Decisions
Exceptions, decisions & reassessment
Exceptions and conditional decisions must remain bounded, accountable, and reviewable rather than silently weakening a control.
Exceptions
- Record the requirement or control affected, rationale, compensating measures, accountable owner, and expiry.
- Route the exception through the required approval path and preserve the decision record.
Decision Ledger
The ledger preserves the accountable outcome, rationale, approvers, evidence context, conditions, expiry, revocation, and later reassessment so teams can explain what authority existed at a point in time.
Reassessment
Reassessment revisits affected governance work after a material change, expired decision, monitoring breach, incident, regulatory update, or vendor change. It should lead to a renewed or changed decision when prior authority is no longer valid.