Your architecture waiver register has 340 open exceptions, 60% past their expiry date. What does this tell you and what do you do?

What the interviewer is testing

Whether you can read a governance artifact as a diagnostic rather than as a backlog.

What it tells you

The standards are not achievable as written, or the paved road is missing capabilities. 340 exceptions is not 340 unusual cases; it is a systematic signal that teams cannot comply through the supported path.

Expiry is not enforced, so waivers are effectively permanent and the standard has quietly become optional.

Nobody has aggregated the risk. Each waiver was individually defensible when granted. The aggregate — what the organisation has collectively accepted — has never been assessed, and that is the exposure the governance function exists to prevent.

What to do

Cluster the waivers by cause. They will collapse into a small number of themes — a standard that is impractical for a whole class of workload, a capability the platform does not provide, a control that is technically impossible for legacy systems. Each theme is one fix that closes dozens of waivers.

Fix the causes. Where the same exception is requested repeatedly, the standard is wrong or the paved road has a gap. That is a backlog item, not a waiver, and it is the highest-leverage response.

Amend standards that are systematically waived. A standard nobody can meet is not a control; it is an administrative burden that produces paperwork.

Re-triage the remainder by actual risk, and close the low-risk ones by amending the standard or accepting them permanently with reasoning. Reserve the process for genuinely material risk.

Then enforce expiry — automatic review triggers, and no silent lapse.

Report the aggregate, risk-weighted, upward. That is what prompts the investment that fixes the underlying causes.

What a strong answer adds

Changing the default: automated guardrails mean compliance requires no effort, which removes most of the waiver demand at source. A register this size usually indicates governance by document rather than by mechanism.

Common weak answers

Chasing 340 owners for renewals. Cancelling all expired waivers, which breaks production systems that depend on them.