Exception & Waiver Management
Time-boxed, owned deviations with a remediation date, rather than permanent silence.
6 to work through
-
intermediate
A platform team introduces time-boxed waivers so that teams can ship against a policy exception with a stated expiry rather than waiting for a fix. Delivery speeds up. What has the organisation given up, and when does that bill arrive?
3 min answer -
intermediate
A standard cannot be met for a legitimate case. What should the exception process look like, and what does the register tell you?
2 min answer -
intermediate
Exceptions to standards are granted and accumulate indefinitely. What should the waiver process look like?
1 min answer -
intermediate
Your exception register has grown from 12 to 90 waivers in eighteen months and none have been closed. What does this tell you and what do you do?
2 min answer -
advanced
Your architecture waiver register has 340 open exceptions, 60% past their expiry date. What does this tell you and what do you do?
2 min answer -
advanced
Your policy gate reads each waiver's expiry at evaluation time and blocks when it has passed. Sixty waivers granted against the same standard during one six-week release freeze all share an expiry date next Tuesday. Walk through what happens from Tuesday morning.
3 min answer
5 terms in this topic
Exception and Waiver Management
The formal process for permitting a deviation from a standard, with a named risk owner, a stated expiry and a remediation plan.
practiceException Register
A recorded, owned, time-bounded set of approved deviations from a control - which is what makes a control survivable, and whose aggregate is the best…
practiceTime-Boxed Waiver
An approved deviation from a standard that carries an owner, a justification, a compensating control and an expiry date after which it is reconsidered.
patternWaiver as Code
Storing each approved deviation where the enforcement point reads it - rule id, scope, owner, justification, compensating control, expiry - so an exc…
practiceWaiver Expiry
A mandatory end date on every exception to a standard, so that continuing the exception is an active decision rather than the default.
Neighbouring topics
Assurance, Audit & Model Risk
General material on assurance, architectural governance and risk oversight.
Control Design vs Operation
A control that is well designed and never runs fails exactly like one that is absent.
Audit Evidence
Producing durable, tamper-evident proof as a by-product rather than as a project.
Certification Impact on Architecture
What SOC 2 and ISO 27001 actually require of a design, and what they do not.
Continuous Controls Monitoring
Testing controls continuously instead of sampling them once a year.
Segregation of Duties
Splitting authority so no single actor can both make and approve a change.
Change Advisory vs Automated Gates
Replacing a weekly board with evidence a machine produces on every change.
Risk Appetite
The stated tolerance that tells you which risks you are allowed to accept.
Risk Assessment Methods
Qualitative matrices, FAIR and scenario analysis, and the illusion of a precise score.
Security Design Review
Reviewing an architecture for security while changing it is still cheap.
Architecture Compliance Checks
Automating conformance to standards so review effort goes to the genuinely novel.
Design Authority
How an ARB should decide, what it should not review, and how it avoids becoming a queue.
Three Lines Model
Ownership, oversight and independent assurance, and where architecture sits in it.
Model Risk Management
Inventory, validation, monitoring and challenge for models that make consequential decisions.
AI Risk Tiering
Classifying a use case by potential harm, and the obligations each tier triggers.
Model Documentation
Model cards, intended use, limitations, and the record a regulator will ask for.
Model Evaluation & Red-Teaming
Adversarial testing of a probabilistic system with no fixed expected output.
Bias & Fairness Controls
Measuring disparate outcomes, choosing a fairness definition, and living with the trade-off.
Human-in-the-Loop Design
Meaningful review rather than a rubber stamp, and designing against automation bias.