Exception Handling

The handling of exceptional circumstances must be taken into account by management in the analysis and reporting of organizational performance.

Once a finding or indicator establishes that a control is not achieving the agreed-upon level of risk reduction, the usual response is to improve the control.

In certain circumstances, the appropriate response is to change the risk tolerance to align with control performance.

The Change Management process must engage the information system's owner to determine the proper course of action. If the circumstance is temporary, and the system owner is willing to accept the risk, the Change Management process should document the circumstances and flag the exception for review at an agreed-upon time or event.

If the owner is not willing to accept additional risk, the system owner must either resource the additional control for the process or take other actions which address the new level of risk. Regardless, exceptions must be documented, authorized and reviewed.