Risk Response and Reporting · Topic 3 of 9
Issues, Findings, Exceptions and Exemptions Management
CRISC issue management: logging findings, tracking remediation, policy exceptions versus exemptions, compensating controls, expiry and escalation.
- 4 min
- Issues and findings need owners, plans, dates and evidence-based closure.
- A significant control failure should trigger a review of related risk ratings.
- Exceptions are temporary with expiry; exemptions are longer term but still reviewed.
What it is
An issue is a known problem that needs action, such as a control failure, an incident root cause or a compliance gap. A finding is an issue raised by an assessment, audit, test or regulator. Both need an owner, a remediation plan and tracking to closure.
An exception is an approved, temporary deviation from a policy or standard. An exemption is a longer-term or permanent release from a requirement, usually because the requirement does not fit a specific case. Both create risk that must be understood and approved at the right level.
How it works
Sources of issues and findings
| Source | Example |
|---|---|
| Internal audit | Access reviews not performed for two quarters |
| External audit or regulator | Inadequate incident reporting process |
| Control testing and self-assessment | Backup restore tests failing |
| Incidents and near misses | Root cause analysis finds weak change control |
| Vulnerability scans and penetration tests | Exposed administration interface |
| Risk assessments | Missing control for a new scenario |
The issue log
A central log, often linked to the risk register, records each issue with an ID, description, source, related risk, rating, owner, action plan, due date and status. Ratings use the same criteria as risks so priorities are consistent.
Linking issues to risks matters. A failed control raises the residual risk of every risk it protects, so the risk ratings should be reviewed when a significant issue is logged.
Remediation and closure
Remediation plans need specific actions, owners and dates. Closure requires evidence that the fix works, not just a statement that it was done. For significant findings, the practitioner or the original finder should validate the evidence before closing.
Overdue items are escalated according to policy. A growing number of overdue high-rated issues is a useful KRI and a sign of weak risk culture or resourcing.
Exceptions and exemptions
| Exception | Exemption | |
|---|---|---|
| Duration | Temporary, with an expiry date | Long term or permanent, still reviewed periodically |
| Typical reason | Cannot comply yet, such as waiting for a system upgrade | Requirement does not reasonably apply to this case |
| Expectation | Return to compliance by the expiry date | Alternative arrangement accepted on an ongoing basis |
A sound request records:
- The requirement that will not be met and why.
- The risk created, assessed with normal criteria.
- Compensating controls that reduce the risk.
- The approver, who must have authority for that level of risk, usually the risk owner and, for high risk, senior management.
- An expiry or review date.
Exceptions should be tracked in a register and reported. Many exceptions against the same policy may mean the policy itself is unrealistic and needs review.
Compensating controls
A compensating control provides alternative protection when the required control cannot be used. For example, if a legacy system cannot enforce password complexity, extra monitoring and network restrictions may compensate. A compensating control should address the same risk and be tested like any other control.
A worked example
An audit finds that a manufacturing plant's control systems use shared administrator accounts, which breaches the access standard. The vendor will not support individual accounts until a system upgrade in 18 months.
The plant manager requests an exception. The practitioner assesses the risk as high, and agrees compensating controls: a password vault that checks out the shared credential to named users, session recording and quarterly review of logs.
The chief operating officer approves the exception with an 18-month expiry. The audit finding is linked to the exception and the risk register, and the practitioner tracks the upgrade.
How the exam asks about this
- "What is the MOST important element of a policy exception request?" An assessment of the risk created and approval by someone with the authority to accept it.
- "Many exception requests are received against the same standard. What should the practitioner do FIRST?" Review whether the standard is still appropriate for the business.
- "What BEST confirms that an audit finding has been remediated?" Evidence that the fix is in place and operating, validated before closure.
What to remember for the exam
- Issues and findings need owners, plans, dates and evidence-based closure.
- A significant control failure should trigger a review of related risk ratings.
- Exceptions are temporary with expiry; exemptions are longer term but still reviewed.
- Approval must come from someone with authority for the risk level.
- Many exceptions to one policy suggest the policy needs review.
An exception with no expiry date quietly becomes permanent risk acceptance. If an option grants an open-ended exception, it is a weak answer.
Common mistakes
Closing findings on the owner's word. Closure needs evidence that the fix works.
Approving exceptions at too low a level. The approver must have authority to accept the resulting risk.
Keeping the issue log separate from the risk register. Without links, control failures do not change risk ratings.
Check yourself
What is the difference between an exception and an exemption?
An exception is a temporary approved deviation with an expiry date, while an exemption is a longer-term release from a requirement that does not reasonably apply.
What should happen when a significant control issue is logged?
The ratings of the risks that control protects should be reviewed, because residual risk may now be higher.
What is a compensating control?
An alternative control that reduces the same risk when the required control cannot be implemented.
Topic 3 of 9 in Risk Response and Reporting
Test yourself on Risk Response and Reporting
The full ISACA CRISC question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.