Policy Exception

Scenario

Exception requests route through managers and compliance, capturing justification, evidence, and final approval.

How it works

Policy exceptions follow a structured escalation path:

1. Submit exception request: any team member files the policy reference, the deviation requested, the business justification, the risk and compensating controls, a requested expiry date, and supporting evidence
2. Manager review: the requester's manager endorses or rejects the business case, with a mandatory comment
3. Compliance assessment: compliance clears the request with conditions or rejects it on regulatory or precedent grounds
4. Senior approval: an admin gives final sign-off on high-impact or precedent-setting exceptions
5. Granted & documented, or rejected: the flow ends on one of two recorded outcomes, keeping the request, conditions, and every approver's reasoning on the audit trail

Any of the three review steps can reject, and a rejection ends the flow on the recorded "Rejected" outcome.

Who uses this

• Spend exceptions
• Access overrides
• Security exceptions
• Process deviations

Why stepbase

Policy exceptions need careful documentation and multi-level approval. stepbase captures the full decision context (justification, evidence, and approver reasoning) so organizations can track precedents and maintain governance standards.