Exceptions Register

Original name

Original description

Maintain a defensible register of accepted residual risks and control exceptions that persists in a local file, so an auditor, a regulator or a board can be shown what the organisation knowingly accepted, on what basis, who approved it, and whether that reasoning is still valid. Records two object types with one lifecycle — acceptances and exceptions with their compensating controls — and refuses any record missing an approver, a justification or a re-validation date. Re-validation is recorded as an act with a rationale, never a timer reset. Derives current, due, overdue and expired status from the dates, exports the active inventory as the CSV or JSON evidence artifact a DORA or NYDFS reviewer asks for, and produces a board section whose language comes from ciso-board-translation. Use when asked to log or approve an exception or waiver, record a risk acceptance with its approver and expiry, run a re-validation review, list what is overdue for re-validation, or produce the risk-acceptance inventory. Accepted risks already in a risk register are fed in one-way with that skill's export-acceptances; this skill is the system of record for the lifecycle, and the register does not duplicate it.