Headline: Controls Fail — The Question Is Whether You're Managing the Failure Effectively
The Exception Reality
Controls fail. The question isn't whether they fail, but whether you're managing exceptions effectively.
What is a control exception?
A control exception occurs when a control is not operating as designed or is not achieving its objective.
The Exception Lifecycle
1. Identification
Exceptions can be identified through:
- Control monitoring
- Control testing
- Internal audit
- External audit
- Incident response
- Employee reports
2. Assessment
When an exception is identified, assess:
|
Question |
Consideration |
|
What is the impact? |
Business, regulatory, operational |
|
What is the root cause? |
Why did the control fail? |
|
What is the risk? |
What is the residual risk? |
|
What are the compensating controls? |
Are there other controls that mitigate the risk? |
3. Remediation
Develop and implement a remediation plan:
- Identify the root cause
- Develop corrective actions
- Assign ownership
- Implement remediation
- Verify the fix
- Update controls
4. Approval
Exceptions may require formal approval:
|
Exception Type |
Approval Required |
|
De minimis |
Minimal risk, no approval needed |
|
Low impact |
Control owner approval |
|
Medium impact |
Business owner approval |
|
High impact |
Executive approval, board reporting |
5. Tracking
Track exceptions through resolution:
- Exception ID
- Control affected
- Impact assessment
- Root cause
- Remediation plan
- Owner
- Status
- Target date
- Approval date
Compensating Controls
When a control fails, compensating controls may mitigate the risk:
|
Primary Control Failed |
Compensating Control |
|
Automated access review not run |
Manual review by manager |
|
Firewall rule misconfigured |
IPS/IDS alerting |
|
MFA not enforced |
Enhanced monitoring |
|
Patch not applied |
Additional monitoring |
The Exception Governance Framework
Key elements:
- Exception policy: Defines when exceptions can be accepted
- Exception process: Defines how exceptions are managed
- Exception authority: Defines who can approve exceptions
- Exception reporting: Defines how exceptions are reported
Key governance questions:
- Are exceptions documented?
- Are they approved by the right authority?
- Are they reviewed regularly?
- Are they tracked to resolution?
Conclusion
Controls fail—the question is whether you're managing exceptions effectively. Organizations with a structured exception management process will identify, assess, and remediate control failures quickly, reducing risk exposure.
Action Items for Your Organization
- Establish an exception management policy
- Define the exception process
- Assign exception authority
- Implement exception tracking
- Review exceptions regularly
- Track exceptions to resolution
