The Blanket Exception Request

Decision: decline the blanket exception; do not simply decline the request. A flat no without an alternative drives the behavior underground.

Why a blanket exception is the wrong instrument:

• It is a policy change executed as an exception, which bypasses the review a policy change would require. If $500 is the right number for trade shows, that belongs in the policy, with Legal review and a documented rationale.
• "Cultural hospitality" is not a legal category. It is a description of intent, not a test. Anti-bribery law turns on the recipient, the purpose, and the record - not on local custom.
• Competitor practice is not a defense. It is relevant only to commercial-fairness arguments, which belong in a business case to management, not in a compliance approval.
• A blanket approval destroys the documentation that evidences good faith. Per-instance records are the program's defense if an enforcement question arises.

What to offer instead:

1. A pre-approved trade-show hospitality standard. Define a fixed package - booth hospitality, modest meals, branded items under a set value - that requires no per-instance approval. This removes the delay that is actually driving the request.
2. A narrow, time-limited exception for non-government commercial customers only, with named event, cap, documentation, Legal sign-off, and reporting to the CCO.
3. A service-level commitment on pre-approval (e.g., 24-hour turnaround) with a named backup approver. Fix the process complaint, not the number.
4. Keep the government-official cap where it is pending Legal review; if the business still wants $500 for officials, route it as a formal policy-change request with a written risk rationale.

Reasoning to state: the request conflates a speed problem with a threshold problem. Solve the speed problem and the threshold argument usually weakens.

Principle: rationalize by risk and by decision, not alphabetically. Do not attempt a full rewrite.

First 30 days - inventory and stabilize

• Build a register of all 47 policies: owner (or "none"), last review date, risk tier, related regulation, systems that reference it.
• Immediate control fix: populate the portal with current versions only, add a "current version" banner and review date to every document, and archive superseded versions in a read-only location. This alone resolves the "can't find the current version" complaint.
• Identify the 12 conflicting approval thresholds and publish a single authoritative thresholds table that overrides all policy text until the documents are reconciled. This is the highest-value fix in the entire project.

Days 30–90 - consolidate the top tier

• Collapse the 47 into a hierarchy: Code of Conduct → 8–10 core policies → standards and procedures.
• Start with the 10 highest-risk policies (GHE, third parties, anti-bribery, conflicts, investigations, non-retaliation, data, trade, quality, antitrust). The remaining 37 wait.
• Assign a named owner to each core policy, with ownership written into the job description and review dates in the compliance calendar.

What to deliberately not do: do not rewrite all 47 at once; do not create a new policy to fix a policy-finding problem; do not launch an attestation campaign until the documents are clean, or you will attest thousands of people to conflicting text.

Measure it: search success rate in the portal, helpdesk tickets asking "which version," and number of policies past review date.