The Exception That Outlived Its Expiry

The accountable owner should be the business process owner for policy administration, not the CISO and not the infrastructure team. The business owner bears the operational and financial consequence of an outage or breach, so that is where accountability sits. The CISO owns the risk framework, challenges the scoring, and recommends; the board risk committee approves only if the residual score still exceeds the board-approved appetite after compensating controls. A CISO cannot unilaterally accept a risk that belongs to the business.

The record should contain: (1) inherent and residual scores with the rationale for each, including the 5x5 inputs and the data classifications affected; (2) the exact scope - two application servers, the claims integration, and the shared admin accounts - not a vague 'policy platform'; (3) each compensating control, its owner, and independent test evidence, because an untested control is an assertion; (4) the acceptance period and expiry date with a hard revalidation trigger; (5) KRIs such as failed admin logons, WAF blocks, patch attempts, and segmentation violations; (6) conditions, for example MFA on admin access before renewal; (7) remediation milestones and funding; (8) signatures and date. The point is to make the decision auditable and contestable, not to create a form that hides the residual risk.

Renewal should not be automatic. The decision logic is: first establish what residual risk actually is. If the firewall segmentation and WAF have never been independently tested, the residual score of 16 is an estimate, not evidence. Before attestation, commission a narrow validation: review firewall rules for the segment, run an authenticated scan from the corporate zone to the application segment, test WAF bypass against the claims integration, and verify whether shared local admin credentials are usable from outside. If those tests pass, the existing controls can support a time-bound renewal with conditions. If they fail or cannot be completed in six weeks, do not represent the controls as effective.

The fallback is not 'renew anyway'. It is a short interim acceptance, explicitly labelled untested, with MFA on administrative access as a precondition and a 30-day expiry, plus a funded remediation plan. If the attestation requires an assertion that controls are operating effectively, management must either qualify the statement or disclose the exception in the required form. That is a legal and governance call for the board, not a wording exercise for the CISO. The audit committee should see the options and the consequences of each.

Treat the disagreement as a control weakness in its own right. Management should escalate it to the audit committee with a joint fact base: the risk score, the test results or absence of them, the proposed acceptance, and the regulator's attestation requirement. The three lines model helps: the business owns the risk, the CISO's function sets and monitors controls, and internal audit provides independent assurance. Audit should not be asked to 'sign off' a risk acceptance; it can only opine on whether controls are designed and operating. The CISO should not be able to overrule an audit finding without documented rationale.

Practical steps: agree a 10-day test plan with pass/fail criteria, document any dissent in the risk register, and have the audit committee minute the decision. If acceptance proceeds, record who accepted, what they knew, and when it will be revisited. This protects the organization in a regulatory review and gives the board a real choice rather than a surprise finding later.