Workflow Template

Policy Exception Request Workflow

Manages requests to deviate from organisational policy: intake, risk assessment, risk-based approval routing (policy owner for low risk, compliance manager for high risk), notification of outcome, and an expiry review with renewal or closure.

Policy exceptions often get requested by email, approved informally, and forgotten until an auditor asks who signed off and when it expires. This workflow gives requesters a form to submit exceptions, has a risk reviewer assess risk level and conditions, routes approval to the policy owner or compliance manager based on risk, and runs an expiry review that closes or renews the exception. Risk reviewers, policy owners, and compliance managers each handle their assigned tasks, while requesters get status updates by email without needing an account.

Business Outcomes

Helps standardise how exception requests are captured and assessed
Supports faster routing of approvals based on risk level
Reduces reliance on email threads to track exception status
Makes it easier to see which exceptions are approaching expiry
Improves visibility into who approved each exception and why

Workflow Steps

Steps

1
Create Policy Exception Recordcreate record
Registers the submitted policy exception request as a record.
2
Set Status to Submittedupdate record
Sets the exception status field to Submitted.
3
Send Acknowledgement Emailsend email
Emails the requester an acknowledgement with their reference number.
4
Set Status to Risk Reviewupdate record
Sets the exception status field to Risk Review before the risk reviewer's task is created.
5
Risk Reviewer: Assess Exceptioncreate task
Creates a task for the risk reviewer to assess risk level, compensating controls, conditions and expiry date.
6
Save Risk Review to Recordupdate record
Persists the risk reviewer's assessment to the record.
7
Route on Risk Level
Routes low-risk exceptions to the policy owner and high-risk exceptions to the compliance manager for approval.
risk_level: "Low"→Policy Owner Approval
risk_level: "High"→Compliance Manager Approval
Default→Policy Owner Approval
8
Policy Owner Approvalrequest approvalrequires approval
Requests approval from the policy owner for the low-risk exception.
9
Route Policy Owner Outcome
Routes the workflow based on the policy owner's approval decision.
approval_status: "approved"→Set Status to Approved
approval_status: "rejected"→Set Status to Rejected
Default→End
10
Compliance Manager Approvalrequest approvalrequires approval
Requests approval from the compliance manager for the high-risk exception.
11
Route Compliance Manager Outcome
Routes the workflow based on the compliance manager's approval decision.
approval_status: "approved"→Set Status to Approved
approval_status: "rejected"→Set Status to Rejected
Default→End
12
Set Status to Rejectedupdate record
Sets the exception status field to Rejected.
13
Send Rejection Emailsend email
Emails the requester that the exception request was not approved.
14
Set Status to Approvedupdate record
Sets the exception status field to Approved.
15
Send Approval Emailsend email
Emails the requester that the exception is approved, with conditions and expiry date.
16
Risk Reviewer: Expiry Reviewcreate task
Creates a task with no due date for the risk reviewer to review the exception on its expiry date and record the outcome.
17
Save Expiry Review to Recordupdate record
Persists the expiry review outcome and notes to the record.
18
Route on Expiry Review Outcome
Routes based on whether the exception should be closed or renewed.
expiry_review_outcome: "Renewal needed"→Send Renewal Needed Email
expiry_review_outcome: "Closed"→Set Status to Expired
Default→Set Status to Expired
19
Send Renewal Needed Emailsend email
Emails the requester asking them to submit a new exception request for renewal.
20
Set Status to Expiredupdate record
Sets the exception status field to Expired.

Fields

Show all 15 fields

FormPolicy Exception Request

Requester Name*· Text
Requester Email*· Email
Policy*· Text
Exception Requested*· Long text
Business Justification*· Long text
Scope*· Long text
Compensating Controls· Long text
Requested Duration (months)*· Number

TaskRisk Reviewer: Assess Exception

Risk Level*· Choice
Compensating Controls Assessment*· Long text
Conditions· Long text
Expiry Date*· Date

TaskRisk Reviewer: Expiry Review

Expiry Review Outcome*· Choice
Expiry Review Notes· Long text

Other fields

Exception Status· Choice

Requester Name*
Requester Email*
Policy*
Exception Requested*
Business Justification*
Scope*

Forms

Policy Exception Request

8 fields

Data Views

Policy Exceptions

policy, exception_requested, risk_level, expiry_date +1 more

Dashboard Widgets

Exceptions by Exception Status

Recommended integrations

Setup the following integrations to extend workflow capability.

Send email in the workflow
AWS SES

policy exceptionpolicy waiverexception requestrisk acceptancecompliance exception

Similar Workflows

Policy Review and Approval Workflow Risk Assessment Workflow Security Exception Workflow

Similar Categories

Governance & Compliance Risk Management Cybersecurity & Privacy

FAQs

How do I set up this workflow for my team?

Publish the template and it runs live immediately, no installation needed. You'll assign who acts as risk reviewer, policy owner, and compliance manager for tasks and approvals, and the request form is ready for requesters to use straight away.

Who submits the exception request, and do they need an account?

Requesters submit through a public request form with fields like Policy, Exception Requested, Business Justification, Scope, and Compensating Controls. They never need an account, and all follow-up communication happens by email using their reference number.

How does the workflow decide who approves the exception?

After the risk reviewer assesses the request and sets a Risk Level, the workflow routes low-risk exceptions to the policy owner and high-risk exceptions to the compliance manager for approval. Each approver's decision then determines whether the record moves to Approved or Rejected.

What happens if the exception is rejected?

If either the policy owner or compliance manager rejects the request, the record status is set to Rejected and the requester receives an email letting them know the exception was not approved. This outcome is recorded in the record's timeline.

What does the risk reviewer actually assess?

The risk reviewer completes a task to assess Risk Level, Compensating Controls, Conditions, and an Expiry Date. Because the workflow waits for this task, all of these values are saved directly to the record before approval routing happens.

How does the expiry review work?

The risk reviewer gets a task with no due date to review the exception on its expiry date and record an Expiry Review Outcome and Notes. Depending on that outcome, the workflow either emails the requester asking for a renewal request or sets the record status to Expired.

Can I change the approval steps or add more reviewers?

Yes. You can describe the change you want in plain English, or edit the steps directly in the workflow editor. Earlier versions of the workflow are kept, so you can see what changed.

Can requesters check the status of their exception request?

Requesters receive email updates at key points — acknowledgement, approval, rejection, and renewal — each referencing their reference number. Internally, the record's status and timeline show exactly where the request stands at any time.

Does this workflow keep a record of who approved what?

The record's timeline logs each status change and the assessment, approval and expiry review details entered by staff. Each business should confirm this level of record-keeping meets its own compliance obligations.

Ready to use this workflow?

Create a free account and customise this workflow for your business.