An expired policy exception: a GRC interview case with two different gaps

An expired exception and an unverified compensating measure are separate questions. Renewing one document does not automatically establish that the measure operated, and showing that the measure operated does not automatically extend an approval.

The following is original fictional interview practice. The dates, requirements and authority are stipulated for this case; they are not universal compliance rules.

Read the three records

Fictional Elm Ledger cannot yet replace a reporting application's shared service credential. Its internal process permits a temporary exception approved by a designated risk owner, with an end date and an explicitly assigned weekly activity review.

Do not assume that the project lead is also the designated risk owner. The case does not establish that.

Write the finding in two parts

First, the supplied approval does not cover July 3. Ask for the current authorization record or the designated decision-maker's documented response. The project lead's expectation is not, by itself, evidence of the required approval.

Second, the supplied review evidence ends before the exception's stated expiry. Ask for the missing period's records and clarify the actual review procedure. Missing records do not by themselves prove that no review occurred; they limit what you can conclude from this packet.

A concise answer is: “I would keep the authorization-period question separate from the operating-evidence question, identify the responsible owners and follow the stated escalation process. I would not close either item merely because the replacement project has a new expected date.”

Now change one fact

The designated risk owner supplies a signed extension through July 31. It was approved on June 28 and retains the weekly review condition.

That can resolve the period question if the record covers the same application, scope and conditions. It does not fill the missing review evidence. Your updated note should name the question resolved and the question still open, rather than leaving the original finding unchanged or declaring everything closed.

If the next record instead shows that all reviews occurred but no extension exists, reverse the conclusion: the operating-evidence question may be resolved while current authorization remains open.

Avoid treating acceptance as the disappearance of risk

NIST's risk-response glossary includes acceptance among several possible informed responses. In this exercise, the useful interview skill is explaining the decision's scope, authority and conditions. You are not being asked to manufacture a numerical risk score or claim that a signature eliminates the underlying exposure.

Make your answer inspectable

Keep a short record with four fields: evidence received, conclusion supported, unresolved item and next owner/action. Revise it when new evidence arrives. Preserve the distinction between a recommendation you drafted and a decision somebody else made.

For a longer practice sequence, compare policy-exception preparation options. The workbook sample and portfolio kit sample show the actual products; this free case is additional teaching material.