Question

A business unit cannot meet a corporate password-complexity standard because a legacy application does not support it. Management requests that the risk practitioner grant a formal exception so the application can remain in production. What is the MOST important element to include when documenting this exception?

Accepted Answer

A defined expiration date with a scheduled review by the accountable risk owner

Answer

A statement that internal audit has reviewed and approved the deviation

Answer

A calculation of the annualized loss expectancy for the affected application

Answer

A commitment to remove the application from the risk register once the exception is signed