Assess risk for a policy exception

---
title: Assess risk for a policy exception
description: After the review of a policy exception request and before deciding to approve or reject a request, the compliance manager may choose to request a risk assessment by the risk manager.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/governance-risk-compliance/grc-risk-management-workspace/assess-the-risk-on-policy-exception.html
release: brazil
product: GRC: Risk Management Workspace
classification: grc-risk-management-workspace
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Assess risks, Use, Risk Management, Governance, Risk, and Compliance]
---

# Assess risk for a policy exception

After the review of a policy exception request and before deciding to approve or reject a request, the compliance manager may choose to request a risk assessment by the risk manager.

## Before you begin

Role required: compliance manager

## About this task

For more information, see [Manage policy exceptions and extensions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/governance-risk-compliance/policy-and-compliance-management/manage-policy-exceptions.md).

## Procedure

1.  Navigate to **All** > **Policy and Compliance** > **My Policy Exceptions**.

2.  Select the policy exception.

3.  Review the form details, as necessary.

4.  Click the Business Impact Analysis tab and update the following fields:

<table id="table_epy_qrq_f5"><thead><tr><th>

Field

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Risk description

</td><td>

Description of the risk.

</td></tr><tr><td>

Residual likelihood

</td><td>

Likelihood of the risk occurring. If it is not **None**, select the likelihood of this risk occurring:-   **5 — Extremely Likely**
-   **4 — Likely**
-   **3 — Neutral**
-   **2 — Unlikely**
-   **1 — Extremely Unlikely**


</td></tr><tr><td>

Residual impact

</td><td>

Residual impact of the risk. If it is not **None**, select the residual impact of this risk:-   **5 — Very High**
-   **4 — High**
-   **3 — Moderate**
-   **2 — Low**
-   **1 — Very Low**


</td></tr><tr><td>

Residual score

</td><td>

Value calculated after you select a residual likelihood and residual impact rating:-   **5 — Very High**
-   **4 — High**
-   **3 — Moderate**
-   **2 — Low**
-   **1 — Very Low**


</td></tr></tbody>
</table>5.  Perform one of the following actions.

<table id="choicetable_qjq_2vw_x1b"><thead><tr><th align="left" id="d335160e239">

Option

</th><th align="left" id="d335160e242">

Action

</th></tr></thead><tbody><tr><td id="d335160e248">

**To view or add impacted controls to the policy exception**

</td><td>

1.  Click the Impacted Controls tab.
2.  Click **Add** or **Add All**.
3.  Choose the controls to associate to the policy exception.


</td></tr><tr><td id="d335160e275">

**To view mitigating controls on the policy exception**

</td><td>

Click the Mitigating Controls tab.

</td></tr><tr><td id="d335160e287">

**To view or add risks to the policy exception**

</td><td>

Click the Risks tab.

 **Note:** This option is available when Governance, Risk, and Compliance is also activated.

</td></tr><tr><td id="d335160e305">

**To view or add approvers to the policy exception**

</td><td>

Click the Approvers tab.

</td></tr><tr><td id="d335160e321">

**To view or add task service level agreements to the policy exception**

</td><td>

Click the Task SLAs tab.

</td></tr></tbody>
</table>6.  Click **Update**.


**Parent Topic:**[Assess risks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/governance-risk-compliance/grc-risk-management-workspace/assess-risk-old-way.md)