|

Risk Management guide

Manage risk exceptions and reassessments

Raise a formal exception for residual exposure above appetite, process the approval decision and create a new assessment version when conditions change.

Risk Manager or Risk Exception Approver Approximately 10–20 minutes Updated 21 September 2026

When an exception is required

If treatment leaves residual exposure above the organisation's risk appetite, PurpleWASP prevents the qualitative assessment from closing without either further reduction or a formal exception request.

Appetite is the decision boundary.

Tolerance does not automatically mean the risk can be closed. A result can be within tolerance and still require an approved exception because it remains above appetite.

1. Raise the exception

  1. Complete the treatment review.
  2. Select the action to complete the assessment.
  3. When prompted, choose to raise an exception rather than returning for more treatment.
  4. Record the justification, review period and required approver.
  5. Submit the exception.

The assessment becomes read-only while the exception decision is pending.

2. Approve or reject the request

A designated exception approver reviews the scenario, residual score, duration and justification in the Risk Exceptions Register.
ApproveAccepts the residual exposure for the defined scope and period and allows the assessment to close.
RejectReopens the assessment so the Risk Manager can add or strengthen treatment.
CloseEnds an exception according to the available governance workflow and recorded reason.

3. Reassess a completed risk

Use reassessment after a review period, material change, control implementation or new threat information.

  1. Open the completed risk and select Reassess Risk.
  2. Start the new assessment version.
  3. Review carried-forward threats, manual weaknesses and controls, then review the current linked technical findings in Technical Exposure.
  4. Remove items that no longer apply, assess newly linked technical vulnerability groups and update exploitability/control-effectiveness/uncertainty where conditions changed.
  5. Complete evaluation and treatment using the current conditions.
A new assessment version begins from the prior residual position while preserving the completed previous version.

Version history

Previous assessments remain available as a stable record. Controls added during earlier treatment can become existing controls in the new version, making the effect of completed work visible.

Technical Exposure follows the same rule: a completed assessment shows the frozen technical findings and factor values captured at completion, while a live reassessment shows the current linked scanner evidence until the new version is completed.

Common problems

The assessment cannot be edited

Check whether an exception is pending. Editing is disabled until the approver decides.

A rejected exception did not close the risk

This is expected. Rejection reopens the assessment for additional treatment.