Question - Policy Exceptions Open/Close status

[dzl]

We use the Policy Exceptions module for several scenarios. For example, we manage remote working requests where users may need to work from a foreign country that is typically blocked by our firewalls. In these cases, we log the request, set the “Valid From” and “Valid To” dates, and mark the status as “Open.”

Often, different employees request access to the same country at different times. Previously, we could close an exception and then reopen it when needed, allowing us to maintain a single record for that country and track multiple requests against it.

However, since upgrading to version 3.29.1, it is no longer possible to reopen a closed policy exception from the Status dropdown and also you cannot extend the Valid to date, these two fields are greyed out. I haven’t found any documentation or discussion explaining this change, and I’m interested in understanding the reasoning behind it.

As a result, we now appear to need to create multiple exception records for the same country, which could lead to duplication and additional administrative overhead.

Any insights or comments would be greatly appreciated.

[kisero]

@dzl

Often, different employees request access to the same country at different times. Previously, we could close an exception and then reopen it when needed, allowing us to maintain a single record for that country and track multiple requests against it.

yes, the exception expiration date can only be modified if the exception is open, if it is closed, well, it is closed. you are right, in the past the logic allowed you to change the expiration field if the exception is closed, we did not want that anymore.

@dzl

I haven’t found any documentation or discussion explaining this change, and I’m interested in understanding the reasoning behind it.

yes, we are in the progress of updating the documentation this week until next week. the reason is basically that if something is closed then is closed.

• if a new expcetion is required a new one needs to be created.
• if an exception deadline is due and the decision is to extend it, then it can be extended.

this applies to all other exceptions (risk and compliance) and findings (OA , Account Reviews, Etc). Audits also in the past could be edited once closed, that has also been modified in the same line.