Create a GRC Exemption

Enter a GRC Exemption to document and gain approval for non compliance with an Audit, Risk, or Policy.

To create an Exemption:

1. On the CSM Desktop Client or Browser Client toolbar, select New > New GRC Exemption.
2. Select the exemption type and requester.
   A tab for the exemption type association will also display in the form arrangement.
3. Add details for the current use and reason for the exemption.
4. Select an exemption term in months and (optional) a device type.
5. Select the assigned team and owner.
   The assigned team will drive the options available in the Assigned To drop-down list.
6. (Optional) Provide details in the Mitigation field.
7. Depending on the exemption type and device type you chose, there may be additional fields to complete (example: GRC Audit, Asset, Device Name).
8. Select Save if you need to come back to the form later to submit it.
9. When the Exemption form is complete, select the Next: Submitted link under Status.
   While in the Submitted phase, the assigned team reviews the request and determines if more information is required.
10. When the Exemption is ready for approval, select the Next: Approving link under Status.
    An Approvals tab appears in the form arrangement.
11. The approver can vote to Approve, Deny, or Abstain, as well as provide comments. Add additional approvers, if necessary. If there are multiple approvers, each will need to provide approval before the Exemption can move to the next step.
    The approver for the Exemption is determined by the Exemption Type:

    Exemption Type	Approver
    Risk	Risk Owner
    Audit	Lead Auditor
    Policy	Business Owner

12. Once the Exemption is approved, the status changes to Active.
    If the Exemption is approved and the status is not Active, select the green refresh button.
13. Close the Exemption when it is no longer applicable.