An exception may proceed only where the risk owner records the commercial need, the unresolved exposure, and the compensating controls.
The conclusion follows the conditions in and the assessment retained with the analysis. The approach is consistent with .
Third-party procurement policy
Any exception must identify the unresolved risk, the accountable owner, the compensating controls, and the date on which approval expires.
Company policyCurrent posted version
Supplier risk assessment.xlsx
Working file84 KB