An exception whose owner has left is orphaned: nobody tracks its fix plan, retests its controls or answers when it expires. Find these by matching exception owners against your directory, reassign each to a named person or team, and make offboarding check for owned exceptions.
Why orphans are dangerous
The approval was given on the strength of a plan and a person. The person is gone, so the plan has no driver. Expiry dates still arrive, but notifications go to a closed mailbox. The exception then either lapses unnoticed or, worse, stays in place because nothing reopens it.
Auditors who sample exceptions will ask who owns this one. An answer of "someone who left in the spring" is a finding in waiting.
Find them
- Export all active exceptions with requester, owner and approver.
- Compare each name to the current staff list from your identity provider.
- Flag any exception where the owner or approver is inactive, on long leave, or in a different role.
- Check team ownership too. Reorganizations leave services with no responsible team.
Do this monthly, and always after a large departure or reorganization.
Reassign properly
| Situation | Action |
|---|---|
| Service has a new owner | Reassign, and have them confirm the plan and controls |
| Service is unowned | Escalate to the engineering lead, and treat as a priority fix or retire |
| Approver left | A current approver reviews and re-approves, even if the end date is far off |
| Service is retired | Close the exception, with the decommission as the reason |
Reassignment is a handover, not a rubber stamp. The new owner should re-read the case and check the compensating controls still work. If they will not confirm it, the exception should not continue.
Prevent it
- Owner is a role, with a person behind it. Use a team alias plus a named individual so a departure does not break the chain.
- Offboarding checklist item. The manager lists exceptions, approvals and risk records the person owns. This matches the thinking in soc 2 offboarding evidence.
- Automated check. The register flags an inactive owner and notifies the security lead.
- Short terms. A short expiry limits how long an orphan can sit.
Where Safeguard fits
Safeguard's asset discovery helps you see which services and owners exist, and policies tie waivers to named approvers so reassignment shows up in the audit trail.
Quick check
Does the exception stay valid if the approver leaves?
It can, but a current approver should review and re-approve it soon. The authority came from the person and their role at the time.
Who owns an exception for a service with no team?
Escalate. An unowned service with an accepted vulnerability is a decision for engineering leadership: assign it, fix it or retire it.
Last reviewed: 19 October 2026.
