Track six numbers: active exceptions, how old they are, how many were renewed, how many expire soon, how many have a valid owner, and how long approvals take. Together they show whether exceptions are a controlled safety valve or a growing pile of ignored risk.
Why measure exceptions at all
A single count tells you little. Fifty exceptions can be healthy if all are short, owned and reviewed. Five can be dangerous if all are two years old. The metrics below describe the behavior of the process, not just its size.
The six metrics
| Metric | What it shows | Warning sign |
|---|---|---|
| Active exceptions, by risk level | Size and mix | Growth in high-risk items |
| Age distribution | Whether time limits mean anything | A long tail past the policy maximum |
| Renewal rate | Whether teams fix or just extend | Many items on a second or third renewal |
| Expiring in 30 days | Upcoming workload | Spikes with no plan |
| Owner and approver validity | Orphans | Any exception with an inactive owner |
| Time to decision | Process friction | Slow approvals push people to bypass |
How to calculate them well
- Define the clock. Age runs from approval, not from when the finding was first seen.
- Count renewals per exception, not per month, so a chain of three renewals is visible.
- Split by exposure. Internet-facing exceptions deserve their own line.
- Keep the denominator. Express exceptions as a share of all open findings, so the story survives growth.
Read them together
Rising renewals plus a long age tail means teams are extending, not fixing. Slow decisions plus a rising count of break-glass overrides means the process is too heavy. Many expiring items plus a low owner-validity score means expiry is coming with nobody to act. Pair this with the lessons in sla compliance rate hides the overdue tail.
Report to leadership
One slide is enough: the six numbers, trend over the quarter, and the three oldest high-risk exceptions with owners and dates. Leaders can ask the right question, which is why those three have not been fixed.
Do not game them
If a team is judged on zero exceptions, they will stop recording them and suppress findings instead. Judge the process on honesty and closure speed, not on the count alone.
Where Safeguard fits
Safeguard tracks findings, waivers and policies centrally and supports compliance evidence automation, which gives you the data for these metrics without a manual export each month.
Quick check
What is a good number of active exceptions?
There is no universal figure. Judge age, renewals and ownership. A small number that is old and unowned is worse than a larger number that is current.
How often should we review these metrics?
Monthly for the security team, and quarterly for leadership.
Last reviewed: 19 October 2026.
