Labs ยท Audit & compliance
Policy Exception Lab
Take a security policy exception from request to approval in a dummy GRC tool. Keep the scope narrow, set an expiry, rate the risk on the facts, choose compensating controls that really cover the gap, route it to the right approver, then clean up expired and orphaned exceptions.