---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Exception questionnaire scenarios for vulnerable items

# Exception questionnaire scenarios for vulnerable items {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
The questionnaire displayed when a user requests an exception on a vulnerability item depends on which questionnaires are configured in the exception management record and which request type is selected.

## Workspace exception questionnaire behavior {#sem-exception-ques-scenarios__section_workspace_scenarios}

In the workspace, users can request a deferral, risk reduction, or both when raising an exception on a vulnerability item. The following table shows which questionnaire is displayed for each combination of configuration and request type.
{#sem-exception-ques-scenarios__section_workspace_scenarios__entry__4}

| Exception questionnaire configured | Compensating control questionnaire configured | Request type selected | Questionnaire displayed |
|-|-|-|-|
| Yes | Yes | Deferral only | Exception questionnaire |
| Yes | Yes | Deferral and risk reduction | Compensating control questionnaire |
| Yes | Yes | Risk reduction only | Compensating control questionnaire |
| Yes | No | Deferral only | Exception questionnaire |
| Yes | No | Deferral and risk reduction | None --- request submitted directly |
| Yes | No | Risk reduction only | None --- request submitted directly |
| No | Yes | Deferral only | None --- request submitted directly |
| No | Yes | Deferral and risk reduction | Compensating control questionnaire |
| No | Yes | Risk reduction only | Compensating control questionnaire |
| No | No | Any | None --- request submitted directly |
[Table 1. Questionnaire display by configuration and request type]

Important:  
When risk reduction is selected (with or without deferral), the compensating control questionnaire takes priority over the exception questionnaire. If the compensating control questionnaire is not configured, the exception request is submitted directly even when an exception questionnaire is configured.

## Classic UI behavior {#sem-exception-ques-scenarios__section_classic_behavior}

In the classic UI, compensating control is not supported. All exception requests default to deferral, and only the exception questionnaire is displayed when configured. The risk reduction option and compensating control
questionnaire don't apply in the classic UI.