---
sourceDocument: Zurich Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/governance-risk-compliance

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# Define policy exception approval rules

# Define policy exception approval rules {#ariaid-title1}

* Release version: Zurich
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Approval rules define the criteria (risk rating, policy or control objective) that is
used for sending approval requests for an exception. Rules can be configured for an
application and you can identify multiple levels of approvers, as needed.

## Before you begin

Role required: sn_compliance.manager

## About this task

You can configure approvals to be sent out automatically or manually after review.  
Note:  
When policy exceptions are created from upstream applications (from Vulnerability Response for example), the policy exception must have impacted controls present before you can request approval.

For policy exceptions created using Policy and Compliance Management, exceptions can be requested for a policy without impacted controls being present, even if both policies and control objectives are added to the exception form. However, for policy
exceptions created for control objectives alone, impacted controls must be present before you can request approval.

You can also use the GRC Approval Configurator to configure policy exception rules. For more information, see [Define the policy verification rules](https://www.servicenow.com/docs/bJeGZWtgFu9snLuCictN1g "Configure granular approval rules for policy exceptions and extensions by using the GRC Approval Configurator. This allows you to manage approvals with precise rule definitions and support multi-level approval workflows.").

## Procedure

1. Navigate to AllPolicy and CompliancePolicy ExceptionsApproval Rule.
2. Click New.
3. On the form, fill in the fields.  
   {#define-approval-rules__table_klc_gq4_plb__entry__2}

   | Field | Description |
   |-|-|
   | Type | Defaults to Approval Rule. |
   | Name | Enter a name for this approval configuration. |
   | Short description | Provide a brief description of the purpose of the configuration. |
   | Source application | Select the application for that applies to this approval rule. Only applications that have been previously added to the Integration Registry are listed. |
   | Active | If this is selected, this approval rule is active. |
   | Risk rating | The risk rating is determined by running a risk assessment on the policy exception. |
   | Policy | Select the policy against which this policy exception is being applied. |
   | Control objective | Select the control objective that references the selected policy. |
   | Auto-trigger approvals | Select this check box to automatically trigger all approvals after the review is completed. If you do not select it, the compliance manager can manually trigger the approvals defined by this rule. |
   | Order | Order defines the precedence of triggering this rule as compared to another rule that is applicable to the exception and defined with similar criteria. |
   [Table 1. Approval Configuration form]

   {#define-approval-rules__table_klc_gq4_plb}
4. Click Update.  
   The Approver Levels related list appears. This related list allows you to define multiple approver levels for a rule. One or more users, or a group of users can be selected as approvers for each level.
   Approvers must be assigned the survey_reader role. You can make it mandatory for all selected users to approve the exception or
   optionally allow a single user to approve on behalf of all approvers.
5. Click New.
6. On the form, fill in the fields.  
   {#define-approval-rules__table_xlt_4sg_rlb__entry__2}

   | Field | Description |
   |-|-|
   | Name | Enter a name for this approval level. |
   | Description | Provide a brief description of the approval level. |
   | Required approval | Select One approval required to allow a single user to approve on behalf of all approvers. Select All users must approve to make it mandatory that all designated users approve the selection. |
   | Users | Select one or more users to act as policy exception approvers. |
   | Groups | Select one or more groups to act as policy exception approvers. Note: Users who belong to the group must have GRC business user (sn_grc.business_user) role. |
   | Order | Select the order to determine the sequence of levels used with respect to other levels (that is, order 1 is displayed first). |
   [Table 2. Approver Level form]

   {#define-approval-rules__table_xlt_4sg_rlb}
7. Click Submit.  
   If you selected the Auto-trigger approvals check box, the designated approvers are notified that their approvals are required. Alternatively, the approvers are notified when the compliance manager clicks the Send for Approval button.

*[\>]: and then