A department director verbally waived a retention rule for a one-off research extract, and months later no one can prove what was allowed. What should governance require for exceptions?

When a department director verbally waives a retention rule for a research extract, governance must still treat the exception as a controlled asset: document the owner, exact scope, rationale, and a time-bound expiry or review date so compliance can reconstruct what was permitted months later. Verbal exceptions followed by an informal reminder email fail because they leave unverifiable practice and invite policy drift under public-sector scrutiny. Publishing a permanent blanket waiver so future extracts need no review fails by converting a one-off risk acceptance into unmanaged standing permission that undermines retention controls citywide. Deleting the retention policy so exceptions become unnecessary fails by removing the protective control rather than governing a narrow deviation—civic records programs cannot erase schedule obligations to avoid paperwork. Exam caveat: exception handling is not the same as policy repeal; exams expect documented, time-boxed exceptions with named owners. Operational check: route exception requests through a logged path, store them with the policy register, calendar the expiry review, and confirm the extract is stopped or re-authorized when the clock runs out. Municipal counsel and records officers should be able to produce the exception packet during audit without relying on hallway memory of what a director once said.