A county IRM lead discovers several compensating controls that have quietly become permanent workarounds for open policy exceptions. What should the compliance team validate first?
Select an answer to reveal the explanation.
Short Explanation
Think of a compensating control like a spare tire: fine for the drive home, not forever. Keep it temporary, dated, and tied to the open exception so nobody pretends the spare is the new permanent wheel.
Full Explanation
In ServiceNow Policy and Compliance, compensating controls are interim mitigations tied to open exceptions or failed controls. Compliance supporting processes should monitor that they remain temporary, have owners and end dates, and stay linked to the exception until remediation or formal risk acceptance. Promoting them silently, deleting them without coverage, or auto-closing exceptions hides residual compliance risk.