What a Temporary Exception Does—and Does Not Do
A business decision may have a sound purpose and still fall outside an approved risk appetite or tolerance. A temporary exception is a controlled authorization to accept a specified, limited departure from an internal risk boundary for a defined purpose and period. It is not a way to make the boundary disappear. The underlying appetite remains in force, and the exception must be assessed against the organization’s governance policy and delegated approval authority.
An exception is different from recognizing a breach after it has occurred. A request made before a planned departure can be assessed and, if permitted, approved with safeguards. An unexpected breach requires prompt escalation and response under the applicable process; it does not become authorized merely because someone later labels it an exception. An exception also differs from changing the appetite itself: a change to the boundary is a governance decision about the risk the organization is willing to take, not a temporary permission for one defined exposure.
The first question is therefore not, “Is the business case attractive?” It is, “Is this boundary eligible for an exception, and who has authority to approve one of this size, duration, and nature?” Some limits may be expressly non-waivable. Approval authority and escalation thresholds vary by organization; the examples below use hypothetical delegations and do not prescribe universal approval levels.
A Disciplined Evaluation and Approval Process
A sound review separates the business rationale from the risk decision. The applicant should explain why the activity is needed, what benefit is expected, and why a lower-risk alternative will not meet the objective. The reviewer then tests the exposure, including plausible adverse outcomes, dependencies, and related exposures already in place. A favorable expected return does not by itself establish that the departure is acceptable.
Identify the exact internal appetite statement, metric, tolerance, and applicable policy. Confirm that an exception is allowed. If the request concerns a non-waivable requirement, do not treat an exception as an available route.
State the current position, the expected position with the activity, the boundary, the maximum exceedance, and how long it is expected to last. Include relevant related exposures and aggregation rules.
Compare the proposal with alternatives, assess adverse scenarios, and identify controls, contingency actions, and observable triggers for escalation or stopping the activity.
Check approval limits for the type, size, duration, and cumulative exposure. Route the request to the required decision-maker before the activity begins; do not assume that a manager’s commercial authority includes authority to grant a risk exception.
Document the decision and conditions, assign an owner, track the metric at an appropriate frequency, and close the exception when it expires or the exposure returns within tolerance. Reassess a proposed extension as a new request under policy.
For an upper-bound metric, let \(M_0\) be the current measure, \(M_1\) the measure after the proposed activity, and \(T\) the applicable tolerance. The proposed exceedance is:
This calculation is useful only when the measure, scope, and aggregation basis are correctly defined. It does not determine whether approval is appropriate, and it does not replace other constraints. For instance, a percentage metric may worsen because its denominator changes even if the exposure itself does not; the reviewer should understand both numerator and denominator.
Duration matters too. If the measured excess varies over time, an organization may choose to track its cumulative exposure-time as a supplemental management indicator:
This is the area between the metric and its tolerance over the approved period. If the excess is constant at \(e\) for \(D\) days, then \(E=eD\). For changing daily values, a simple discrete approximation is the sum of each day’s excess. This indicator helps compare the scale and duration of departures, but it is not a universal risk measure or a substitute for an organization’s approval rules. Its units also depend on the metric: for a percentage metric, the units are percentage-points multiplied by days.
Why Scope and Duration Must Be Explicit
The exposure-time calculation follows directly by dividing the period into short intervals. On each interval, the excess is approximately constant, so the area contributed is approximately “excess times interval length.” Adding those areas and making the intervals progressively shorter gives the integral. If the excess is constant, every interval has the same height, and the total area is a rectangle of height \(e\) and width \(D\), giving \(E=eD\).
This arithmetic supports disciplined monitoring; it does not imply that two exceptions with the same \(E\) are equally risky. A sharp, brief departure and a small, prolonged departure can have different consequences. The reviewer must consider the nature of the risk, the timing, uncertainty, and the organization’s actual tolerance for that risk. Nor should unrelated metrics be netted against each other unless the governing framework expressly permits that treatment.
Worked Example: Liquidity Coverage Above an Internal Tolerance
A hypothetical insurer has an internal minimum liquidity coverage ratio of 120%. Its current forecast is 123%. A proposed collateral restructuring is forecast to reduce the ratio to 116% for 10 calendar days, after which it is forecast to recover to 123%. The applicable hypothetical policy permits this type of internal exception, but a business-unit manager may approve only an exceedance of at most 2 percentage points for at most 5 days. Longer or larger requests require approval by the designated risk executive. Assume separately that the forecast remains above all applicable legal and regulatory minima. Assess the request.
Method. Compare the post-activity measure with the internal tolerance, calculate the maximum departure and its planned duration, then test those values against the stated delegation.
Step 1: Calculate the departure. The tolerance is \(T=120\%\), and the forecast during the activity is \(M_1=116\%\). The exceedance below the minimum is \(120\%-116\%=4\) percentage points. The current forecast of 123% does not remove the departure: approval is assessed against the forecast after the activity.
Step 2: Calculate the planned cumulative exposure-time. The forecast excess is constant at 4 percentage points for 10 days, so \(E=4\times10=40\) percentage-point-days.
Step 3: Test the authority. The request is for 4 percentage points and 10 days. It exceeds both the manager’s 2-percentage-point limit and the 5-day limit. The manager therefore cannot approve it under the stated delegation. The request must be routed to the designated risk executive before the restructuring begins. That executive may approve, reject, or require a narrower proposal, subject to policy.
Step 4: Specify controls for any approval. A decision should state the permitted minimum ratio and end date, require monitoring during the 10 days, identify who acts if the forecast worsens, and require confirmation that the ratio has recovered before closure. The approval must not be recorded as changing the 120% tolerance.
Common mistake and correction. A reviewer might calculate \(123\%-120\%=3\) percentage points and conclude that only a 3-point exception is needed. That compares the starting position with the boundary, not the post-activity position. The correct departure is \(120\%-116\%=4\) percentage points. The request also exceeds the manager’s authority on duration, regardless of the exposure-time calculation.
Approval Conditions and the Exception Record
An approval is only operationally useful if the people responsible can tell what has been authorized and when it stops. The decision record should be specific enough to distinguish permitted activity from activity outside the approval. At a minimum, it should capture:
- the relevant appetite statement, metric, boundary, and measurement basis;
- the activity, exposure, business purpose, and maximum permitted departure;
- the start date, expiry date, owner, decision-maker, and basis for delegated authority;
- the principal assumptions, uncertainties, alternatives considered, and material adverse scenarios;
- required safeguards, monitoring frequency, reporting route, and trigger levels for action;
- the required response if a condition is breached, including whether activity must stop or be escalated; and
- the closure test and review date, including what evidence will demonstrate return within tolerance.
A condition should be observable and assigned to an owner. “Monitor closely” is not enough on its own. A stronger condition says which measure is monitored, how often, who reviews it, what level triggers action, and what action follows. For an exposure that can change quickly, periodic reporting at a frequency too slow to detect a material deterioration may not provide meaningful control.
The approved amount should also be expressed on the correct basis. For a concentration limit, for example, the decision should clarify which exposures count, whether related entities are aggregated, and whether the measure uses gross or net exposure. A proposed risk reduction elsewhere does not automatically cancel an exceedance; offsets are valid only when the metric’s design and policy allow them.
Worked Example: Aggregating a Concentration Before Approval
A hypothetical insurer has a 12% internal tolerance for exposure to any one counterparty group, measured as exposure divided by total invested assets. Total invested assets are $200 million. Current exposure to Group A is $19 million. A proposed transaction would add $8 million to the same group. The applicant also points to a separate $4 million reduction in exposure to Group B. The hypothetical policy defines concentration by counterparty group and does not permit one group’s reduction to offset another group’s concentration. The policy allows a temporary exception only if the delegated risk executive approves it. Find the Group A concentration and exception size.
Method. Aggregate exposures within the relevant counterparty group, divide by the stated denominator, and compare with the tolerance. Treat the Group B reduction separately because the policy does not permit cross-group offsetting.
Step 1: Find Group A exposure after the transaction. The new exposure is \(19+8=\$27\) million.
Step 2: Calculate the concentration. The post-transaction concentration is \(27/200=0.135=13.5\%\).
Step 3: Compare with the tolerance. The tolerance is 12%, equivalent to \(0.12\times \$200\text{ million}=\$24\) million. The proposed exposure exceeds that amount by \(\$27-\$24=\$3\) million, or \(13.5\%-12\%=1.5\) percentage points.
Step 4: Apply the policy and authority. The Group B reduction does not change Group A’s concentration under the stated rules. The transaction therefore requires an exception of up to 1.5 percentage points, and only the delegated risk executive may approve it. The request should also state duration, monitoring, safeguards, and an exit or reduction plan.
Check. The calculated limit amount plus the excess is \(\$24+\$3=\$27\) million, which matches the post-transaction Group A exposure. The concentration calculation is consistent.
Common mistake and correction. Subtracting the unrelated $4 million Group B reduction from Group A’s $3 million excess would suggest there is no exception. That is wrong because the policy defines the metric by counterparty group and prohibits this offset. Assess Group A on its own stated basis.
Expiry, Review, and the Risk of Limit Erosion
A temporary approval should end on a stated date or when a clearly defined closure condition is met, subject to whichever occurs first under the decision. “Until further notice” is not a meaningful time limit. An extension should not be automatic: the owner should report actual exposure, changes in assumptions, control performance, and progress toward exit, and the request should be reassessed under the required authority.
Repeated extensions, similar requests from several units, or routine reliance on exceptions can indicate that the approved limit no longer reflects operations—or that controls are failing. Those patterns call for analysis, not quiet normalization. A persistent mismatch may require a formal review of the appetite boundary or business plan under the organization’s governance process. Until such a change is approved, the existing boundary remains in effect.
Worked Example: Reviewing an Exception Near Expiry
A hypothetical business has approval to exceed an internal operational-loss tolerance by no more than $20,000 for 30 days while it replaces a claims-processing control. The approval requires weekly review and expires at the end of day 30. At day 21, the measured excess is $12,000. Replacement is expected to take another 12 days, and the owner asks to continue for 12 additional days. Assume the policy requires a fresh approval for any extension and the original approval contains no automatic renewal.
Method. Compare the observed amount and time elapsed with the approved limits, then distinguish the remaining original authorization from the requested extension.
Step 1: Test the current amount. The observed excess is $12,000, which is $8,000 below the authorized maximum of $20,000. The amount is within the original cap at day 21.
Step 2: Test the original time limit. The original approval lasts 30 days. At day 21, \(30-21=9\) days remain. A 12-day extension would continue 3 days beyond the original expiry.
Step 3: Decide what may happen next. The existing approval can cover only the remaining 9 days, and only while its conditions and $20,000 maximum remain satisfied. It cannot authorize days 31 through 33. Because the policy requires fresh approval, the owner must submit an extension request before expiry, with updated exposure, the reason for delay, revised controls, and a credible completion date. The proper decision-maker must approve it before the original authorization ends if continued operation is to be permitted.
Step 4: Review progress and close. Weekly review should continue, and the owner should report whether the replacement is on schedule and whether the excess remains within the cap. Once the control is operating and the metric is within tolerance, document the evidence and close the exception. If the amount exceeds $20,000 or another condition fails, escalate and act under the applicable response process; the original approval does not cover that departure.
Common mistake and correction. Treating “replacement takes 12 more days” as permission for 12 more days turns a request into a renewal without authority. The original approval has 9 days remaining, and the additional 3 days require a fresh decision in advance.
Controlled Exception or Informal Limit Erosion?
The distinction is visible in the evidence and behavior around the decision. A controlled exception has a defined exposure, a valid approval, a named owner, safeguards, monitoring, and a real endpoint. Informal limit erosion appears when staff repeatedly exceed a boundary without approval, treat an expired approval as continuing, omit related exposures, or regard exceptions as routine. A signed form alone is not sufficient if actual exposure exceeds its scope or conditions are not monitored.
The objective is neither to prohibit every departure nor to treat every commercial need as an exception. It is to make risk-taking explicit, bounded, and accountable within the organization’s approved framework. This process is aligned with the CAS Exam 9 (Risk Management for Actuaries) syllabus because it connects appetite, tolerance, escalation, and governance to concrete decisions.
Check Your Understanding
For each hypothetical situation, identify the appropriate calculation or governance conclusion.
- An internal upper tolerance is 10%. A planned activity raises the metric from 8% to 12.5% for 4 days. What is the maximum exceedance and constant-excess exposure-time? (Answer: 2.5 percentage points; 10 percentage-point-days.)
- A $150 million portfolio has a 6% single-counterparty tolerance. Current exposure to one group is $7.5 million, and a proposed transaction adds $2 million. Calculate the post-transaction concentration and excess over tolerance. (Answer: 6.33% (to 2 decimals), exceeding the 6% tolerance by $0.5 million or 0.33 percentage points.)
- A temporary internal exception is approved for 14 days, with a maximum excess of $9,000. At day 10, the excess is $8,000 and the owner forecasts 6 more days of need. How many days remain under the approval, and what must happen before continued activity after expiry? (Answer: 4 days remain; a fresh approval must be obtained before continuing beyond the 14-day expiry.)
- An exception request concerns an internal tolerance, but the forecast also indicates a breach of a non-waivable regulatory minimum. Can approval of the internal exception authorize the activity as proposed? (Answer: No; an internal appetite exception cannot waive the regulatory minimum, so the proposal must be changed or otherwise handled in compliance with that requirement.)
- A limit is exceeded for 5 days without prior authorization. A manager then signs a request covering those same 5 days. Does the later signature make the original departure a controlled temporary exception? State the appropriate distinction. (Answer: No; the departure was an actual breach when it occurred, not a pre-authorized exception. It should be escalated and addressed under the applicable breach process; any future exception requires valid prior approval if policy allows one.)