Why a Governance Exception Needs a Decision Path
A business exception is a proposed action that does not fit an established approval limit, control requirement, or other governance rule. It may be commercially attractive and still require a different decision-maker from the person who normally approves similar activity. The central task is not simply to ask whether the proposal is sensible. It is to identify who owns the decision, who must challenge it, which approvals are required, and where unresolved or reserved matters must go.
The path depends on the organization’s approved authority framework: its delegation schedule, committee mandates, board-reserved matters, and relevant policies. These documents differ by organization. A risk committee may challenge and recommend without having authority to approve; a senior executive may approve within a delegation but not a matter expressly reserved to the board. An exception is not authorized merely because a senior person supports it.
The first line remains accountable for proposing and managing the business activity. Relevant second-line functions, such as risk, compliance, and legal, provide independent challenge or advice within their roles. Internal audit provides independent assurance rather than becoming a co-approver of the proposal. These responsibilities are consistent with the Three Lines Model, but the exact approval path comes from the organization’s own governance documents.
A Practical Method for Routing the Exception
Use the following sequence before any binding commitment is made. Read the actual authority documents; do not infer a decision right from job title, customary practice, or the apparent size of the opportunity.
Describe the requested action, the rule or limit it departs from, the affected activity, duration, and any conditions. Separate the decision to proceed from later operational steps.
Check monetary limits, cumulative exposure rules, policy waivers, product or transaction triggers, and matters reserved to a committee or the board. A proposal can be below a monetary ceiling and still meet a separate reserved-matter trigger.
Ask the appropriate control functions to examine relevant assumptions, controls, compliance obligations, legal terms, and risk consequences. Record material objections and the response; do not label advice as approval unless the framework explicitly grants that role.
Escalate to the next level that has authority for the exception. If a matter is reserved to a governing body, a lower-level executive or committee cannot replace that approval unless the governing documents provide for it.
Document the approver, rationale, conditions, dissent, expiry or review date, and monitoring owner. Until approval is validly granted, the business should not act as though the exception has been authorized.
Why Escalation Follows From the Authority Structure
The logic is straightforward. A delegated authority gives a person power to decide only within its stated scope. If a proposal falls outside that scope, that person cannot make it valid by agreeing with it. The exception must go to an authority that covers it, or to the governing body if the matter is reserved there.
This is a necessary governance test, not a formula for deciding whether the business case is attractive. Challenge can improve the information on which the authorized decision-maker acts, but it does not cure an authority gap. Nor does escalation automatically mean board approval: the authority schedule may place the decision with a more senior executive or a delegated committee, unless a separate reserved-matter trigger applies.
The method is useful because exceptions often combine several routes. One may cross an exposure limit, require a policy waiver, affect a regulated obligation, and involve a board-reserved decision at the same time. Each trigger must be tested; satisfying one approval does not silently satisfy the others.
Worked Applications
Worked Example: A Facility Above the Underwriting Delegation
A hypothetical insurer’s authority schedule permits a business-unit head to approve up to $20 million of aggregate committed exposure, the chief underwriting officer to approve up to $30 million, and the chief executive officer to approve up to $50 million. The board has reserved new product launches, but this proposal uses an existing product and does not meet another board-reserved trigger. CEO approval requires documented challenge from the chief risk officer and legal review. Existing commitments under the facility are $13 million. The business unit proposes an additional $22 million. Determine the route before the additional commitment is made.
Method: test cumulative exposure, then test the next level and any independent triggers. The applicable total is not just the proposed increment. It is:
The business-unit head’s $20 million authority is exceeded because $35 million is greater than $20 million. The chief underwriting officer’s $30 million authority is also exceeded because $35 million is greater than $30 million. The amount is within the CEO’s $50 million ceiling because $35 million is less than or equal to $50 million.
The business unit should therefore prepare the proposal and supporting analysis, while the chief risk officer provides the required challenge and legal completes the required review. The CEO is the authorized approver under the stated schedule, provided those required steps are completed and no other trigger is identified. The board is not the approver here: the proposal is not a new product launch and the facts state that no other reserved-matter trigger applies.
Check. The approved total, if the CEO approves, would be $35 million, within the CEO’s stated limit. The common mistake is to compare only the $22 million increment with the $30 million chief underwriting officer limit and conclude that the chief underwriting officer can approve. The schedule applies to aggregate committed exposure, so the correct comparison is $35 million, not $22 million.
Worked Example: A Board Trigger Despite a Small Amount
A hypothetical insurer’s CEO may approve ordinary product changes with an expected first-year exposure up to $18 million. The board has separately reserved approval of any launch that introduces a product using customer location data to set coverage terms. A proposed add-on would produce an estimated first-year exposure of $7 million and would use such data. The product team argues that executive approval is sufficient because the amount is below the CEO’s limit. Identify the decision path.
Method: test the type-of-decision trigger separately from the monetary limit. The $7 million estimate is less than the CEO’s $18 million ordinary limit. That comparison alone does not resolve the authority question. The proposal uses location data to set coverage terms, which exactly meets the stated board-reserved trigger.
The business team remains responsible for the proposal and its operational controls. Risk, compliance, and legal should challenge or advise on matters within their roles, including the data use and relevant obligations. The responsible executives should ensure that the board receives a sufficiently clear proposal and any required committee review or recommendation under the organization’s governance documents. The board must make the reserved decision before launch. CEO approval alone cannot authorize the launch under the stated rules.
The decision record should distinguish the board’s approval of the reserved launch from any separate executive approvals needed to implement it. The common mistake is to treat a monetary limit as the only approval test. The correction is to test every trigger: a proposal can be within an executive’s dollar delegation and still be reserved to the board because of its nature.
Worked Example: Conflicting Challenge on a Counterparty Exception
A hypothetical insurer’s policy requires collateral for a defined class of reinsurance counterparties. Its authority schedule reserves exceptions to that collateral requirement for board approval. The risk committee may challenge and recommend, but its charter does not grant it approval authority. A proposed treaty would transfer $9 million of exposure without the required collateral. The chief financial officer supports the treaty; the chief risk officer identifies material credit risk and recommends against the exception. Trace the decision and state what each party can do.
Method: identify the reserved decision first, then separate the decision-maker from the challengers. The treaty departs from a specified collateral requirement. The stated schedule reserves that exception to the board, so neither the CFO’s support nor the risk committee’s view supplies the required approval.
The CFO, as business sponsor, should present the rationale, proposed terms, alternatives, and consequences of proceeding or declining. The CRO should provide an independent assessment and explain the credit-risk concern. The risk committee can scrutinize the submission and make a recommendation, but it cannot approve the exception under its stated charter. The board is the decision-maker for the policy exception. It may approve, reject, or impose conditions, subject to its governing documents.
If the board has not approved the exception, the treaty should not be executed on the assumption that executive support is enough. The disagreement should be recorded, along with the board’s decision and any conditions or monitoring requirements. The common mistake is to interpret the committee’s review as approval, or to treat the CRO’s recommendation as a veto. The correction is to respect the defined roles: the committee challenges and recommends, the CRO advises, and the board holds the reserved decision right.
Common Governance Traps
- Using only the proposed increment. If a limit applies to total commitments or aggregate exposure, include existing commitments and any other components specified in the authority schedule.
- Assuming the next senior person can approve everything. A senior executive remains bound by reserved matters, policy requirements, and limits on their own delegation.
- Confusing review with approval. A committee’s discussion, a control function’s challenge, or a legal sign-off is not automatically a decision unless the applicable charter or delegation says so.
- Escalating without a decision request. A useful escalation states what approval or direction is sought, which rule is triggered, what alternatives exist, and what happens if approval is not granted.
- Acting before the approval is complete. Negotiation or preparation may be permitted, but any binding commitment must follow the applicable authority rules. Clarify interim limits rather than implying that an unapproved exception is in force.
- Omitting the record and follow-up. A decision without a clear rationale, conditions, owner, and review date can be difficult to implement consistently or scrutinize later.
A sound case analysis names the decision right, not merely the people involved. It identifies the accountable business sponsor, required challenge, advisory or committee steps, final approver, and the escalation route if the proposal is disputed or reserved. The approach is aligned with the CAS Exam 9 (Risk Management for Actuaries) syllabus.
Check Your Understanding
For each hypothetical case, identify the relevant authority trigger and the correct next decision step. Use the stated governance rules rather than assuming a universal approval structure.
- A regional executive may approve up to $12 million of total commitments. Existing commitments are $8 million, and a proposal adds $6 million. The next executive level has authority up to $20 million. No reserved-matter trigger applies. Who must receive the proposal? (Answer: The next executive level; total commitments would be $14 million, which exceeds $12 million but is within $20 million.)
- A committee’s charter permits it to recommend exceptions to a control policy, while the board retains approval. The committee unanimously supports a proposed exception. Is the exception approved? (Answer: No. The committee may recommend it, but board approval is still required.)
- A CEO may approve standard contracts up to $25 million. A proposed $10 million contract would introduce a service explicitly reserved for board approval. Which test governs the approval route? (Answer: The reserved-service trigger; the proposal must go to the board despite being below the CEO’s monetary limit.)
- A delegated approver is permitted to approve a $16 million exposure, but the authority schedule counts existing and proposed exposure together. Existing exposure is $11 million, and the proposal adds $7 million. What is the total, and can that approver approve it? (Answer: $18 million; no, because it exceeds the $16 million delegation, so it must be routed to the next authorized level.)
- A risk committee identifies a significant concern, but its charter gives it no veto or approval right. The authorized executive asks whether committee silence would count as approval. What should happen? (Answer: Silence is not approval unless the governance documents explicitly make it so; obtain the required challenge and route the decision to the authorized approver, recording the concern and response.)