{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":17756,"path":"governance-risk-compliance/policy-and-compliance-management/define-approval-rules.md","title":"Define policy exception approval rules","bundle":null,"doc_type":null,"release":"australia","body":"\n# Define policy exception approval rules\n\nApproval rules define the criteria \\(risk rating, policy or control objective\\) that is used for sending approval requests for an exception. Rules can be configured for an application and you can identify multiple levels of approvers, as needed.\n\n## Before you begin\n\nRole required: sn\\_compliance.manager\n\n## About this task\n\nYou can configure approvals to be sent out automatically or manually after review.\n\n**Note:** When policy exceptions are created from upstream applications \\(from Vulnerability Response for example\\), the policy exception must have impacted controls present before you can request approval.\n\nFor policy exceptions created using Policy and Compliance Management, exceptions can be requested for a policy without impacted controls being present, even if both policies and control objectives are added to the exception form. However, for policy exceptions created for control objectives alone, impacted controls must be present before you can request approval.\n\nYou can also use the GRC Approval Configurator to configure policy exception rules. For more information, see [Define policy exception and extension rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/policy-and-compliance-management/define-policy-exception-verification-rules.md).\n\n## Procedure\n\n1.  Navigate to **All** &gt; **Policy and Compliance** &gt; **Policy Exceptions** &gt; **Approval Rule**.\n\n2.  Click **New**.\n\n3.  On the form, fill in the fields.\n\n    |Field|Description|\n    |-----|-----------|\n    |Type|Defaults to Approval Rule.|\n    |Name|Enter a name for this approval configuration.|\n    |Short description|Provide a brief description of the purpose of the configuration.|\n    |Source application|Select the application for that applies to this approval rule. Only applications that have been previously added to the Integration Registry are listed.|\n    |Active|If this is selected, this approval rule is active.|\n    |Risk rating|The risk rating is determined by running a risk assessment on the policy exception.|\n    |Policy|Select the policy against which this policy exception is being applied.|\n    |Control objective|Select the control objective that references the selected policy.|\n    |Auto-trigger approvals|Select this check box to automatically trigger all approvals after the review is completed. If you do not select it, the compliance manager can manually trigger the approvals defined by this rule.|\n    |Order|Order defines the precedence of triggering this rule as compared to another rule that is applicable to the exception and defined with similar criteria.|\n\n4.  Click **Update**.\n\n    The Approver Levels related list appears. This related list allows you to define multiple approver levels for a rule. One or more users, or a group of users can be selected as approvers for each level. Approvers must be assigned the survey\\_reader role. You can make it mandatory for all selected users to approve the exception or optionally allow a single user to approve on behalf of all approvers.\n\n5.  Select **New**.\n\n6.  On the form, fill in the fields.\n\n<table id=\"table_xlt_4sg_rlb\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nName\n\n</td><td>\n\nEnter a name for this approval level.\n\n</td></tr><tr><td>\n\nDescription\n\n</td><td>\n\nProvide a brief description of the approval level.\n\n</td></tr><tr><td>\n\nRequired approval\n\n</td><td>\n\nSelect **One approval required** to allow a single user to approve on behalf of all approvers.Select **All users must approve** to make it mandatory that all designated users approve the selection.\n\n</td></tr><tr><td>\n\nUsers\n\n</td><td>\n\nSelect one or more users to act as policy exception approvers.\n\n</td></tr><tr><td>\n\nGroups\n\n</td><td>\n\nSelect one or more groups to act as policy exception approvers.**Note:** Users who belong to the group must have GRC business user \\(sn\\_grc.business\\_user\\) role.\n\n</td></tr><tr><td>\n\nOrder\n\n</td><td>\n\nSelect the order to determine the sequence of levels used with respect to other levels \\(that is, order 1 is displayed first\\).\n\n</td></tr></tbody>\n</table>7.  Click **Submit**.\n\n    If you selected the **Auto-trigger approvals** check box, the designated approvers are notified that their approvals are required. Alternatively, the approvers are notified when the compliance manager clicks the **Send for Approval** button.\n\n\n**Parent Topic:**[Allow policy exception requests from other applications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/policy-and-compliance-management/allow-other-app-policy-except.md)\n\n"}}