---
title: Request an exception for application vulnerabilities using GRC: Policy and Compliance Management
description: Request policy exceptions using the GRC policy exception management capability in the Policy and Compliance Management application from within Application Vulnerability Response.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/application-vulnerability-response/integrate-with-grc-avr.html
release: australia
product: Application Vulnerability Response
classification: application-vulnerability-response
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 2
breadcrumb: [Requesting and approving an exception in Application Vulnerability Response, Exception Management in Application Vulnerability Response, Configure Application Vulnerability Response, Configure, Application Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Request an exception for application vulnerabilities using GRC: Policy and Compliance Management

Request policy exceptions using the GRC policy exception management capability in the Policy and Compliance Management application from within Application Vulnerability Response.

## Before you begin

Before you can use the Policy Exception Integration to request policy exceptions, you must download the GRC: Policy and Compliance Management application from the ServiceNow Store.

Role required: sn\_vul.remediation\_owner

You can also request exceptions in the classic UI:

## Procedure

1.  Navigate to **All** > **Application Vulnerability Response** > **Application Vulnerable Items** \(or **Remediation Tasks**\)>**All**, and open the item or group for which you want to request an exception.

    The selected item or group must be in Open, Under investigation, or Awaiting implementation state.

2.  On the selected form, click **Request Exception**.

3.  If GRC: Policy and Compliance Management is selected in the Exception Management screen, fill in the fields in the Request Exception form.

<table id="table_l4l_2yq_3vb"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Policy

</td><td>

Vulnerability Management policy that you are requesting an exception for.

</td></tr><tr><td>

Control objective

</td><td>

Control objectives that are associated with the policy you selected. If a policy is not selected, all the control objectives are listed.

</td></tr><tr><td>

Valid from

</td><td>

Date when the exception will start. The default value is the current date. This date cannot be in the past.

</td></tr><tr><td>

Valid until

</td><td>

Date that the policy exception expires and the state of the vulnerable item or group changes from Deferred to Open.**Note:** The number of days that the policy exception is valid cannot exceed the **Maximum exception duration \(days\)** that you set for the policy in Policy and Compliance. For more information, see [Create a policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/governance-risk-compliance/t_DefineAPolicy.md).

</td></tr><tr><td>

Reason

</td><td>

Reason for requesting an exception.

</td></tr><tr><td>

Justification

</td><td>

Details that are related to the reason why this request is being made. This mandatory field must be filled in by the remediation owner.

</td></tr></tbody>
</table>    1.  Click **Request Approval** to submit the exception request.

        The state of the vulnerable items changes to In Review and a policy exception is created. Use the **State Change Approval** tab to track the status of the exception request.

    2.  Click the Policy Exceptions related list to view the policy exception.

    3.  Click the policy exception number.

    4.  In the **Approver** field, select the name of the approver.

    5.  Click the Source tab and select a control objective from the **Control objective** field.

    6.  Click the Risk assessment tab and select the risk rating from the **Risk rating** field.

    7.  Save the form.

    8.  Click Impacted Controls tab and click Add to add the controls.

    9.  Save the form.

        **Note:** You can raise a compliance review by clicking **Request compliance review**.

    10. The approval form is sent to the approver.

    11. As an approver, you can either approve the request by clicking **Approve** or request additional approval by clicking **Request Additional Approval**.

        The record state changes to Deferred. The reason stated is the one you selected when raising the exception request. The Deferral tab provides additional notes on the record.

        **Note:** If the request gets rejected, the record moves to its previous state.

4.  Click **Submit**.

    For more information on the Policy Exception Integration and the hand-off between the remediation owner and the compliance manager, see [Policy and Compliance Management optional setup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/governance-risk-compliance/policy-compliance-optional-steps.md).


**Parent Topic:**[Requesting and approving an exception in Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avr-request-approve-exception.md)