If you manage compliance for your organization, it's common to expect the compliance score to drop once an exemption has been approved. That's not what happens in Tenacy, though: an exemption doesn't impact the score. This article explains why, and what it actually changes.
What is an exemption?
An exemption is a temporary and voluntary request for non-compliance with a security requirement: you know a rule isn't being met, and you formally declare it, with a justification, a deadline for becoming compliant, and, if needed, compensating measures.
This is different from a gap, which is an anomaly identified from the outside (an audit, an incident, a check) rather than voluntarily declared.
🔎 For details on creating an exemption and its statuses, see: Create an exemption.
Why the score doesn't change when an exemption is approved
A policy's compliance score reflects the actual state of your measures and evaluations for each requirement, whichever score type applies (declarative, coverage, or measured). An exemption is a separate object that documents and manages a non-compliance that already exists: it isn't part of the score calculation.
Exemption requested or approved: the requirement stays non-compliant in the score, but the non-compliance is acknowledged and documented (justification, compensating measures, deadline).
Exemption rejected: nothing changes in the score. The requester is notified and needs to act to restore compliance.
What an exemption actually changes
Even though it doesn't change the score, an approved exemption has a concrete effect on how your compliance is tracked:
It prevents an additional gap: while it's valid, it stops a gap from being opened in the gap register for the same requirement.
It records a decision: who requested the exemption, who approved it, why, until when, and with which compensating measures.
It makes the non-compliance visible and owned in the policy's tracking, rather than staying invisible.
💡 To actually move your score, you need to act on the requirement itself: implement or improve the associated measure, for example through an improvement action in your action plan.
Exemption vs. gap: know the difference
| Exemption | Gap |
Origin | Voluntarily declared by a contributor or a pilot | Identified, often from an external source (audit, check, vulnerability) |
Lifecycle | Requested → Approved or Rejected, then Closed | Open as soon as it's identified, tracked until resolved |
Effect on the compliance score | No direct effect: the requirement stays non-compliant in the score | No direct effect on the compliance score either; tracked separately through its own resolution score |
What happens when it's closed or expires?
On closing: when you close the exemption (compliance restored, or the exemption is no longer needed), it stops generating a gap, and the policy's compliance score is recalculated based on the actual state of the measures at that point.
On expiry: if the deadline passes without the exemption being closed, it shows up as an anomaly to handle in your tracking, prompting you to take action: close it, extend it, or address the underlying non-compliance.
Frequently asked questions
If my exemption is approved, why doesn't my compliance score go up?
Because the score reflects the actual state of your measures and evaluations for the requirement in question. The exemption documents and manages the non-compliance, but it isn't part of the score calculation: the requirement stays non-compliant until the underlying measure is actually implemented.
How do I move my score if a requirement is covered by an exemption?
You need to act on the requirement itself: implement or improve the associated measure, for example through an implementation action in your action plan. Once the measure is actually in place, the score reflects the new situation, regardless of the exemption's status.
What happens if I forget to close an exemption once it reaches its deadline?
It shows up as an anomaly in your tracking (an approved exemption whose deadline has passed), prompting you to take action: close it, extend it, or address the underlying non-compliance.
🔎 To go further, see: Create an exemption, Manage your exemptions, and Implement a measure.