TECH DEBT & EXCEPTION REGISTER

Risk accepted via exceptions and long-term technical debt is recorded once and forgotten, so accumulated debt quietly becomes the biggest exposure nobody's tracking. Expiry dates pass unnoticed.

Actors

  • Head of Vulnerability Management
  • Risk Owners
  • IT & Infra Leads

Systems / Vendors

  • GRC platform
  • Vulnerability management
  • Asset / CMDB

Business Question

"How much risk have we formally accepted, and how much of that technical debt is now overdue?"

What SPoG Does

  • Tracks risk accepted via formal exceptions and long-term technical debt.
  • Flags expiring and overdue acceptances.
  • Keeps accumulated exposure visible.

Outcome Metrics

−30%

Overdue risk acceptances

1

Live debt register

6–10 wks

To first outcomes