At this organization, deviations from policies had to be documented in a letter signed by both the executive of the business group requesting the deviation and the central information security group's manager.
380347
Deviations from policy must be documented by two people.
380348
Nothing has to be documented, it is a very chill operation.