Approved by Waiver

Header Title: Approved by Waiver Subtitle: When certification is hard, confidence becomes the control. Panel 1 Visual: A project team sits around a conference table during a “Certification and Authorisation Readiness Review”. A stack of missing artefacts is labelled “Security Test Report”, “Threat Model”, “Residual Risk Statement”, “Control Evidence”, and “Operating Authority”. Project manager: “So... mostly done?” Security adviser: “We’re missing the security test report, the threat model, the residual risk statement, the control evidence, and the operating authority.” Caption: Every approval journey begins with optimism and missing artefacts. Panel 2 Visual: The project manager attempts to negotiate with a stern certification reviewer while the rest of the team looks concerned. Project manager: “What about conditional approval?” Certification reviewer: “This is not ready for certification.” Project manager: “Conditional on it being ready.” Caption: The certification body commits the unforgivable act of reading the evidence. Panel 3 Visual: A delivery schedule shows a prominent “GO-LIVE: FRIDAY” milestone. Senior managers point at the schedule while the security representative objects. Senior executive: “We have already briefed success.” Project manager: “Then failure is no longer an option.” Security representative: “That is not how risk works.” Project manager: “This is how PowerPoint works.” Caption: The most dangerous control is an executive milestone. Panel 4 Visual: A manager slides an “Operational Waiver” document across the table. Manager: “We could seek a waiver.” Project manager: “A waiver?” Manager: “It’s like certification, but thinner.” Security representative: “That is not what that means.” Caption: When assurance is hard, paperwork becomes interpretive dance. Panel 5 Visual: A proposed “Operational Waiver” is displayed with the following statements: Risk understood Operational imperative Mitigations to follow Temporary basis Pending future uplift Accepted by appropriate authority Signature Date Security adviser: “This does not identify the risk, the exposure, the controls, the owner, or the expiry conditions.” Project manager: “But it does say ‘accepted.’” Caption: Blind risk acceptance: now with margins and a signature block. Panel 6 Visual: A concerned decision-maker holds a folder labelled “Urgent: For Awareness”. A note attached to it reads, “Just need signature to maintain schedule.” Decision-maker: “What exactly am I accepting?” Project manager: “The operational necessity of continuing.” Security adviser: “That was impressively not an answer.” Caption: Nothing says informed decision like a two-minute signature request before lunch. Panel 7 Visual: The decision-maker reluctantly signs the operational waiver. Behind the team, a dashboard displays: Certification Status: Not Approved Waiver Status: Approved Risk Understanding: Pending Residual Risk: Decorative Accountability: To Be Determined Project manager: “Great news. We’re authorised.” Security adviser: “No. You are waived.” Senior executive: “Close enough for the dashboard.” Caption: The system was not certified. It was administratively exhaled into production. Panel 8 Visual: A banner reads “GO-LIVE SUCCESSFULL”. Smoke rises from a server rack in the background. One team member holds a clipboard labelled “Known Issues That Were Apparently Known”, while the decision-maker studies the operational waiver. Decision-maker: “Why does this say ‘temporary’ with no end date?” Project manager: “That’s how we know it’s strategic.” Caption: Certification avoided. Risk accepted. Understanding not included.