The exempted system is the one attackers find and the one that voids the policy. The exemption register is now a financial document.