Are Your Exemption Claims Actually Defensible? A Diagnostic Framework for FOIA Compliance Officers

Asserting a FOIA exemption is easy. Defending one is considerably harder. Across federal agencies and regulated entities, a persistent gap exists between the exemptions organizations routinely invoke and the legal standards those claims must actually satisfy. Courts are no longer content to accept a redaction simply because an agency labeled it with a statutory category. They are examining the evidentiary basis, the internal reasoning process, and the consistency with which an organization applies its own standards.

For compliance officers, this shift carries real consequences. An exemption claim that cannot be reconstructed—documented, reasoned, and tied to controlling precedent—is a liability waiting to materialize. The following diagnostic framework is designed to help organizations evaluate the defensibility of their current exemption practices before a requester, a court, or an oversight authority forces the issue.

Why Exemption Audits Have Become Necessary

The Freedom of Information Act presumes disclosure. Exemptions exist as narrow exceptions to that presumption, not as general-purpose shields against inconvenient transparency. Over the past decade, federal courts have grown increasingly skeptical of agencies that assert exemptions without producing detailed Vaughn indexes, that apply categorical redaction policies without individualized review, or that invoke deliberative process protections for documents that bear little resemblance to genuine pre-decisional deliberation.

The D.C. Circuit—the most consequential federal appellate venue for FOIA litigation—has repeatedly signaled that boilerplate exemption language is insufficient. Other circuits have followed. Meanwhile, the Office of Information Policy at the Department of Justice continues to refine its guidance on foreseeable harm, a standard introduced by the FOIA Improvement Act of 2016 that requires agencies to demonstrate not merely that an exemption applies, but that disclosure would cause a specific, articulable harm.

Organizations that have not revisited their exemption practices since before that statutory amendment are, in many cases, operating under an outdated compliance model.

Step One: Inventory Your Current Exemption Usage

A meaningful audit begins with data. Compliance officers should compile a working inventory of exemptions asserted over a defined review period—typically the prior twelve to twenty-four months. For each exemption category invoked, the inventory should capture:

• The frequency with which the exemption was applied
• The document types most commonly redacted under each category
• Whether the claim was challenged, and if so, the outcome
• The name or role of the reviewer who made the determination

This inventory serves two purposes. First, it reveals patterns that may indicate over-reliance on particular exemptions—a common warning sign that categorical rather than individualized review is occurring. Second, it creates a baseline against which future practices can be measured.

Organizations that lack the records to complete this inventory have already identified a compliance gap worth addressing immediately.

Step Two: Apply the Foreseeable Harm Test to Each Category

Once the inventory is complete, each exemption category in active use should be evaluated against the foreseeable harm standard. The relevant question is not whether a document falls within the technical scope of an exemption, but whether releasing it would foreseeably harm an interest the exemption was designed to protect.

This distinction matters most for the exemptions most frequently misapplied:

Exemption 5 (Deliberative Process Privilege): Courts have become markedly less tolerant of agencies that use this exemption to withhold documents that reflect final policy positions, that post-date a decision rather than precede it, or that contain purely factual material segregated from deliberative content. If your organization routinely withholds entire documents under Exemption 5 without performing segregability analysis, that practice is vulnerable.

Exemption 6 and 7(C) (Personal Privacy): Privacy exemptions require a balancing test between the individual's privacy interest and the public's interest in disclosure. Organizations that apply these exemptions reflexively—without documenting the balancing analysis—are asserting conclusions rather than reasoning. Courts have overturned redactions on precisely this basis.

Exemption 4 (Confidential Commercial Information): Following the Supreme Court's 2019 decision in Food Marketing Institute v. Argus Leader Media, the standard for what qualifies as confidential commercial information shifted. Organizations that calibrated their Exemption 4 practices to the prior National Parks test should verify that their current approach aligns with the revised standard.

Exemption 7 (Law Enforcement Records): The threshold requirement—that records were compiled for law enforcement purposes—is frequently glossed over in practice. If your organization cannot articulate how a specific document satisfies that threshold, the exemption claim begins on unstable ground.

Step Three: Evaluate Your Vaughn Index Capacity

A Vaughn index is the mechanism by which an agency demonstrates to a court that each withheld document or redaction is legally justified. It must describe the document with sufficient specificity to allow judicial review, identify the exemption claimed, and explain why the exemption applies.

The practical diagnostic question is this: if your organization were required to produce a Vaughn index tomorrow for any pending FOIA response, could you do it? More specifically:

• Are reviewers documenting their exemption rationale at the time of review, or reconstructing it after the fact?
• Is the documentation specific to the document at issue, or does it rely on generic descriptions applicable to any record?
• Has your organization experienced litigation in which a court found the Vaughn index inadequate?

Inadequate Vaughn index capacity is not merely a litigation risk—it is a signal that exemption decisions are not being made with the rigor the law requires.

Step Four: Identify Sector-Specific Vulnerability Points

Certain industries and agency types face recurring exemption challenges that a general audit framework may not surface on its own. Federal contractors frequently encounter disputes over Exemption 4 when agencies receive FOIA requests for contract documents containing proprietary pricing or technical data. Law enforcement agencies face heightened scrutiny on Exemption 7 claims involving body camera footage and use-of-force records. Regulatory agencies in health, environment, and finance often contend with Exemption 5 challenges when requesters allege that withheld documents reflect final agency positions rather than internal deliberation.

Compliance officers should supplement the general diagnostic with a review of recent case law specific to their sector. The Department of Justice's Office of Information Policy publishes annual FOIA litigation summaries that provide a useful starting point.

Step Five: Close the Gap Between Policy and Practice

The most common finding in a well-conducted exemption audit is not that an organization's written policies are wrong—it is that practice has diverged from policy in ways that accumulated gradually and went unnoticed. Reviewers apply shortcuts under time pressure. Supervisory review becomes perfunctory. New legal developments are not incorporated into training materials.

Closing that gap requires more than a policy update. It requires documented training records, supervisory spot-checks of exemption determinations, and a feedback loop that routes litigation outcomes back into the review process.

Organizations that treat an exemption audit as a one-time exercise will find themselves repeating it under less favorable circumstances. Those that build it into a regular compliance cycle are far better positioned to demonstrate, when it matters, that their redaction decisions were not merely asserted—they were reasoned, documented, and defensible.

The standard for FOIA compliance is not perfection. It is demonstrable good faith, grounded in current law. An exemption audit is the most direct path to knowing whether your organization can meet that standard.