Here’s how I view/use those terms:
You would think that these two things always go hand-in-hand and very often they do, but not always.
For example, a security exception is at its heart a question of compliance, which may or may not represent an excessive level of risk — e.g., that missing patch may not represent much risk, or the risk associated with applying the patch is greater than the risk associated with not applying it. In other words a risk acceptance isn’t always necessary due to a security exception (at least if an organization is operating in a risk-based mode versus a compliance mode).
Similarly, you might have a situation that requires risk acceptance even though a security exception doesn’t exist. For example, perhaps an organization’s security policy doesn’t prohibit the use of customer data in development and test environments, yet a risk analysis show that permitting large volumes of sensitive data in those environments represents a significant amount of risk. In this case, no security exception is required, but a risk acceptance may be. In a case like this though, a prudent organization would probably alter its security policies based on this better understanding of the risk implications.
FAIR analysts know how to use quantitative risk analysis to estimate the level of risk in a security exception or to help an organization set its risk acceptance. Some 4,000 FAIR analysts and risk managers and information security officers have joined the FAIR Institute. It's a growing movement that you should join now.