An organization needs evidence that security exceptions have owners, expiration dates, and compensating controls. Which approach is most appropriate?

1. Delete findings for exempt resources without retaining the exception decision.
2. Allow each workload to define its own unreviewed exemption from every policy.
3. Maintain an approved exception process with documented rationale, accountable owners, review dates, and controls.
4. Treat a verbal approval as permanent authorization with no record.