An internal audit finds that a production exception has no expiry date or designated owner. What is the best corrective action?

1. Disable all production monitoring until review is complete
2. Delete the audit finding without changing the exception
3. Convert every exception into a permanent policy rule
4. Assign an accountable owner and a review deadline