A board asks who may authorize operation outside an approved tolerance. What should provide the answer?

1. The number of controls already installed
2. Documented governance authority and escalation rules
3. The administrator currently on call
4. The external software vendor's sales contract alone