A program has many controls but no consistent exception process. What should the manager establish?

1. A defined request, assessment, approval, expiry, and review lifecycle
2. An informal chat channel as the only approval record
3. Automatic approval for every request
4. A ban on recording exceptions