A security exception has no expiry, owner, or review trigger. Which governance weakness is most significant?

1. The organization lacks accountable, time-bounded oversight of the exception
2. The exception form has no logo
3. The exception has not been approved by the technical product vendor
4. The exception must be replaced by an identical control in every system