Which of the following is a good rule for handling exceptions?

• A. Only some people should be allowed to request exceptions.
• B. The requestor and approver should be different people.
• C. The exception should be documented.
• D. All of the above.

Answer: (D)

Handling exceptions effectively relies on governance and traceability. You want to limit who can initiate an exception so requests come from a controlled pool and aren’t used carelessly. You also want separation of duties, so the person requesting an exception isn’t the same one who approves it, providing a check against abuse or mistakes. Finally, every exception should be documented with the rationale, scope, risk, duration, and approved authority, creating an auditable record for accountability and future reference. When these practices are combined, you get a stronger, more reliable process that covers initiation, verification, and documentation. That's why choosing all of the above is the best approach.