An IS auditor observes that exceptions have been approved for an organization's information security policy. Which of the following is MOST important for the au...