A large enterprise is implementing an information security policy exception process. The BEST way to ensure that security risk is properly addressed is to:

Confirming process owners' acceptance of residual risk ensures that accountability for the increased risk associated with the policy exception is formally assigned to the responsible business unit, making them aware of and willing to bear the potential consequences.

Performing penetration tests assesses current vulnerabilities but is not a direct control for managing individual policy exceptions or formally addressing their associated risks.

Obtaining IT security approval is a necessary step, but it is incomplete without formally documenting and acknowledging who ultimately accepts the residual risk from a business perspective.

Benchmarking policy against industry best practice is for policy development and review, not for the specific process of handling and addressing risks from policy exceptions.