A risk practitioner observed Vial a high number of pokey exceptions were approved by senior management. Which of the following is the risk practitioner's BEST course of action to determine root cause?

Reviewing the risk profile would provide a high-level overview of known risks, but not specific details about why particular policy exceptions are frequently approved.

Reviewing policy change history might show *when* a policy changed, but it wouldn't explain *why* exceptions to the *current* policy are being granted.

Interviewing the control owner directly provides crucial qualitative information about the reasons for the exceptions, such as operational challenges, business requirements that conflict with the policy, policy design flaws, or resource constraints. This direct engagement is the most effective way to understand the human and process factors contributing to the high exception rate and identify the root cause.

Performing control testing would assess if controls are operating effectively, but the issue here is the *approval of exceptions* to existing policies, which suggests the policy itself or its application might be the underlying problem, not necessarily a control failure in execution.