Information technology (IT) systems should be able to capture data useful to management to better understand the company’s risk profile and risk management. This means not granting exceptions ...