High-risk model approvals are being handled through informal email threads. Why is this a governance problem?
Select an answer to reveal the explanation.
Short Explanation
You need a structured, auditable record for high-risk approvals. Email threads can be deleted, forwarded, or lost, so they don't reliably show what risk was reviewed, which controls were checked, or who approved it.
Full Explanation
The correct choice is the one saying informal email approvals leave no structured, auditable record of what risk was reviewed, what controls were checked, and who approved it. Governance depends on showing, after the fact, exactly what was reviewed and who signed off; email does not guarantee that in a form an auditor can rely on. The choice saying email is slower than a dedicated approval tool is incorrect because speed is secondary to the lack of a defensible, reviewable record. The choice saying emails cannot be archived beyond a fixed retention period is incorrect because retention limits are not the core objection. The choice saying informal approval is acceptable if the same people are copied is incorrect because being copied is not documented, accountable approval. For the exam, insist on a structured workflow with a retained record for high-risk approvals.