An internal AI audit finds that a customer service AI model was promoted to production based solely on a business unit manager's sign-off, bypassing the formal validation process. The model governance policy requires independent validation for all customer-facing AI. Which audit finding classification is MOST appropriate?

B is correct because bypassing a required control (independent validation) is a significant governance deficiency regardless of observed model performance. Controls exist precisely to detect problems that casual observation might miss. The absence of independent validation means the organization does not know whether the model has undetected fairness issues, documentation gaps, or other problems that validation would reveal. Post-hoc performance observation (A, D) does not substitute for pre-deployment independent review. An exception process (C) would need to have been invoked and approved before bypass, not rationalized after the fact.