An internal AI audit finds that a customer service AI model was promoted to production based solely on a business unit manager's sign-off, bypassing the formal validation process. The model governance policy requires independent validation for all customer-facing AI. Which audit finding classification is MOST appropriate?

The most appropriate classification is a significant deficiency because a required control—independent validation—was bypassed, creating model risk exposure regardless of whether the model performed well. Controls exist to detect problems that observation might miss. Without independent validation, the organization does not know whether the model has undetected fairness issues, documentation gaps, or other problems validation would reveal. The observation that the model performed adequately is wrong because post-hoc performance observation does not substitute for pre-deployment independent review. The no-finding position is wrong for the same reason: acceptable performance does not make retrospective validation unnecessary or erase the control failure. The informational finding that the business unit followed an expedited process that should be formally documented as an exception is wrong because an exception process would need to have been invoked and approved before the bypass, not rationalized after the fact.