How to handle policy exceptions efficiently?

In an ideal world, too many policy exceptions in my humble case is an indicator of policy failure. Not necessarily the process and implementation, but maybe the policy does not align with the business objectives and requirements or it has not been communicated well with the stakeholders. Coming back to the question and assuming there is a genuine need for an exception, we could look at various options, including a workflow system with delegated approvals. For example, if its a low risk, maybe the line manager can approve, whereas for higher risks, the policy owner should take the decision.