You must have the Approve Exceptions permission or the Exception Approval Manager role.
When creating an exception, you can specify that the exception needs approval before being applied to security check results, an endpoint, or a group of endpoints. This option gives you the flexibility to add an exception approval level to your change management workflow. Depending on your console permissions set, Secure Configuration Manager might automatically set the approval status. By default, Secure Configuration Manager allows you to apply exceptions to security check results or endpoints immediately.
On the Approved tab, you can also change the approval status to Disapproved for one or more exceptions.
For more information about establishing an approval process, see “Enabling Exception Approvals” in the User’s Guide to Secure Configuration Manager.