The most information I can find is that the standard is maintained by the ISO 3166 Maintenance Agency [1]. Additions appear to be mostly at the direction of the United Nations [2], but I couldn't find a clear procedure as to how a country code is removed. I'm also unclear on who makes the decision to mark codes as exceptionally reserved.
[1] https://en.wikipedia.org/wiki/ISO_3166#ISO_3166_Maintenance_...