Personally speaking (mostly lab work with some real-world experience):

• Metasploit first (why reinvent the wheel? if it works, go with that and move on to something more interesting)
• Modification of existing code (milw0rm, Packet Storm, etc.)
• Handwritten as last option (unless practice at exploit dev is the goal)

If all you're looking for is access to the box I'd stick with this order.

From a business perspective writing the exploit from scratch doesn't make sense (assuming an less intensive (Metasploit, modifying PoCs etc.) option works). All the business is interested in is if the vulnerability exists and the risk to the business.

Proving you're 3l1t3 and coding it yourself isn't going to gain you anything in the business world, and may actually reduce the impact the vulnerability has on the business people. However if you can demo freely downloading a point and click application that makes their essential web-server fall over revealing corporate secrets and client CC info in a few clicks, that can definitely get the point home

Thanks Guys!