When management decides not to implement a critical recommendation, especially one related to regulatory compliance and potential reputational risk, it is essential for the chief audit executive (CAE) to escalate the issue to senior management. This step ensures that management fully understands the risks involved and can make an informed decision.
Detailed Explanation:
IIA Standard 2600 - Communicating the Acceptance of Risks:
This standard requires the CAE to communicate to senior management and the board when management has accepted a level of risk that the CAE believes is unacceptable. The CAE must ensure that the decision-makers are aware of the potential consequences.
Importance of Escalation:
By convening a meeting with senior management, the CAE can discuss the risks of non-compliance, including potential regulatory sanctions and reputational damage. This discussion provides an opportunity for senior management to reassess the decision in light of these risks.
IIA Practice Advisory 2600-1:
The advisory suggests that when significant risks are not being addressed by management, the CAE should communicate these concerns to higher levels of the organization. This ensures that the risks are not ignored and that appropriate action can be taken.
Why Not Other Options?
Option A (Do nothing): This is not appropriate, as the CAE has a responsibility to escalate significant risks.
Option B (Contact regulatory agency): This is an extreme step and should not be the first course of action. The issue should be discussed internally before involving external regulators.
Option D (Highlight to external auditors): While external auditors might need to be informed, the issue should first be addressed within the organization.