When senior management is challenging regulatory fines that could adversely affect the organization's ability to continue business, the chief audit executive (CAE) should assess the level of financial risks that may affect the organization's stability. This approach allows the CAE to evaluate the potential impact of the fines on the organization's financial health and ensure that appropriate risk management strategies are in place.
IIA Reference:
IIA Standard 2120: Risk Management requires internal auditors to evaluate the effectiveness and contribute to the improvement of risk management processes. In this scenario, assessing the financial risks helps ensure that the organization is adequately prepared to address the consequences of the fines.
The Practice Guide on Risk Management suggests that when facing significant risks, such as regulatory fines, the internal audit activity should assess the potential impact on the organization's financial stability and provide insights for management to consider in their decision-making process.