A chief audit executive (CAE) following up on action plans from previously completed audits identifies that management has determined that certain action plans are no longer necessary If the CAE disagrees with managements decision, which of the following is the most appropriate next step for the CAE to take?

According to the Institute of Internal Auditors (IIA) Standards, the chief audit executive (CAE) has a direct and unrestricted line of communication to the board. When the CAE concludes that management has accepted a level of risk that may be unacceptable to the organization by not implementing agreed-upon action plans, the CAE must escalate the issue. While initial discussions should occur with senior management, if the disagreement persists and the matter is not resolved, the CAE's professional responsibility is to communicate the matter directly to the board (or its audit committee). The board has the ultimate oversight responsibility for the organization's risk management framework and can overrule management's decision.

A. The CAE must discuss the matter with senior management: This is an initial step, but if the disagreement is not resolved, or if the decision came from senior management, the ultimate and most appropriate step is escalation to the board.
B. The CAE must discuss the matter with key shareholders: The CAE's formal reporting line is to the board and senior management, not directly to shareholders. Bypassing the board would be a breach of established corporate governance protocol.
C. The CAE must discuss the matter with legal counsel: This would only be appropriate if the issue involved potential legal or regulatory noncompliance. The core issue here is a disagreement over risk acceptance, which is a governance matter for the board.

1. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing (Standards). Standard 2600 – Communicating the Acceptance of Risks.

Reference: "When the chief audit executive concludes that management has accepted a level of risk that may be unacceptable to the organization, the chief audit executive must discuss the matter with senior management. If the chief audit executive determines that the matter has not been resolved, the chief audit executive must communicate the matter to the board." This standard explicitly outlines the escalation path from senior management to the board for unresolved risk acceptance issues.

2. The Institute of Internal Auditors (IIA). (2017). Implementation Guide 2600: Communicating the Acceptance of Risks.

Reference: Paragraph 1 states, "The chief audit executive and senior management may disagree about the level of risk that is acceptable to the organization... If the disagreement cannot be resolved, the chief audit executive should inform the board of his or her view on the matter so that the board can make a final determination." This guide reinforces that the board is the final arbiter.

3. Marks, N. (2019). The Internal Auditor's Guide to Risk Assessment. The Institute of Internal Auditors Research Foundation.

Reference: Chapter 5, "Communicating Risk Assessment Results," discusses the CAE's responsibility to ensure that significant risks and management's responses are communicated to those charged with governance. It emphasizes that the audit committee (of the board) relies on the CAE for an independent perspective when management's risk decisions are questionable.