The chief audit executive (CAE) and management of the area under review disagree over managing a significant risk item. According to IIA guidance…

When disagreements occur regarding risk management or audit findings, the CAE should first

escalate the matter within management levels to attempt resolution. Only if the disagreement

remains unresolved after discussion with senior management should the CAE report the matter to

the board or audit committee.

Options B and C are premature: the charter does not grant internal audit supremacy over

management’s decisions, and documenting disagreement in the audit report should occur only after

reasonable attempts at resolution. Option A (escalating immediately to the board) should occur only

if discussion with management does not resolve the issue.

Reference:

IIA Standards – Standard 2600: Communicating the Acceptance of Risks.