The chief audit executive (CAE) and management of the area under review disagree over managing a significant risk item. According to IIA guidance, which of the following actions should the CAE take first?

According to IIA guidance, when a disagreement over a significant risk arises between the chief audit executive (CAE) and management, the initial step is to escalate the discussion within the management hierarchy. The CAE should first discuss the matter with senior management to seek resolution before taking further action. Escalating directly to the board is the final step, to be taken only if discussions with senior management fail.

A. Referring the matter to the board is the final escalation step, not the first. It should only occur after discussions with senior management have been exhausted.
B. The audit charter grants authority but is not a tool for resolving specific disagreements on findings; it does not grant supremacy in operational risk decisions.
C. Recording both positions in the report is a valid action, but it typically follows unsuccessful attempts to resolve the disagreement through discussion.

1. The Institute of Internal Auditors (IIA), Global Internal Audit Standards, 2024. Standard 14.3: Disagreement with Management’s Decisions Regarding Risk, states, "If the chief audit executive concludes that management has accepted a level of risk that may be unacceptable to the organization, the chief audit executive must discuss the matter with senior management. If the matter is not resolved, the chief audit executive must communicate the matter to the board."

2. The Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing, 2017. Standard 2600: Communicating the Acceptance of Risks, provides the same escalation path: first discuss with senior management, and if unresolved, communicate to the board.