The IS auditor's primary responsibility in the reporting phase is to provide a fair and accurate account of the audit findings and management's disposition of those findings. When management decides to accept a risk rather than implement a corrective action, the immediate and standard procedure is to document this formal response in the audit report. This creates an official record for senior management and the audit committee, ensuring transparency and accountability. This documentation is the foundation for any further governance oversight or potential future escalation, should the accepted risk be deemed significant or unacceptable by higher authorities.

B. Escalate the acceptance to the board. Escalation directly to the board is an extreme measure, typically reserved for critical risks that threaten the organization's viability and is not the immediate next step.
C. Ensure a follow-up audit is on next year's plan. Scheduling a follow-up is part of the audit planning cycle and a subsequent consideration, not the immediate action required after receiving management's response.
D. Escalate acceptance to the audit committee. Escalation to the audit committee is only warranted if the auditor concludes that the level of accepted risk is inappropriate or exceeds the organization's established risk appetite. The first step is always documentation. ---

1. ISACA

CISA Review Manual

27th Edition. Domain 1: The Process of Auditing Information Systems

Section: "Communicate Audit Results." The manual states that the final audit report should include management's response to the findings. This explicitly covers the documentation of risk acceptance as the formal response.

2. ISACA

ITAF™: A Professional Practices Framework for IS Audit/Assurance

4th Edition. Standard 2401: Reporting. This standard outlines the requirements for audit reporting

specifying that the report should contain the findings

conclusions

and recommendations

as well as "management's response (if any)." This confirms that documenting the response is a required procedural step.

3. Cascarino

R. E. (2012). Auditor's Guide to Information Systems Auditing. John Wiley & Sons. Chapter 18: "Reporting and Communication Skills." This text details the audit reporting process

emphasizing that the auditor's report must present management's comments and action plans

including decisions to accept risk

to provide a balanced view for the report's recipients (e.g.

the audit committee).