A follow-up review found that a significant internal control weakness had not been corrected. The CAE discussed this matter with senior management and was informed of management’s willingness to accept the risk. The CAE should:
a. Do nothing further because management is responsible for deciding the appropriate action to be taken in response to reported engagement observations and recommendations.
b. Initiate a fraud investigation to determine if employees had taken advantage of the internal control weakness.
c. Inform senior management that the weakness must be corrected and schedule another follow-up review.
d. Assess the reasons that senior management decided to accept the risk and inform the board of senior management’s decision.