An audit manager identifies that a financial institution (FI) has not produced a business-level risk assessment in accordance with policy. The senior manager of the FI assures that assessing risk at the individual client level and aggregating the data is an acceptable approach.
How should the audit manager proceed?