When senior management decides to accept risks, especially those involving questionable vendors, the chief audit executive should discuss the issue with the board. The board has the ultimate responsibility for the organization's risk management framework, and they need to be informed of any significant risks that could impact the organization. This ensures that the organization adequately considers and addresses potential risks at the highest level of governance.