A chief audit executive (CAE) determined that operational management did not address an open internal control issue, which creates a risk of material misstatement of the organization's financial statements. Which of the following is the best course of action for the CAE to take?
The best course of action for the Chief Audit Executive (CAE) when operational management has not addressed an internal control issue that poses a risk of material misstatement of the organization's financial statements is to escalate the issue to senior management. Senior management has the primary responsibility for addressing significant internal control issues and ensuring the integrity of financial reporting. By escalating the issue to senior management, the CAE ensures that the matter is addressed by those who are responsible and can implement the necessary corrective actions. Immediate reporting to the board would be premature without first giving senior management the opportunity to address the issue, and taking corrective action directly would be outside the typical scope of the CAE's responsibilities.
It is typically the responsibility of senior management to address significant internal control issues that could impact financial reporting. By escalating the issue to senior management, the CAE ensures that those responsible are made aware of the issue and can take appropriate action. While the board ultimately oversees financial reporting and internal controls, immediate reporting to the board may bypass the internal reporting structure and not allow senior management the opportunity to address the issue first.