When an internal auditor identifies a potential significant weakness in a control and management does not agree with the assessment, the appropriate next step is to perform additional audit work to better articulate the risk. This means gathering more evidence, conducting further analysis, and providing clearer examples of how the weakness could impact the organization. By doing this, the auditor can better communicate the potential consequences and severity of the risk to management, increasing the likelihood of reaching a mutual understanding and agreement on the necessary actions.

The Institute of Internal Auditors (IIA) Practice Guide: Communicating Risk and Control Information

IIA Standard 2310 - Identifying Information

IIA Standard 2410 - Criteria for Communicating