The best course of action for an IS auditor who finds that some critical recommendations have not been implemented is to evaluate senior management’s acceptance of the risk. The IS auditor should understand the reasons why the recommendations have not been implemented and the implications for the organization’s risk exposure. The IS auditor should also verify that senior management has formally acknowledged and accepted the residual risk and has documented the rationale and justification for their decision. The IS auditor should communicate the findings and the risk acceptance to the audit committee and other relevant stakeholders. References:

CISA Review Manual (Digital Version)

CISA Questions, Answers and Explanations Database