The correct answer is A. Escalate the situation to audit management.

If a process owner accepts residual risk that appears to exceed the organization’s risk appetite, the IS auditor should not simply accept the action plan. The auditor should escalate the matter through the proper audit chain, beginning with audit management. Audit management can evaluate the significance of the disagreement, determine the proper escalation path, and decide whether the matter should be discussed with executive management or the audit committee.

Option B is incorrect because accepting an action plan that leaves risk outside the organization’s risk appetite would be inappropriate. Option C may become appropriate later, but the auditor should first escalate internally to audit management rather than going directly to the audit committee. Option D may also become appropriate, but direct communication to executive management should normally be coordinated through audit management and established audit protocols.

ISACA defines residual risk as the risk remaining after management has implemented a risk response, and risk appetite as the amount of risk an organization is prepared to accept in pursuit of its objectives.

This maps to Information Systems Auditing Process because it concerns audit findings, management responses, residual risk, and proper escalation.