Does a severe audit issue mean internal audit should skip senior management?

author: AcadiFi Team

Answer:

Usually no. A severe issue may eventually require board attention, but internal audit should normally follow the approved escalation path. The CAE should discuss unacceptable risk with senior management and escalate to the board if the matter remains unresolved.

The exception is not "this sounds serious." The exception is a real governance constraint, such as senior management being involved in the issue, a legal reporting requirement, a whistleblower protocol, or a board-approved emergency escalation process.

That distinction is important on the CIA exam. Severe facts increase the need for timely communication, but they do not automatically authorize every auditor to bypass the CAE or senior management.