How should I approach this audit execution problem without missing the real risk?

I am worried about missing the root issue because the workpaper steps feel too mechanical. The source discussion was triggered by 'Action plan'. The practical concern underneath it was: Hi, A question on management's answer to findings and recommendations. Standards state that when the risk incurred by the inappropriate/absence of action plan is > acceptable risk then the IA needs to convince management to take action, if that does not work, then senior manag