What if management rejects an automated monitoring control?

Internal audit should evaluate the residual risk and management's rationale. If the risk is within appetite, document the decision and adjust audit coverage as appropriate. If the risk appears above tolerance, the CAE should follow the approved escalation process for risk acceptance.

Internal audit should be careful about continuing to operate the rejected control itself. If audit keeps running the test indefinitely, stakeholders may believe the risk is monitored when management has not actually accepted ownership or built a sustainable response process.