After identifying and reporting a control deficiency, which of the following actions should an internal...

The auditor’s responsibility does not end with reporting a control deficiency. The CAE must monitor progress and follow up periodically with management to confirm whether corrective actions have been implemented.

Option A stops at documentation and fails to ensure corrective action. Option C incorrectly assumes no further audit is needed. Option D assigns management’s responsibility to the auditor, which would impair independence.