If the recommendations made by the internal audit activity regarding the organization ' s risk management function remain unaddressed, the next step should be for the chief audit executive (CAE) to discuss this matter with senior management and the board. This discussion aims to ensure that senior leaders are aware of the unaddressed risks and can take necessary actions to address the internal audit ' s findings effectively.
The IIA ' s International Standards for the Professional Practice of Internal Auditing, which stipulate the CAE
' s responsibilities in communicating significant risk exposures and control issues to senior management and the board.

According to IIA guidance, it is appropriate for an internal auditor to determine whether the organization has adequate controls to achieve its CSR objectives and to facilitate a management self-assessment of CSR controls and results. These activities are within the scope of internal auditing as they involve evaluating the effectiveness of governance, risk management, and control processes. Consulting on project design and implementation for CSR or excluding external risks goes beyond the typical role of internal auditing, which is to provide independent assurance.
The IIA ' s guidance on the role of internal auditing in organizational governance and control evaluations.

The most appropriate consulting service from the options provided is facilitating biannual training of the risk management team in risk identification methodologies. This is considered a consulting activity because it involves adding value and improving the organization's operations through training and development, a supportive role that falls squarely within the scope of consulting services as defined by the IIA.
IIA guidance on the nature of consulting services provided by internal audit activities.

Computer forensic auditing is the process of collecting and analyzing digital evidence from electronic devices. The purpose is to investigate and resolve cases involving cybercrime, fraud, or other illegal or unethical activities. One of the examples is recovering deleted communications and emails, which can help to reveal the identity, motive, or modus operandi of the perpetrators or suspects.

An effective continuing professional education (CPE) program for internal auditors involves ongoing development and engagement with the broader professional community. By encouraging auditors to volunteer and support research work of the local professional institute, the CAE promotes professional growth, knowledge sharing, and staying current with industry best practices and emerging trends. This practice not only enhances the auditors' skills and knowledge but also fosters networking and professional development opportunities.
The IIA Standards: Standard 1230 - Continuing Professional Development: "Internal auditors must enhance their knowledge, skills, and other competencies through continuing professional development." IIA Practice Guide: "Continuing Professional Education (CPE)": Highlights the importance of engagement with professional bodies and continuous learning as part of an effective CPE program.