https://www.esecurityplanet.com/networks/what-is-log-monitoring/

Senior leadership is primarily responsible for establishing and reinforcing the control culture by setting the tone at the top, demonstrating commitment to policies, and ensuring accountability, which directly influences employee adherence to IT access control policies.

The most concerning issue when reviewing an organization's business impact analysis (BIA) is that a risk assessment was not conducted prior to completing the BIA. A risk assessment is essential to identify potential threats and vulnerabilities to the organization's critical systems, which helps inform the BIA by assessing the potential impact of disruptions. Without this assessment, the BIA may lack an adequate understanding of the actual risks faced by the organization, leading to incomplete or ineffective disaster recovery and business continuity planning.

The IS auditor should record management's decision to accept the risk in the audit report, ensuring it is clearly documented. This provides transparency and accountability, noting that management has consciously decided to accept the identified risk.
Escalating the acceptance to the board or audit committee may be necessary only if the accepted risk is significantly outside the organization's risk appetite or policy. However, the first step is to document the decision. Ensuring a follow-up audit can be planned if required, but documenting the decision is the most immediate and essential action.