The first thing that an IS auditor should do when a follow-up audit reveals some management action plans have not been initiated is to escalate the lack of plan completion to executive management. This is because executive management is responsible for ensuring that necessary actions are taken to address identified risks and ensure the effectiveness of internal controls. The auditor should communicate the findings and the importance of timely action to mitigate the risks. Reference: ISACA, CISA Exam Preparation Guide, pg. 112.

The auditor should understand the reason for the deviation and evaluate if the new control mitigates the risk to an acceptable level. If necessary, the auditor can report the deviation in the audit report and provide recommendations for improving the process in the future.