An internal audit uncovered high-risk issues that needed to be addressed by the organization.

When management agrees to address audit issues, the CAE must ensure that the final report documents management’s agreement and corrective action plan, including implementation timelines. This ensures accountability and enables proper follow-up monitoring.

Option B (follow-up engagement) may happen later, but the first step is proper documentation. Option C is unnecessary since management already agreed to corrective action. Option D is inappropriate because it is management’s responsibility to develop and own the action plan, not internal audit’s.