An IS auditor finds that irregularities have occurred and that auditee management has chosen to ignore them. If reporting to external authorities is required, which of the following is the BEST action

In situations where irregularities are significant and auditee management is non-responsive, the IS auditor's professional and ethical obligation requires reporting these findings up their chain of command to audit management. Audit management will then review the findings, assess the implications, and determine the appropriate course of action, including whether to report to external regulators, ensuring due process and organizational policy compliance.

Obtaining approval from auditee management is inappropriate when they are the ones ignoring the irregularities, as it would compromise the auditor's independence and likely result in denial.

Seeking approval from auditee management (as explained above) is problematic, and while audit management approval is needed, combined approval is not the first or best step in this adversarial scenario.

Submitting the report immediately without internal audit management approval bypasses proper organizational governance and may violate internal policies or professional standards.