Which of the following is an IS auditor's BEST course of action when the auditee indicates that a corrective action plan for a high-risk finding will take longer than expected?

For a high-risk finding, any delay in remediation leaves the organization exposed to significant risk. The most responsible and immediate course of action for an IS auditor is to ensure that while the permanent solution is pending, temporary or compensating controls are put in place to mitigate the identified high risk. This minimizes the organization's exposure during the extended remediation period.

Requiring completion in the agreed timeframe might be unrealistic if legitimate delays exist and does not proactively address the current risk exposure.

Simply accepting a longer target date without ensuring interim risk mitigation is irresponsible, especially for a high-risk finding.

Escalating to the audit committee is an appropriate step if interim controls are not possible or if management is unresponsive, but it's not the first course of action for immediate risk mitigation.