As part of an audit response, an auditee has concerns with the recommendations and is hesitant to implement them. Which of the following would be the BEST course of action for the IS auditor?

Suggesting a third-party consultant adds an unnecessary layer of complexity and cost before the auditor has fully engaged with the auditee to understand and address their concerns.

Issuing a final report without the auditee's opinion undermines the collaborative nature of an audit, can lead to resistance, and fails to leverage the auditee's operational insights for practical solutions.

Conducting further discussions with the auditee to develop a mitigation plan demonstrates collaboration, helps understand the auditee's specific concerns or constraints, and fosters a more practical and mutually agreeable solution. This approach increases the likelihood of recommendations being effectively implemented while ensuring risks are appropriately addressed.

Accepting the auditee's response without addressing the underlying hesitation or performing additional testing to validate concerns might compromise the integrity of the audit and leave identified risks unmitigated.