During external reporting for IT-dependent controls, a listed software company finds that the CIO wants to call a repeat issue a technical defect. The CRISC practitioner is asked to address issue aging escalation; internal audit has not retested the control. Which action BEST supports risk-based response and reporting?
