An audit report identifies a critical access-control weakness. Management disagrees with the severity. What should the auditor do?

1. Discuss supporting evidence and business impact, documenting unresolved disagreement through the reporting process
2. Publish allegations without giving management an opportunity to respond
3. Implement the control personally and omit the finding
4. Remove the finding solely to obtain management approval