As a result of an audit, a policy exception was identified that had been approved by the compliance officer. The auditor

[answerhappygod]

As a result of an audit, a policy exception was identified that had been approved by the compliance officer. The auditor determined that the policy exception is a violation of a regulatory requirement.
What should the auditor do?

A. Advise the compliance officer on how to appropriately respond to policy exceptions.
B. Include the regulatory violation in the audit report and report it to the board of directors.
C. Consult with legal counsel to determine if the approval of the policy exception was acceptable.
D. Include the regulatory violation in the audit report and recommend the compliance officer be subject to disciplinary action by the board of directors.