The first thing that an IS auditor should do when a follow-up audit reveals some management action plans have not been initiated is to escalate the lack of plan completion to executive management. This is because executive management is responsible for ensuring that necessary actions are taken to address identified risks and ensure the effectiveness of internal controls. The auditor should communicate the findings and the importance of timely action to mitigate the risks. Reference: ISACA, CISA Exam Preparation Guide, pg. 112.