First of all, I will ask him regarding on the practices that currently being practiced by him. I will discuss with him on the posibilities of risk that can be occurred and how he can manage and control it. If the control is adequate enough, I will highlight and report it to the Management regarding his best practices and controls. But if he cannot answer me on the controls on how to mitigate risks that we highlighted before, I will highlight to him the implications and the consiquences of my assessment/finding. Or I will put it in the report and recomend to him whether he will require to comply the procedures or change the company's procedure.
I explained the context for my client's initial inclination and how I persuaded them to adopt a different alternative through case studies, data and postulating how their selection would impact their users in the future (creative visualization).