At our Bank, we ask for responses to include the action plan management will take and an estimated time frame (ie. We will implement this new procedure by 2nd quarter 2009). So I don't think I would accept that response. Management does have the right to disagree with the recommendation and accept the risk. In your case, they aren't really saying if they agree or disagree. They aren't committing to anything.
Do they need more time to think about it and research? I've had recommendations that are on-going for months and I just check in with them each quarter. They are usually longer term projects.
I would go back to them and just discuss what types of info you would expect to see in a response and ask them to add to their response as appropriate.