“Management should ensure that controls over vendor bank changes are strengthened.” That sentence has appeared, in one wording or another, in more audit reports than any other, and it has never once been implemented, because there is nothing in it to implement. It names no control, no change, no owner and no date; it asks management to ensure, which is not an action; and it asks for strengthening, which is not a state anyone can reach or a validator can test. A year later the finding is closed on a memo saying the controls have been strengthened, and the next audit finds 31 of 46 changes unverified again. Standard 14.4 requires recommendations that address the root cause and are practical, and the whole difference between a recommendation that changes something and one that decorates a report is whether it can be done on a Monday by a named person and shown to be done on a Friday by another.
This guide is about writing recommendations of the first kind. It covers when a report carries a recommendation and when it carries management’s action plan instead, the anatomy of an implementable recommendation, the verbs that make one and the words that unmake one, how to match the recommendation to the cause family, proportion and the four options every recommendation chooses among, layering immediate, short-term and structural actions, defining “done” at the moment of writing, the recommendations that overreach, a checklist, and ten recommendations from the engagements on this site rewritten from their first drafts. It is the fourth of five guides on writing the elements of a finding, after conditions, causes and impact, and before the makeovers, within the structure the five Cs masterclass sets out.
In this guide
- Recommendation or action plan: which one the report carries
- The anatomy of an implementable recommendation
- The verbs that make a recommendation, and the words that unmake one
- Matching the recommendation to the cause family
- Proportion: the four options and the cost of each
- Layering: immediate, short-term and structural
- Defining “done” at the moment of writing
- Recommendations that overreach
- Offering the recommendation: the conversation that turns it into a plan
- What the follow-up finds
- Recommendations in advisory work and in reports to the board
- The recommendation checklist
- Ten recommendations rewritten
- Common mistakes
- Where to go next
Recommendation or action plan: which one the report carries
Standard 14.4 draws a distinction most functions blur: the recommendation is the auditor’s proposal, and the action plan is management’s commitment, and a report may carry either or both. Where management has developed an action plan that addresses the root cause and passes the five tests, the report carries the plan, and the auditor’s recommendation may be unnecessary; where management has not, or the plan is inadequate, the report carries the auditor’s recommendation with management’s response beside it. The distinction matters for two reasons. It keeps ownership where it belongs: a plan management wrote is a plan management owns, and a recommendation the auditor wrote and management “agreed” is owned by nobody in particular. And it tells the auditor what the recommendation is for: it is the standard the action plan is measured against, which means it has to be specific enough to measure against, and the auditor who writes “strengthen controls” has set a standard any plan meets. The best practice in the engagements on this site is that the auditor drafts a recommendation at the evaluation stage, uses it in the fact validation conversation to invite management’s plan, and then reports the plan where it is adequate and the recommendation where it is not, with the finding record holding both.
The anatomy of an implementable recommendation
An implementable recommendation has six parts, and it is usually two sentences. The action verb says what is done. The object says what it is done to: a control, a system configuration, a process step, a document, a role, a threshold. The owner says who does it, as a role. The timing says by when, in proportion to the rating. The measure of done says what will exist afterward that does not now, in a form a validator can inspect. The interim measure, for a High or Medium with a fix more than a quarter away, says what protects the organization in the meantime. The table gives the six for one finding and the sentences that assemble them.
| Part | The question | For the bank-detail change finding |
|---|---|---|
| Action verb | What is done? | Configure; require; assign |
| Object | To what? | The vendor master change workflow; a verification record; the master-data role |
| Owner | By whom, as a role? | The controller for the workflow; the chief financial officer for the role |
| Timing | By when, in proportion to the rating? | Workflow by the end of the next quarter; the role by the quarter after; the interim now |
| Measure of done | What will exist afterward that a validator can inspect? | No bank-detail change becomes effective without a second approver and a completed verification record in the system; a named analyst owns the change process |
| Interim | What protects the organization until then? | The AP supervisor reviews every bank change against a call-back record before the weekly payment run, evidenced on the change report |
| Assembled | “Configure the vendor master workflow so that a bank-detail change cannot take effect until a second approver has confirmed a verification record showing a call-back to a number on file (controller, by 30 June), and assign ownership of the change process to a master-data role independent of accounts payable (chief financial officer, by 30 September). Until the workflow is live, the AP supervisor is to review every bank change against its call-back record before each weekly payment run and sign the change report.” |
The verbs that make a recommendation, and the words that unmake one
A recommendation is made by its verb. “Ensure”, “enhance”, “strengthen”, “improve”, “consider” and “review” are the verbs that unmake one, because none of them names an act: to ensure is to want an outcome, to enhance is to move in a direction, to consider is to think. The verbs that make a recommendation name an act a person could perform and a validator could observe. The table pairs the unmaking words with the questions they hide and the verbs that answer them.
| The word | The question it hides | Verbs that answer it | Example |
|---|---|---|---|
| Ensure that | By doing what? | Configure, require, block, route, assign, reconcile, compare, restrict | “Block issuer approval of credit memos in the order system” rather than “ensure credits are independently approved” |
| Strengthen, enhance, improve | From what to what? | Add, replace, extend, raise, lower | “Extend the corporate card program to the two acquired distributors” rather than “strengthen expense controls” |
| Consider | Should they or should they not? | Decide by [date] whether to; or state the action | “Decide by quarter end whether the three depots’ accounts move to head-office reconciliation, and if not, document the acceptance” rather than “consider centralizing” |
| Review | To decide what, by when? | Re-perform, re-base, recertify, test, compare | “Re-base the allowance method on three years of write-off history” rather than “review the allowance” |
| Monitor | Which metric, reported to whom, triggering what? | Report [metric] to [role] [frequency]; escalate when [threshold] | “Report reconciling items past deadline by owner to the controller monthly, with items past ninety days escalated to the CFO” |
| Communicate, remind, train | Is the cause knowledge, and what will be different afterward? | Only where the cause is knowledge; otherwise replace with the design verb | “Train the twelve depot evaluators in the scoring procedure and require completion before they next evaluate” only if the cause was that they did not know it |
| Appropriate, adequate, timely, robust, as necessary | What standard? | State the standard: the number, the date, the threshold | “within ten working days of the target date” rather than “in a timely manner” |
Matching the recommendation to the cause family
The cause statements guide sorts causes into six families, and each family implies a kind of recommendation. The match is the first test of a recommendation: a design cause answered with training, or an ownership cause answered with a system change, is a recommendation that will be implemented and will not remove the condition. The table gives the match, with the recommendation each family produced in the engagements on this site.
| Cause family | Recommendation type | Example |
|---|---|---|
| Design: the system or process permits the condition | Configure, block, route, require in the system; redesign the step | “Configure the HR workflow so that the user who enters a rate change cannot approve it, and add workflow roles to the quarterly access recertification” |
| Capacity and capability: the people cannot do it in the time or with the skills | Redistribute, assign, fund a role; specific training with a completion requirement | “Redistribute the 140 reconciliations owned by two accountants across the team by the next close, and remove post-close journal preparation from the reconciliation owners” |
| Incentive and pressure: the measures reward the condition | Change the threshold, the target or the approval design that creates the incentive | “Raise the plant-level capital approval limit to 50,000 dollars with a two-day turnaround, and add a capitalization review to repairs coded above 5,000 dollars” |
| Information: the responsible people could not see it | Produce the report, display the status, add the metric, route the exception | “Generate quarterly certifications from the reconciliation tool with open exceptions pre-populated, requiring an acknowledgment of each” |
| Ownership and governance: nobody owns it | Assign the role, name the owner, define the escalation | “Assign each complementary user control in the payroll provider’s SOC 1 report to a named owner, and schedule an annual reliance review of the report by the controller” |
| Change: a migration or departure broke it | Complete the change; add a control over future changes | “Route the acquired depots’ credit memos through the ERP workflow by quarter end, and add a control-integration checklist to the acquisition playbook” |
Proportion: the four options and the cost of each
Every recommendation chooses among four options, and the choice should be visible: prevent the condition, by a control that stops it before it happens; detect it, by a control that finds it afterward, quickly enough to matter; compensate, by a control elsewhere that limits the consequence; or accept, which is management’s decision under the risk acceptance guide and not the auditor’s to recommend but the auditor’s to name as an option. The choice is proportion: a Low finding recommends the cheapest option that works, usually detection or a procedural fix; a High recommends prevention, with detection as the interim; a Medium is usually where the argument lives. The auditor who recommends a prevention control costing two years and a system project for a Low has written a recommendation management will decline and the audit committee will not support; the auditor who recommends a monthly review for a High has written one management will accept and the next audit will reopen. The cost of the recommendation belongs in the auditor’s own evaluation even when it is not in the report, and the five tests’ fifth test, proportion, is where the engagement lead checks it. Where the right option is expensive and the rating justifies it, the recommendation says so and offers the interim measure; where the cost-benefit comparison is close, the recommendation may present two options with their costs and leave the choice to management, which is not weakness but the honest form of a recommendation on a judgment call.
Layering: immediate, short-term and structural
Most High and many Medium findings need more than one action at more than one horizon, and a recommendation that names only the structural fix leaves the risk running until it arrives. Layering states three actions: the immediate measure, usually manual and detective, that operates from the closing meeting; the short-term action, within a quarter, that fixes the proximate cause; and the structural action, within two or three quarters, that fixes the root. Each layer has its own owner, date and measure of done, and the follow-up validates each in turn. The table layers the Pennine reconciliation finding.
| Layer | Action | Owner and date | Measure of done |
|---|---|---|---|
| Immediate | The fourteen accounts with unexplained differences are reviewed weekly by the controller until cleared, with the status report escalated to the CFO from this month | Controller; from the next close | Weekly review evidenced; escalation on the CFO’s monthly agenda |
| Short-term | Ownership of the 140 reconciliations redistributed; roll-forward of aged items disabled in the tool; the fourteen differences cleared | Controller; by the half-year | Ownership list changed in the tool; configuration changed; the fourteen accounts reconciled to the standard and re-performed by internal audit |
| Structural | Post-close entries routed through workflow to the controller with mandatory support; the consolidation review scheduled before release with queries recorded; the close calendar rebuilt to the seven-property standard with a named owner for every task | Chief financial officer; by year end | Workflow configuration; review evidence with queries for two quarters; the calendar reconciled to task logs for three months |
Defining “done” at the moment of writing
The measure of done is the part of a recommendation that the follow-up depends on and the part most often left out, because at the moment of writing the fix seems obvious. A year later, the validator arrives with the recommendation and finds that “implement dual approval” has been implemented as a policy sentence, and there is nothing in the recommendation to say that was not enough. The measure of done is written at the moment of writing, as the evidence closure will require, agreed with management in the response, and recorded in the finding record so that the validation standard is fixed before anyone has an interest in lowering it. The issue validation guide sets the evidence by rating: for a High, re-performance on post-remediation data; for a Medium, inspection of the implemented control and a small sample; for a Low, management’s evidence reviewed. The recommendation says which, in a sentence a validator can execute.
Recommendation record. 1. Finding number and the cause family the recommendation addresses. 2. The recommendation in full: verb, object, owner as a role, date. 3. The option chosen (prevent, detect, compensate) and why, with the alternatives and their costs in one line each. 4. The layers, where there are more than one, each with owner, date and measure of done. 5. The interim measure for a High or Medium with a fix more than a quarter away. 6. The measure of done for each layer: what will exist, where, that a validator can inspect. 7. The validation standard by rating: re-performance, inspection with sample, or evidence review, and the population or period it will cover. 8. Management’s action plan as received, and whether it was accepted in place of the recommendation, with the five-test evaluation referenced. 9. The date the recommendation was drafted, and the date management first saw it.
Recommendations that overreach
A recommendation can be specific and still be wrong, by reaching into decisions that are management’s. The auditor who recommends a particular software product has recommended a procurement decision; the auditor who recommends that the AP team be reorganized under the controller has recommended an organization design; the auditor who recommends that a supplier be replaced has recommended a commercial decision. In each case the recommendation should name the control outcome and leave the means to management: “a system-enforced verification step before a bank change takes effect”, not “the vendor portal module from the ERP provider”; “separation of the reconciliation and post-close journal roles”, not “move the two accountants to the reporting team”. The second overreach is volume: three recommendations per finding, each addressing a different symptom, which produces a plan with nine actions and no priority. One recommendation per finding, addressing the cause, with layers where the horizon requires them, is the standard; where a finding genuinely needs two independent actions, it is usually two findings. The third is scope: recommending a change to a process the engagement did not audit because it resembles the one it did, which is a recommendation with no condition behind it and should go to the potential findings list for the next engagement instead.
Offering the recommendation: the conversation that turns it into a plan
A recommendation is offered before it is reported, in the fact validation conversation the life of a finding describes, and the offer is what turns it into management’s plan. The auditor states the cause, states the recommendation as a proposal, and asks the process owner two questions: does this address the cause as you understand it, and is there a better way to do it that you would own? The second question is the one that produces good action plans, because the process owner knows constraints the auditor does not, the system change that is already scheduled, the role that is already being recruited, the report that already exists and is not read. Where the owner’s alternative addresses the cause and passes the five tests, it becomes the plan and the report carries it; where it does not, the auditor says which test it fails and the recommendation stands. The conversation is recorded in the finding record, and its most useful output is often a plan that is better than the recommendation, which is not a loss for the auditor but the point of having made the recommendation specific enough to improve on.
What the follow-up finds: recommendations that closed and recommendations that did not
The test of a recommendation is the follow-up, and the engagements on this site give a year of evidence. The recommendations that closed on validation were the ones with a configuration in them: the vendor portal with dual approval, the HR workflow split, the exact-match duplicate check re-enabled, the credit memo routing. Each had a measure of done that a validator could inspect in the system, and each was validated by re-performance on post-remediation data within a quarter of its date. The recommendations that did not close, or closed and reopened, were the ones that had been accepted as reviews, reminders and monitoring without a metric: the “temporary” local vendor-create right at MidState’s acquired distributors, still open a year later because the recommendation to remove it had no date; the Brightwater conflict declarations, current at the start of the year and not refreshed because the recommendation said “maintain” and named no cadence; the threshold monitoring that covered the cliff the audit found and not the ladder. The pattern is not that management ignored the weak recommendations; it is that management implemented exactly what they said, which was nothing in particular. A function that reads its own follow-up results this way, once a year, learns which of its verbs to retire.
| Recommendation as written | What management implemented | Follow-up result | The lesson |
|---|---|---|---|
| “Implement dual approval with a verification record in the vendor master workflow by 30 June” | Portal with enforced dual approval; verification record fields | Closed on re-performance; residual Low on one optional field a year later | The measure of done was inspectable; the residual was in the one element left optional |
| “Remove the acquired distributors’ local vendor-create right once the master-data role is in place” | The role was created; the right was not removed, because “once” had no date | Reopened as a Medium | A condition without a date is a recommendation without one |
| “Maintain current conflict declarations for all staff with buying or evaluation influence” | Declarations collected once | Fourteen new evaluators undeclared at re-test | “Maintain” needs a cadence and an owner; “recertify annually by [role]” would have closed |
| “Add threshold monitoring to the quarterly procurement pack” | Monitoring of the 10,000-dollar limit | Clustering found under the 100,000-dollar threshold | “Threshold” was singular; “every threshold in the delegation” was the recommendation that was meant |
| “Re-base the allowance method on three years of write-off history by year end, with the annual review documented as a re-performance” | Method re-based; review documented | Closed on inspection of the re-basing | A review recommendation closes when it says what the review will do and produce |
Recommendations in advisory work and in reports to the board
Two settings change the recommendation’s voice without changing its anatomy. In advisory engagements, where no assurance is given and there are no findings, the recommendation becomes an option or a design proposal, and it is written with the same six parts but offered rather than required: “if the organization proceeds with the outsourced payroll model, the four complementary user controls in the provider’s report should be assigned to owners before go-live” is advisory, specific and implementable, and it avoids the assurance language that would turn an advisory memo into an audit report by accident. In reports to the audit committee, recommendations are aggregated rather than restated: the committee does not need the workflow configuration, it needs to know that the three High findings have plans with named executives and dates, that two have interim measures, and that one is a risk the chief executive has accepted under the acceptance procedure. The anatomy of a report puts that aggregation in the executive summary’s fifth item, and its source is the recommendation records the function keeps, which is one more reason to keep them.
The recommendation checklist
Recommendation checklist. 1. The verb names an act: configure, require, assign, block, route, reconcile, compare, report; not ensure, enhance, strengthen, consider, review. 2. The object is a control, configuration, step, document, role or threshold, named. 3. The recommendation addresses the cause family the cause statement names. 4. The owner is a role with the authority and budget to act. 5. The date is proportionate to the rating, and a High has an interim measure from now. 6. The measure of done is stated as something a validator can inspect. 7. The validation standard by rating is stated or referenced. 8. The option chosen is visible and proportionate: prevent for Highs, the cheapest option that works for Lows. 9. There is one recommendation per finding, layered where the horizon requires. 10. It names the control outcome and leaves the means to management. 11. It stays within the engagement’s scope. 12. It was offered to the process owner before the draft, and their alternative was evaluated. 13. A reader who owns the process could start on Monday.
Ten recommendations rewritten
| First draft | What is missing | Rewritten |
|---|---|---|
| “Management should ensure that vendor bank changes are properly verified.” | Act, object, owner, date, done | “Configure the vendor master workflow so that no bank-detail change takes effect until a second approver confirms a verification record showing a call-back to a number on file (controller, by 30 June); until then, the AP supervisor signs the weekly change report against call-back records before each payment run.” |
| “Strengthen segregation of duties in the HR workflow.” | Act and object | “Split the enter and approve roles in the HR rate-change workflow so that no user holds both, and add workflow roles to the quarterly access recertification (HR director, by quarter end).” |
| “Consider centralizing reconciliation of the three depots’ bank accounts.” | A decision offered as an action | “Move the three depots’ bank accounts into head-office reconciliation by [date] (controller); if the audit committee decides otherwise, record the acceptance under the risk acceptance procedure.” |
| “Enhance monitoring of sole-source awards.” | Metric, recipient, trigger | “Report the sole-source rate by category and buyer to the procurement committee quarterly, with any award above 50,000 dollars listed, and require the justification memo standard for every award above threshold (head of procurement, from next quarter).” |
| “Remind staff of the capitalization policy.” | Wrong cause family: the cause was incentive | “Raise the plant-level capital approval limit to 50,000 dollars with a two-day turnaround, and add a capitalization review by the fixed asset accountant for any repair invoice above 5,000 dollars (CFO for the limit, controller for the review, by quarter end).” |
| “Improve the close process to reduce late entries.” | Everything | “Route post-close journal entries through workflow approval by the controller with mandatory attached support, and report the post-close share of manual journals to the audit committee quarterly (controller, from the next close).” |
| “Ensure certifications are reviewed appropriately.” | Act, standard | “Generate quarterly certifications from the reconciliation tool with open exceptions pre-populated, require the owner to acknowledge each exception before signing, and report the count of certifications with exceptions to the audit committee (controller, from next quarter).” |
| “Review the complementary user controls in the payroll provider’s SOC 1 report.” | Decision offered as action; no owner | “Assign each of the four complementary user controls to a named owner, document how each is performed and evidenced, and schedule the controller’s annual reliance review of the report within sixty days of its issue (controller, by quarter end).” |
| “Implement controls to prevent duplicate payments.” | Object and done | “Re-enable the ERP’s duplicate-invoice check with normalized matching on vendor, invoice number and amount, merge the 188 duplicate vendor records, and run the duplicate analytics monthly until two consecutive clean months (controller; check in 30 days, merge in 90).” |
| “Address the credit memo approval weakness at the acquired depots.” | Act, object, date, interim | “Route the acquired depots’ credit memos through the ERP approval workflow with issuer approval blocked (controller, by quarter end); until then, the credit manager reviews every credit above 500 dollars raised at those depots weekly against return receipts, evidenced on the credit register.” |
Every rewrite is longer, and every one could be handed to the named role on Monday. The first drafts were not lazy; they were written by auditors who knew what needed to happen and assumed the reader did too. The reader did not, and the rewrites cost each finding one more sentence and each follow-up a year less.
Common mistakes
Ensure, enhance, strengthen, consider. Recommending the symptom’s fix when the cause was named. Training against a design cause. Three recommendations per finding. Recommending the means rather than the outcome: the product, the reorganization, the supplier. A High with no interim measure. No measure of done, so that a policy sentence closes a control finding. A date with no owner, or an owner with no authority. A recommendation management first sees in the draft. Recommending beyond the engagement’s scope. And the mistake that produces the rest: writing the recommendation as the last sentence of the finding, in the draft week, rather than as the proposal that the fact validation conversation was built around.
Where to go next
Name the act, the object, the owner, the date and the evidence of done; match the recommendation to the cause family; choose the option in proportion to the rating; layer it where the horizon requires; and offer it before you report it. The elements before it are in writing airtight conditions, writing cause statements and writing impact that lands; all four are assembled in the finding makeovers; the evaluation of the plan management offers in return is in the management responses guide; and the evidence that will one day close it is in the issue validation guide.
Related guides
- Writing airtight conditions — the first element
- Writing cause statements that point to the fix — the cause family the recommendation must match
- Writing impact that lands — the consequence the recommendation removes
- Finding makeovers — five findings rewritten element by element
- The 5 C’s of audit findings — the structure
- Evaluating management responses — the five tests, from the other side of the table
- Risk acceptance by management — the fourth option
- Issue validation in internal audit — the evidence standard “done” refers to
- The finding and issue log template — where the recommendation’s owner, date and measure of done are tracked
- The life of a finding — the stage at which the recommendation is offered
- Preventive, detective and corrective controls — the options the recommendation chooses among
- Control description examples — how the control a recommendation creates should be described
- Negotiating audit findings — the action plan on the table
- Writing guides and findings and reporting guides — the full collections
- Finding Severity Ratings: The Calibrated Matrix — anchors, the grid, twelve cases and the rating memo.
Leave a Reply