Why Internal Auditors Should Stop Writing Recommendations

One of the most common mistakes made by internal auditors is also one of the easiest to overlook.

After completing months of planning, fieldwork, testing, interviews, and report writing, the auditor arrives at the final page of the report and writes...

"Management should..."

The report then proceeds to tell management exactly what controls to implement, what procedures to write, what approvals to require, and sometimes even what software to purchase.

Although well intentioned, this practice creates a significant governance problem.

Under the Institute of Internal Auditors (IIA) Global Internal Audit Standards, management—not internal audit—is responsible for designing, implementing, and operating internal controls. Internal audit provides independent assurance and advice, but it should not assume management's responsibilities or impair its own objectivity.

A more effective approach is for auditors to facilitate management in developing its own corrective action plans. One of the best tools for accomplishing this is Neil Rackham's SPIN Selling methodology.

It may sound unusual to combine professional auditing with a sales methodology—but SPIN is actually one of the most powerful techniques available for helping management solve problems without the auditor becoming the decision-maker.

The Independence Problem

The IIA Standards require internal auditors to remain objective and avoid assuming management responsibilities.

When auditors prescribe detailed corrective actions, they risk crossing that line.

Consider these recommendations:

"Management should purchase Vendor XYZ software."

"Management should hire two additional accountants."

"Management should require three approvals."

Who made those management decisions?

The auditor?

Now imagine returning next year to audit those same controls.

The auditor is no longer evaluating management's solution.

The auditor is evaluating their own solution.

That creates an obvious threat to objectivity.

What the IIA Standards Actually Expect

The Global Internal Audit Standards recognize internal audit as an independent assurance and advisory function.

Internal auditors should:

• Identify risks.

• Evaluate controls.

• Report deficiencies.

• Explain consequences.

• Facilitate discussions.

• Share leading practices.

• Challenge assumptions.

• Assist management in understanding alternatives.

Management should:

• Decide how to respond.

• Design controls.

• Allocate resources.

• Accept or mitigate risk.

• Implement corrective actions.

• Own the results.

Ownership matters.

People support solutions they create.

They often resist solutions imposed upon them.

Recommendations Versus Action Plans

Instead of writing recommendations, auditors should focus on clearly communicating:

• The condition.

• The criteria.

• The cause.

• The consequence.

• The risk.

Once management understands the issue, the discussion shifts naturally to:

"How do you plan to address this?"

That simple question changes everything.

The auditor becomes a facilitator instead of the architect of management's controls.

Enter SPIN Selling

Neil Rackham developed SPIN Selling after studying more than 35,000 sales calls.

His research showed that successful professionals don't convince people by telling them what to do.

Instead, they ask questions that help people recognize problems and develop their own solutions.

The SPIN model consists of four types of questions:

• Situation

• Problem

• Implication

• Need-Payoff

Although designed for sales, SPIN works remarkably well during audit closing meetings.

Applying SPIN During an Exit Conference

Suppose internal audit identifies inadequate segregation of duties in Accounts Payable.

Instead of writing:

"Management should assign invoice approval to another employee."

The auditor could facilitate the discussion.

Situation Questions

• How are invoices currently approved?

• Who has access to the payment system?

• How many employees participate in the process?

These questions ensure everyone shares the same understanding of the current state.

Problem Questions

• What challenges does the current process create?

• Where could errors occur?

• What would happen if someone intentionally bypassed approvals?

Now management begins identifying the weakness.

Implication Questions

This is where the conversation becomes powerful.

Ask questions like:

• What could happen if unauthorized payments were processed?

• How would an external auditor view this control?

• Could this increase fraud risk?

• Would this affect public confidence?

• Could this delay financial reporting?

Management begins recognizing the importance of addressing the issue.

Need-Payoff Questions

Finally ask:

• What changes would reduce this risk?

• Which solution would fit your operations?

• How could technology help?

• Which controls would be most effective?

• What resources would you need?

Notice something?

The auditor hasn't prescribed anything.

Management develops the corrective action.

Management owns the solution.

Why SPIN Produces Better Action Plans

Management understands:

• Budget limitations.

• Staffing constraints.

• Technology capabilities.

• Operational priorities.

• Organizational culture.

Auditors often do not.

By asking thoughtful questions instead of prescribing solutions, auditors allow management to develop action plans that are both practical and sustainable.

The resulting plans typically receive greater support because they were created by the people responsible for implementing them.

Internal Audit Becomes a Trusted Advisor

Many audit departments aspire to become "trusted advisors."

Trusted advisors do not dictate solutions.

They ask insightful questions.

They facilitate discussions.

They challenge assumptions.

They broaden perspectives.

Most importantly, they help management make better decisions.

That is exactly what SPIN encourages.

A Better Audit Report

Rather than ending reports with recommendations, consider ending them with Management Action Plans.

For example:

Finding

Invoice approval responsibilities are not adequately segregated.

Risk

Unauthorized or fraudulent payments may occur without timely detection.

Management Action Plan

Management will redesign the approval workflow by September 30 to ensure payment authorization is segregated from vendor maintenance. The Controller will be responsible for implementation and quarterly monitoring.

Notice the difference.

The action belongs to management—not internal audit.

The Benefits

Using SPIN during audit discussions creates several advantages:

• Stronger management ownership.

• Better corrective actions.

• Improved relationships.

• Greater auditor independence.

• Increased implementation success.

• More meaningful audit reports.

• Better compliance with the IIA Standards.

• Enhanced credibility with audit committees.

Most importantly, the organization benefits because management becomes actively engaged in solving risks instead of simply complying with audit recommendations.

Final Thoughts

Internal auditors are not hired to manage the organization.

They are hired to evaluate governance, risk management, and internal controls while preserving their independence and objectivity.

The best audit reports do not tell management what to do.

They clearly explain the risks, ask the right questions, and help management develop practical, sustainable solutions.

The next time you prepare an audit report, consider replacing the word "Recommendation" with "Management Action Plan."

Then use the SPIN approach during your exit conference to help management create that plan.

You may discover that your audit reports become more persuasive, your recommendations become more actionable, and your relationships with management become significantly stronger.

A

s Peter Drucker famously observed:

"People support what they help create."

That principle is at the heart of both effective internal auditing and effective management.