Most recommendations in audit reports are never acted upon. Everyone knows this, yet auditors keep writing them. The question is not whether you give advice, but when it is worth doing so.
Should you include recommendations in an audit report? The answer is less obvious than it seems. Some auditors are fiercely against it, others consider it the core of their work. Both camps are right.
With the introduction of the Global Internal Audit Standards (GIAS), the distinction between assurance and advisory has become more explicit: internal audit fundamentally delivers independent assurance and may additionally provide advisory services, provided this is done transparently, fits within the mandate and does not impair independence12. This makes the question "should I actually be giving advice in my audit report?" all the more pointed.
What do the GIAS say about advisory?
The new GIAS call for a clear mandate for internal audit (charter), an independent position and explicit expectations regarding types of engagements: assurance, advisory or a combination123. In practice, this means: agree upfront with the board and audit committee whether and how you advise, and then do so consistently.
Within the GIAS, giving advice belongs primarily to "consulting services" or "advisory services": engagements where management explicitly asks for your help, you make clear that you are not providing formal assurance, and you safeguard your future independence124. Routinely appending recommendations to every finding fits poorly with this, unless your charter and stakeholders have deliberately set it up that way1.
Standard 14.4: the standard everyone reaches for
Say in a room full of auditors that you no longer write recommendations and Standard 14.4 is on the table within a minute. "Recommendations and Action Plans" it is called, which sounds like an obligation to advise. It is not. The standard opens with a choice: do you develop recommendations, request an action plan from management, or collaborate with management to agree on actions12? Three routes, of equal standing. In two of them the solution sits with the risk owner, not with you.
Those actions do have to lead somewhere. The standard names four aims: closing the gap between the established criteria and the existing condition, mitigating the risk to an acceptable level, addressing the root cause, and improving the activity under review. About the form, 14.4 says nothing. The two hard requirements it does impose only apply once you write recommendations yourself: you discuss them with the management of the activity under review, and where you disagree you follow an established methodology that lets both parties state their position. Write no recommendations and neither requirement comes into play. Reading 14.4 as a duty to advise means reading something into it that is not there.
To advise or not? At a glance
Yes: when advisory is explicitly agreed in the charter or engagement, when management asks for it, when it supports their own decision-making, and as long as your independence for future audits remains safeguarded.
No: unsolicited with every finding, without investigating the root cause, because 'it is expected', or when it takes time away from assurance.
Why advice often fails: insights from communication science
Many internal auditors include recommendations in their reports because they think they 'have to'. It has always been done that way. Or they assume it is expected, without ever testing that assumption with the colleagues who receive the report and actually have to act on it. My tip: think carefully about whether you should or even want to give advice. In many cases, it is better not to. There are solid reasons from communication science and psychology for this.
Communication science uses the concept of psychological reactance: as soon as people feel their freedom or autonomy is being restricted ("you must do this now"), an automatic counter-reaction occurs56. The more competent and autonomous someone considers themselves, the more quickly well-intentioned advice comes across as patronising or condescending. It is rejected, even when the content is correct7. Professionals and board members have a strong autonomous professional identity. Unsolicited advice in an audit report almost automatically translates into resistance rather than action.
Self-Determination Theory shows that lasting motivation arises when three basic psychological needs are met: autonomy (making your own choices), competence (feeling capable) and relatedness (feeling taken seriously in the relationship)8910. Advice that comes across as "the auditor's prescription" undermines precisely autonomy and competence. A robust assessment framework, strong findings and room to choose their own solutions actually reinforce those needs811.
Research on the intention-action gap confirms what experienced auditors have long known: between knowing and doing lies a chasm. Professionals have excellent intentions but fail to act121314. The problem is rarely unfamiliarity with the advice. The environment, priorities or routines block execution1314. As an internal auditor, you add more value by making clear where the friction is and helping management create conditions in which their own good intentions become actionable, than by adding yet another list of measures to the report13.
From practice: reasons not to give advice
1. Who do you think you are? Or: it comes across as patronising...
If I as an auditor start advising a well-paid director who is responsible for managing his risks, that director might as well go home so I can take over his job. Because that is exactly what a director is supposed to do, is it not? Managing risks by implementing controls? He does not have much more responsibility than that.
Psychologically, recommendations touch on the autonomy of professionals: as soon as someone experiences their freedom of action being restricted, psychological reactance arises, the tendency to resist advice that is perfectly sensible in itself56. Highly educated professionals and board members have a strong self-image as competent decision-makers. Well-intentioned advice is therefore quickly perceived as patronising7.
2. (Again) who do you think you are? Or (again): it comes across as patronising...
Yes, this is the second time, but for a different reason: recommendations cause hassle, friction and endless discussion. They cause delays, because an enormous number of hours go into negotiating them.
Figure 1: Comparison of hours distribution: ideal audit (green) versus audits with budget overruns (red)
With clients that have structural budget overruns on internal audits, I regularly draw this picture. The green line shows the ideal hours distribution: most of the work is in preparation and execution, and the wrap-up is done within a day. The red line shows what happens with audits that go over budget. The culprit? Endless meetings and negotiation over the recommendations.
Most of my clients have directors who decidedly do not appreciate it when it suddenly turns out they do not have their house in order. And even less so when a self-righteous auditor rubs salt in the wound by telling them what to do. They know that perfectly well themselves. With those clients, we immediately stopped giving advice. The result: hours stayed within budget and satisfaction ratings from directors and managers shot up.
3. It is not the done thing (and certainly not according to the purists)
Internal auditors examine the quality of internal control in an organisation. It is problem-focused investigation: does the control environment meet requirements, yes or no. If not, you state that. Let the organisation fix it themselves. The auditor can perfectly well establish whether that has actually happened some time later.
The GIAS is clear on this: internal audit is about assurance. The purpose is to give stakeholders greater confidence in governance, risk management and internal control12. Advisory does not fall under that, unless it has been explicitly positioned as a separate advisory service14.
4. You do not actually know the root cause
Any recommendation for which you have not investigated the root cause is doomed to fail. And that is something fundamentally different from an investigation asking "is there a problem?". Without that underpinning, there is a good chance your advice is irrelevant or, worse, that the organisation uses you to pursue a direction that suits them but does not address the root cause.
Suppose you find that segregation of duties is lacking or that the design of an IT system is flawed. What is the cause? No budget? Incompetence? High workload? My advice (oops, what am I saying?): stay as far away as possible from root cause analyses without the research to back them up.
Communication science and behavioural psychology leave no room for doubt here: people ignore advice that does not match their own definition of the problem1516. If you present the "solution" without the other party recognising themselves in your analysis of the cause, it will be politely heard and subsequently ignored.
5. The best advice is a solid assessment framework
If you carry out a good audit, you have performed a thorough risk analysis and it is clear what the key controls are for each risk. The appendix of your report hopefully also contains the assessment framework with a score or indication per control showing whether it is adequate or not (or somewhere in between). Then the only meaningful advice you can still give is: "resolve the findings, see appendix".
6. If they need advice, they will ask for it
Be constructive and willing to help. They will ask you soon enough when they cannot work it out themselves. State in your report that you are willing to assist, if you are comfortable doing so.
Research on advice-giving behaviour shows that people experience a clear difference between unsolicited and solicited advice: solicited advice is more readily perceived as supportive and competence-enhancing, whereas unsolicited advice triggers defensiveness and distance17. By explicitly stating your willingness to think along in your report, while leaving the choice to the other party, you reinforce their sense of control. And with it, the likelihood that they will actually invite you later.
7. It costs time and money
That costs time and money you could also spend on assurance or other investigation. Most recommendations are stating the obvious; in the worst case, nothing is done with them at all. Even worse is when an externally hired auditor insists on giving recommendations. Instead, simply ask them to come by for an hour to discuss what needs to happen. That works better than spending considerable time on an advisory paragraph with all the debate that surrounds it.
The intention-action gap shows that the problem is rarely knowledge. Professionals generally know what needs to be done but fail to get it done1213. A list of recommendations changes nothing about that. A good conversation might.
When does advisory fit within the GIAS?
From a GIAS perspective, advisory fits well when:
- it has been explicitly agreed as an advisory engagement (in the charter or per engagement),
- the purpose is to help management better substantiate their own decisions,
- and your independence in future audits is not undermined124.
In that context, a brief, sharp recommendation in or alongside the report can add value. Think of complex change programmes or persistent culture and behavioural issues where the question is not "is there a problem?" but "what are scenarios for dealing with this?"2.
What 14.4 asks of you when you give no advice
No recommendation paragraph is not the same as stating the facts and then falling silent. If you leave the solution with the owner, you are taking route two or three from 14.4: you request the action plan and record it. That is not a formality. Without an action plan there is nothing to follow up on later, and your finding stays an opinion in a drawer.
Something does go with that. Your finding has to say enough about the cause for the action plan to work with it, because 14.4 calls for actions that address the root cause (see reason 4). And the choice not to write recommendations belongs in your methodology, not in your habits. For handling disagreement, 14.4 refers explicitly to Standard 9.3 on methodologies1. "We do not write recommendations as a matter of principle" is perfectly defensible, as long as it is documented and agreed with the board and audit committee. As an unwritten habit it is just as unconsidered as the recommendation paragraph you were trying to avoid.
From practice: reasons to give advice in a report
There are plenty of reasons to include advice in a report. A few:
8. They are asking for it!
Few things are as satisfying as genuinely helping people move forward, especially when they appreciate that help. So when you get the chance: take it. I too regularly receive requests for advice. Sometimes about a persistent problem, often culture- or behaviour-related. Sometimes about a complex challenge where everyone has got lost in the details and no one has the bigger picture any more. Or simply because, as an internal auditor, you are one of the few who look right across the entire organisation. All excellent reasons to give advice.
In GIAS terms, you then temporarily shift towards an advisory role, on the condition that this has been agreed upfront and is transparent to the board and audit committee12. Self-Determination Theory confirms that solicited advice reinforces the autonomy and competence of the recipient rather than undermining them89.
9. It is expected of you
Be alert here. 'It is expected' often means 'the organisation expects it', and chances are it is an ingrained expectation that arose somewhere in the past and has never been reconsidered. Have the conversation with the board and audit committee: do they really want to spend those expensive audit hours on this? Giving advice means less time for assurance and investigation. That need not be a problem, but then arrange it properly. Document it in the Charter and then formulate recommendations that genuinely add value for the organisation.
This directly aligns with the GIAS requirement to have a clear charter stating what the internal audit function does and does not do12. Transparency prevents confusion and protects your independence.
10. Giving advice is the most enjoyable part of an internal auditor's work
I do not find that a strong argument. The enjoyment lies in the auditing itself, the added value in providing assurance. So I can do without it, that should be clear by now. But no one is the same. If it makes you happy: go ahead. Just pay close attention to reasons 1 through 7.
Final word
There are certainly more arguments for and against giving advice, apart from the question of what a recommendation actually constitutes. Virtually everything about this topic is dependent on the individual and the organisation.
With the GIAS in hand, it comes down to this for me: be radically clear about your role. If you provide assurance, stick to a robust assessment framework, sharp findings and clear conclusions12. If you want to (or must) also advise, ensure this is explicitly agreed, that your independence remains safeguarded and that your advice reinforces the autonomy and professionalism of your counterpart rather than undermining them158.
Professionals generally know perfectly well what needs to happen. What they need is a sharp picture of the risks, room to choose for themselves and, when they ask for it, a sparring partner who thinks along without taking over5817.
Do what works for you and your organisation, but make it a conscious choice. I hope this article prompts reflection. I am curious to see what your next audit report looks like. Comments are welcome.
References
[1] The IIA. (2024). Global Internal Audit Standards. https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
[2] The IIA Nederland. (2024). Global Internal Audit Standards, Dutch version. https://www.theiia.org/globalassets/site/standards/editable-versions/global-internal-audit-standards-dutch.pdf
[3] IIA Nederland. (2025). Effectuation of the GIAS. https://www.iia.nl/nieuws/effectuering-gias
[4] Wolters Kluwer. (2024). Overview of the new Global Internal Audit Standards 2024. https://www.wolterskluwer.com/en/expert-insights/new-global-internal-audit-standards-overview
[5] Psychology Fanatic. (2025). Reactance Theory Explained: A Psychological Perspective. https://psychologyfanatic.com/reactance-theory/
[6] PsychoTricks. (2025). Psychological Reactance. https://psychotricks.com/reactance/
[7] CiteSeerX. Reactance, autonomy and paths to persuasion. https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&doi=0e8c3f1d3daefe96ecb2a7c9a3fb8f856f81584e
[8] Verywell Mind. (2013). How Self-Determination Theory Explains Motivation. https://www.verywellmind.com/what-is-self-determination-theory-2795387
[9] ScienceDirect. (2017). Self-Determination Theory. https://www.sciencedirect.com/topics/social-sciences/self-determination-theory
[10] RCCS. (2026). Autonomy, Competence, and Relatedness: Understanding the Three Universal Needs of Self-Determination. https://www.rccs.org.uk/post/autonomy-competence-and-relatedness-understanding-the-three-universal-needs-of-self-determination
[11] Ryan, R. M., & Deci, E. L. (2000). Self-Determination Theory and the Facilitation of Intrinsic Motivation. https://selfdeterminationtheory.org/SDT/documents/2000_RyanDeci_SDT.pdf
[12] Concepts. (2025). Intention-Action Gap. https://concepts.dsebastien.net/concept/intention-action-gap/
[13] Think Insights. (2022). Intention-Action Gap. https://thinkinsights.net/consulting/intention-action-gap/
[14] The Decision Lab. (2021). Intention-Action Gap. https://thedecisionlab.com/reference-guide/psychology/intention-action-gap
[15] Sue Behavioural Design. (2026). Why informing does not work (and what does). https://www.suebehaviouraldesign.com/nl/blog/waarom-informeren-niet-werkt/
[16] John Vrakking. (2023). Why your communication may not be working. https://johnvrakking.nl/kennis/de-belangrijkste-reden-dat-jouw-communicatie-niet-werkt
[17] OR-ondersteuning. May I not give you advice? https://or-ondersteuning.nl/boek-recensies/mag-ik-je-geen-advies-geven/