In an ideal world, management would adopt the internal audit’s recommendations and take timely action. In reality, a recommendation only creates value when it is put into practice, and good ideas sometimes fail to land. The gap between intention and implementation is where many audit engagements stall.
From risk appetite to resourcing constraints, there are legitimate reasons why carefully thought-out recommendations are not always well received. Understanding these dynamics helps auditors tailor advice that is practical, prioritized, and more likely to stick.
Risk Appetite Mismatch
Auditors may see a risk as significant; management, driven by growth, may accept it within their risk appetite. Both perspectives can be rational. The job is to make the trade-off explicit so leaders can decide with eyes open.
Clarity on risk thresholds and performance ambition reduces friction. Framing options (accept, mitigate, transfer) with quantified impact makes acceptance a conscious choice rather than silent drift.
The “One-Man-Band” Constraint
Recommending segregation of duties in a team of one is textbook, but not feasible. You cannot separate duties that do not exist.
When structure is the constraint, design compensating controls: management review, automated logs, or periodic independent checks. Fit-for-context beats ideal-but-impossible.
Administrative Bureaucracy
Controls that add extra approval layers can unintentionally slow decisions. When cycle time is critical, added friction can erode value.
Streamline by moving from serial approvals to risk-based thresholds, pre-approved limits, or automated workflows. The control objective remains intact without throttling pace.
“It’s Not Significant”
Materiality is contextual. What the audit perceives as material may be minor in the business model, timing, or portfolio view.
Anchor recommendations to business outcomes; customer impact, regulatory exposure, cash, or brand. Translating risk into executive metrics increases relevance and uptake.
Cost Versus Benefit
For smaller operations, moving from spreadsheets to a full ERP can be disproportionate to the benefit. Cost, complexity, and change fatigue are real barriers.
Offer staged pathways: strengthen spreadsheet controls now; pilot modular tools; set triggers for when a system upgrade becomes value-justified. Scalability is a strategy, not a switch.
External Constraints
Sometimes the solution is outside management’s control – a secure payment solution the local bank does not offer, for example.
Document the constraint and recommend mitigations within reach: interim processes, additional monitoring, or alternative providers. Progress matters even when perfection is unavailable.
Competing Priorities
In fast-moving environments, urgent initiatives eclipse important ones. Even sound recommendations can slide down the list.
Sequence actions by risk and effort. Propose a phased plan with quick wins, time-boxed pilots, and clear owners. Momentum builds commitment.
Lack of Collaboration
When management is not involved in the audit process, recommendations arrive as a surprise, and surprises create resistance.
Co-create during fieldwork: align on problems, test options, and agree on success criteria. Shared ownership in design leads to shared ownership in delivery.
Turning Resistance into Uptake
Recommendations gain traction when they meet the business where it is: aligned to risk appetite, sized to constraints, and tied to outcomes leadership cares about. By diagnosing the reasons behind resistance and adapting the path forward, internal audit moves from being merely correct to being genuinely effective.