auditor recommendations