Why should internal audit reports favor an emphasis on management's corrective action responses, rather than IA's recommendations? The possibility of sampling risk puts the auditor's conclusions in some doubt. Internal auditors are only expected to point problems out, not help solve them. It reflects management's responsibility for designing and implementing effective controls. If a crisis occurs, internal auditors won't lose their jobs