Internal audit provides a monitoring rule to support the board in discharging its responsibilities for internal control and risk management. Internal audit would be expected to draw management’s attention to deficiencies in control in any area – sales/purchases/payroll etc – with recommendations for improvements. However, that is not the same as advising “you should use this [specified] software package” (for example). If internal audit were to make decision’s on behalf of management it could not then discharge its monitoring role in an objective/unbiased manner.