Not every company has a group that reports directly to the top management and has access to all the employees/information in the company. Therefore the same people who do required audits are sometimes engaged by the management to prepare similar reports as consultants. I've read a few audit reports and they did sound like a set of recommendations to the management.