Auditors are required to use policies as the criteria. They do not write the policies. Sometimes the audit report may be used to change policies. Address the policy when necessary. The auditors might have missed an issue.
Some recommendations appear overly simplistic.
For example, a report might say that management should perform monthly reconciliation's of revenue and cash. What the report might not have mentioned is that the computer support does not provide the necessary information to perform the reconciliation. A system enhancement is necessary. Management Comment - We agree. To implement the recommendation it will be necessary to enhance the current accounting systems.