The internal auditing department recently completed two audits, and the director of internal auditing is puzzled about what to recommend to management in the audit reports. The first audit was of a construction project in the downtown area of a large city. A significant part of the audit was aimed at evaluating the control procedures designed to protect pedestrian and automobile traffic near the construction site from accidental injury or damage. The auditors determined that the project managers had taken all reasonable precautions, but that significant risks still existed, that someone could get hurt, and that the company might suffer significant costs in damages.

In the second audit, the auditors found that control procedures were operating adequately in the management of the company's investments portfolio, but that the portfolio still was operating at a very low profit level.

Required:

Since the auditors had found that the internal control procedures were satisfactory, what might the director of internal auditing recommend to management that might help them better manage the risks in each of the two operations?