I work as an IT auditor in a lead / mentor role for members on my team. We communicate frequently with management about recommendations to remedy security weaknesses discovered in reviews or audits.
As the end goal is for management to take action to mitigate risks exposed, the recommendations should be practical and actually achievable by the company. I have discovered that team members are recommending actions after the audit has completed in the audit report that are not feasible for management to implement, taking into account business needs. Examples of constraints are technological inadequacy, and resource shortages in terms of number of available employees and time.
I would love to see some of the recommendations given by my team members to be implemented in the future but right now is not feasible. I fully agree these are best practices but recommendations should be realistic, cost effective and be a value added function.
I am not sure how to discuss this problem with the team. On one hand, I don't want to dampen their enthusiasm in recommending solutions, but on the other hand, it is important to understand the business environment when recommendation remediation steps.
How can I help team members become more aware of business needs when making recommendations to management?