The Controller shall review and monitor audit report findings to determine that both state and local entities have taken appropriate corrective action, or shall make recommendations to state departments for corrective action, including recovery and referral for legal action, as appropriate.