So you do not make any recommendations. You draw conclusions as to whether there was misconduct, and management then makes a decision.
At the same time, when members of management themselves are involved, management still decides on any action to be taken. In that case, is there not a risk that management would simply give those at fault a slap on the wrist, telling them not to do it again in order to protect the agency's reputation?