The auditor should conclude the review by identifying outstanding areas of risk and the agency's actions to address those risks.
Auditors shouldn't bother summarizing potential problem areas at any point of the report.