premise: The auditor should conclude the review by identifying outstanding areas of risk and the agency's actions to address those risks.
hypothesis: Auditors shouldn't bother summarizing potential problem areas at any point of the report.