What a Real Systems Audit Should Deliver (and What It Shouldn't)

A single, clearly identified constraint — not a ranked list of ten issues with no way to tell which one actually matters. A specification detailed enough that someone other than the auditor could act on it. An honest answer about whether software is even the right fix, including the answer "no."

A generic best-practices checklist that would apply to almost any business, since that's a sign the audit wasn't actually built from observing this specific operation. A proposal that happens to require exactly the audit provider's own product. A list so long nothing on it is prioritized, which usually means nothing on it was actually confirmed as the real constraint.