The auditor should conclude the review by identifying outstanding areas of risk and the agency's actions to address those risks.
Concluding this way will give agencies more opportunity to think of ways to mitigate the risks.