Which of the following would be MOST important to include in an IS audit report?

Observations with inadequate evidence are typically excluded from formal findings to maintain the credibility and objectivity of the audit report.

A roadmap for addressing risk areas is typically developed by management in response to audit findings, rather than being a primary component of the audit report itself.

While an audit may suggest general control improvements, specific technology solutions are usually the responsibility of management or IT teams to implement, not the auditor to prescribe in detail.

An IS audit's primary purpose is to identify risks and evaluate controls. By reporting the level of unmitigated risk along with its business impact, the audit report provides management with clear, actionable information about the most significant exposures, enabling informed decision-making regarding remediation priorities.