The resulting business impact, of the penetration test or ethical hacking engagement is explained in what section of the final report?

The Problems section enumerates specific technical issues discovered during testing and does not translate those issues into business-level consequences.

The Findings section provides detailed technical descriptions of vulnerabilities, proof-of-concept steps, and affected systems - not a business impact analysis.

Impact Assessment is not a standard standalone section in widely accepted penetration testing report frameworks; business impact is formally addressed in the Executive Summary.

The Executive Summary is written specifically for senior management and non-technical stakeholders who need to understand the business consequences of the engagement without reading technical details. It describes the overall risk posture, potential financial and operational impact, and high-level recommendations - making it the appropriate section for business impact communication.