The report is written in such a way that it targets the key questions management and governance have, lists specific issues found, suggesting appropriate remediation. This is done in quite a good way so as not to overwhelm those unfamiliar with security concepts but provide enough information to understand the risks.