It's been two years. If this was a problematic area—and it appears that the safeguarding of government information is problematic—then she can do another audit.
I like the idea of inserting a paragraph saying that this was the situation when the audit took place, but I do not want any subjective input in this report stating what work has been done, because I have no idea and there's been no audit since. So let's stick to the facts. I am open to the paragraph you want to put in, but I'm not open to anything else.