The deliverable is a document
Current state as we found it, a findings register ranked by risk and by cost of inaction, a target architecture with the trade-offs written down rather than implied, and a sequenced roadmap in stages that each leave the system working. Where a finding is disputed by your team, the disagreement is recorded beside it instead of being smoothed away.
An audit can be commissioned on its own. There is no obligation to have the recommendations implemented by us, and the document is written so that another supplier could act on it.