The effectiveness of an audit is measured by?

The number of security controls the company has in use

How it exposes the risk tolerance of the company

The number of actionable items in the recommendations

How the recommendations directly support the goals of the company