What audit report publication achieves
Launch library · evergreen read

Publishing audit reports, rather than treating them as internal documents shared only with senior management, lets the public, journalists and researchers see for themselves exactly what an independent auditor actually found, rather than relying entirely on an agency's own summary of results that were, after all, about its own performance.
Publication also creates a form of pressure that internal reporting alone rarely achieves, since an agency facing a critical finding it knows will become public tends to respond more seriously than one that expects the finding to remain quietly confined within internal channels indefinitely, safely out of public view.
Some sensitive details are still occasionally withheld from a published version, such as information that could compromise an active investigation or genuinely threaten security, but these exceptions are meant to be narrow rather than a convenient reason to withhold an otherwise embarrassing finding from proper public view, far more than any single written rule ever could on its own.