It is common to hold an assumption that the business is "probably fine" on IT until an incident proves otherwise. An independent audit is how an organization replaces that assumption with evidence.
The value is not the report itself — it is the prioritized view of where a disruption could occur, and the discipline of turning that into an ordered improvement plan.
Because the audit is independent and does not require an MSP contract, it can also be a credible first engagement when a business is evaluating whether to build a managed operating model at all.