IT Audit uncovers risk threats associated with vulnerabilities.  Without knowing the risks and comparing those risks to configured environments through testing, no audit measurement can be made and no accepable level of security can be achieved.