A report without dates is a document nobody acts on. Each finding needs an owner, a severity and a date, and the follow-up is where a consultancy either becomes a supplier or becomes a memory.
Evidence is the deliverable for certification work. Screenshots, policies and configuration extracts collected as they are produced is a fraction of the work it becomes when assembled a fortnight before an assessment.
Every certification expires. The renewal date is next year's engagement already scheduled, and a consultancy that contacts a client three months beforehand rarely loses one.
The consultancy has to meet the standard it sells. Client findings are extremely sensitive documents, and how they are stored, shared and eventually deleted is a question a serious client will ask.