tl;dr - audit reports are better tools than security questionnaires for identifying external cybersecurity risk, but leave much to be desired. Don't rely solely on them.