This is a sample-brief discussion, not an active purchasing request.
For a hypothetical audit request, define the site size, available access and required deliverables. What would distinguish a prioritized fix plan from a long export of warnings?
A concrete example of how you would make the decision would be more useful than a general rule. What would change your answer?