Is it normal to share the final pentest report with internal audit?

Internal audit Director is requesting the final report of the pen test, not just evidence that it was done.

There was no specific reason provided beyond just for "their information". Is it customary to share it with them? I'm under the impression that it is only shared on need to know basis.

audit beyond cybersecurity director information internal internal audit pen pen test pentest pentest report report share test under