Encrypt the report with the auditor’s public key and sign it with the auditor’s public key as well, since the exchange is governed by the recipient’s key pair and using a single key for both steps avoids any confusion over which key applies

Encrypt the report with the auditor’s public key, so that only the auditor’s matching private key can open it, and sign it with her own private key, so that the auditor can verify the signature using her public key

Generate one symmetric key, encrypt the report with it and send the key to the auditor in a separate e-mail; symmetric encryption is considerably faster than asymmetric encryption for a large file and avoids the overhead of managing certificates

Encrypt the report with her own private key so that the auditor can open it with her widely available public key; because only she holds the private key, this simultaneously proves that the report came from her and keeps its contents secret from everyone else