Which activity is an auditor least likely to conduct during the information$-$gathering phase of an audit?

$1.$

Vulnerability testing

$2.$

Report writing

$3.$

Penetration testing

$4.$

Configuration review