Most breaches at businesses this size are not sophisticated. They are an unpatched service, a reused password, or a permission nobody removed when someone left.
An audit reviews how things are configured and governed. A penetration test attacks the system to find what actually gets through. Most businesses need the audit first. A pen test on unreviewed infrastructure just produces a long, expensive list.
Scope and timing are agreed in writing beforehand, including what is explicitly off-limits. Anything with a real risk of disruption runs against staging or out of hours.
Both. A report with no remediation is a list of problems you now provably knew about, which is worse than not having looked.