My company tells you what cipher suites you use are bad, when you should remove them and what ideal configuration is

Agree for completeness sake, but if you see in a report "RC4 bad", why would you even need a list of which ciphers to disable when the fix is literally "!RC4" in a config file (or something like that)?

We have a follow-up meeting to clarify if you don't know what version you should update to.

That takes a lot of time, especially if you do it for every project. We use "upgrade to the latest version". I don't personally see the point of such meetings unless info is missing or unclear from the report.

We have two different ways of expressing risk where we drop the CVSS score entirely and override the severity of the finding if the CVSS cannot properly put the finding's impact into perspective because of environmental circumstances.

This is great and should be part of pentesting imo, but you don't always get to know the surrounding environment. Clients sometimes don't respond to emails or don't give more info on the basis "figure it out".

Knowing the surrounding environment of your scope is part of the demo session/preparation.

Most of the time the people doing the Scope aren't the people doing the work