It would be very beneficial to have an auditing tool (similar to Microsoft's MBSA) that will identify deficiencies and potential risks on the firewall. For example, weak ciphers and protocols enabled, weak passwords used etc.
Basically, something that will provide an output similar to what Nipper provides, but focused on Sophos firewalls.