Hi.
My belief is that for ANYWHAT good TECHNICAL audit you will need access to Google Analytics and GWT. Because it's TECHNICAL. And these tools will tell you everything about penalizations etc.
Yes, you can use MOZ, but if you don't have access to historical rankings data - there is no much use to determine anything about penalizations.
The rest is covered by other comments - ahrefs/majestic/OSE for backlink profile, MOZ Rank Tracker for current rankings, webpagetest and PageSpeed for loading times.
And the most important - your own head. Just look at the website. If that website has been penalized - there is huge reason for that and you'd be able to see it just by looking at the website architecture, content etc.
