FYI - Service Organizations—User Auditors

(1) A service auditor’s Type 1 report addresses design effectiveness, that is, controls placed in operation at the service organization. (2) A service auditor’s Type 2 report addresses the operating effectiveness of internal controls at the service organization, which requires the service auditor to perform appropriate tests of controls.