An auditor's client uses a $3$rd party to process payroll. If the auditor is relying on the internal controls of the $3$rd party, which of the following procedures would be the least appropriate?

Multiple Choice

Obtain a system and organization control report $($type $1)$ on the $3$rd party to obtain evidence that the $3$rd party's controls had been implemented.

Perform tests of control of the $3$rd party's internal controls.

Obtain a system and organization control report $($type $2)$ on the $3$rd party to obtain evidence that the $3$rd party's controls had been operating effectively.