When a user auditor plans to use a SOC 1 Type 2 report as audit evidence to reduce the assessed level of control risk for areas of the user entity's accounting affected by the service organization, the user auditor should be satisfied regarding all of the following except