Which of the following is correct concerning system and organization controls $($SOC$)$ reports?

Multiple Choice

They all result in restricted$-$use reports.

A prerequisite before issuing such a report is having performed the audit of the

service organization's financial statements.

Some of these reports do not address operating effectiveness.

They all relate to controls at service organizations.