An auditor is performing a review of Management's Discussion and Analysis (MD&A) for a nonissuer. Which of the following statements is TRUE regarding this engagement?

The engagement must be performed under the SSAE (Attestation Standards).

The auditor must provide an opinion on the MD&A.

The engagement is performed under SSARS.

The auditor can perform this service even if they have not audited the related financial statements.