An auditor is understanding the internal control of a client that uses a service organization for payroll processing. The auditor obtains a SOC 1 Type 2 report. Which of the following is the auditor PRIMARILY looking for in this report to support a lower assessment of control risk?

The service auditor's opinion on the fairness of the presentation of the service organization's system description.

The service auditor's opinion on the operating effectiveness of controls and the results of tests of controls.

A list of user control considerations (UCCs) that the client must implement.

Confirmation that the service organization has a disaster recovery plan.