A supplier's assurance report excludes the service used by the organization. How should the auditor treat it?

1. Conclude that every supplier service necessarily has identical controls
2. Seek assurance relevant to the actual service and required controls
3. Accept it because the supplier's legal name is identical
4. Treat the report as a replacement for all contract requirements