A cloud provider supplies an independent control report. Which review is essential before relying on it for assurance?

1. Accept it solely because the cover includes a recognized audit logo
2. Check the covered service, period, exceptions, and required customer controls
3. Assume it transfers the customer's regulatory accountability to the auditor
4. Ignore report exceptions when the contract is discounted