ssae 16 / isae 3402 report on controls placed in operation and tests