An IS auditor is evaluating a bank's reliance on a cloud-based payroll processing provider. Management states that the provider is 'trustworthy' but has never independently verified the provider's control environment. Which of the following would provide the auditor with the MOST reliable assurance over the effectiveness of the provider's internal controls?