A financial services company is onboarding a SaaS payroll provider and needs assurance that the provider's controls over data confidentiality and processing integrity are not only suitably designed but have also operated effectively over the past year. The vendor offers to share several attestation reports. The company will use the report internally to satisfy its own auditors and risk committee, and does not intend to distribute it publicly. Which report best meets these requirements?