CompTIA Security+ (SY0-701) SY0-701 — Question 387

An organization is required to provide assurance that its controls are properly designed and operating effectively. Which of the following reports will best achieve the objective?