Regarding the assessment of service organisation’s control, what is the purpose of obtaining Type 1 report where we can obtain a Type 2 report that provides a description of the efficiency of internal control rather than just describing the internal control implemented (type 1 report)?