Service organizations provide a number of other IT serviced for entities that may not relate to internal controls over financial reporting. For example, a university that outsources the processing of student applications for admission will likely be subject to laws requiring the university to maintain the privacy of the information included in the application. The university is concerned about the accuracy of that information and is responsible for maintaining the privacy of the information including that residing at the service organization. Management of the university is also concerned about complying with laws or regulations related to processing integrity and privacy and may desire assurance about the service organization’s controls relevant to processing integrity and privacy that affect the users’ information. The service auditor uses the criteria in Trust Services Principles for evaluating and reporting on controls related to security, availability, processing integrity, confidentiality, or privacy. The controls that the CPA reports on in these engagements are intended to prevent, or detect and correct, errors or other negative events that affect the service or information provided to user entities, as they relate to the principle being reported on.