A service organization may be required under the terms of the contract with user entities to disclose to affected user entities non-compliance with laws and regulations, including illegal acts, or fraud or uncorrected misstatements attributable to the service organization’s management or employees. We make inquiries of the user entity management regarding whether the service organization has reported any such matters