Currently, outside auditor reports are not required to provide any level of assurance with regard to key internal controls.
Outside auditor reports don't have to have any level of assurance, though they do follow guidelines.