Independent, risk-based, and objective assurance for organizations seeking C3PAO services.