; (ii) describe whether such controls are appropriate to the size and complexity of the operator, the nature and scope of the activities of the operator, and the nature of the sensitive personal information or behavioral data collected by the operator; (iii) certify whether the privacy and security controls operate with sufficient effectiveness to provide reasonable assurance to protect the privacy and security of sensitive personal information or behavioral data and that the controls have so operated throughout the reporting period; (iv) be prepared and completed within 60 days after the end of the reporting period to which the audit applies