; and (ii) shall make public whether or not the privacy audit found the controller compliant. (B) Audit requirements Each such audit shall— (i) set forth the privacy, security, and data use controls that the controller has implemented and maintained during the reporting period; (ii) describe whether such controls are appropriate to the size and complexity of the controller, the nature and scope of the activities of the controller, and the nature of the sensitive personal information or behavioral data collected by the controller; (iii) certify whether the privacy and security controls operate with sufficient effectiveness to provide reasonable assurance to protect the privacy and security of sensitive personal information or behavioral data, including with respect to data shared with third parties, and that the controls have so operated throughout the reporting period; (iv) be prepared and completed within 60 days after the end of the reporting period to which the audit applies