SAMPLE AUDITOR'S REPORT — For A Fictitious PrivaTrust Client

To: The Management of Lakeshore Medical Center

We have audited Lakeshore Medical Center's disclosure of its privacy and information protection practices on its web site and the effectiveness of its controls over these practices (at http://LakeshoreMedical.com/) during the period of April 1, 1999 through June 30, 1999. These privacy and information protection disclosures and controls are the responsibility of Lakeshore Medical Center's management. Our responsibility is to express an opinion on the conformity of those disclosures and controls with the privacy and information protection criteria from the CICA/AICPA WebTrust criteria based on our audit.

We conducted our audit in accordance with standards for assurance engagements established by the Canadian Institute of Chartered Accountants. Those standards require that we plan and perform our audit to obtain reasonable assurance as a basis for our opinion. Our audit included (1) obtaining an understanding of LakeShore Medical Centre's privacy and information protection practices and its controls over the information collected, (2) testing and evaluating the operating effectiveness of the controls, and (3) performing such other procedures as we considered necessary in the circumstances.

In our opinion, during the period of April 1, 1999 through June 30, 1999, Lakeshore Medical Center in all material respects disclosed its privacy and information protection practices on its web site, and maintained effective controls to provide reasonable assurance that private patient information obtained was protected from uses not related to Lakeshore Medical Center's business and was not used for purposes not disclosed on the web site, in accordance with the privacy and information protection criteria from the CICA/AICPA WebTrust criteria.

Because of inherent limitations in controls, errors or fraud may occur and not be detected. Furthermore, the projection of any conclusions, based on our findings, to future periods is subject to the risk that (1) changes made to the system or controls, (2) changes in processing requirements, or (3) changes required because of the passage of time, such as to accommodate dates in the year 2000, may alter the validity of such conclusions.

The PrivaTrust plate of assurance on Lakeshore Medical Center's web site for privacy and information protection constitutes a symbolic representation of the contents of this report and it is not intended, nor should it be construed, to update this report or provide any additional assurance.

This report does not include any representation as to the quality of Lakeshore Medical Center's goods or services nor their suitability for any customer's intended purpose.

Toronto, Ontario Canada
July 5, 1999

Bennett Gold, Chartered Accountants

www.BennettGold.ca