Which of the following is not true regarding the requirements for reporting on internal controls under Section 404 of the Sarbanes–Oxley Act of 2002?
- Management must accept responsibility for the establishment and maintenance of internal controls and provide its assessment of their effectiveness.
- The independent auditor must issue a report on the effectiveness of internal controls.
- Management must identify the framework used for evaluating its internal controls.
- Management must achieve a control environment that has no significant deficiencies.