The Sarbanes-Oxley Act of 2002 requires management to include a report on internal control in the entity's annual report. It also requires auditors to attest to management's internal control assertion. Which of the following statements concerning these requirements is false?

a. The auditor should evaluate whether internal controls are effective in accurately and fairly reflecting the firm's transactions.

b. Management's report should state its responsibility for establishing and maintaining an adequate internal control system.

c. Management should identify material weaknesses in its report.

d. The auditor should provide recommendations for improving internal control in the attestation report. p-986