The Sarbanes-Oxley Act of 2002 requires management to include a report on the effectiveness of ICFR in the entity's annual report. It also requires auditors to report on the effectiveness of ICFR. Which of the following statements concerning these requirements is false?

a. The auditor should evaluate whether internal controls are effective in accurately and fairly reflecting the firm's transactions.

b. Management's report should state its responsibility for establishing and maintaining an adequate internal control system.

c. Management should identify material weaknesses in its report.

d. The auditor should provide recommendations for improving internal control in the audit report.