1. Section 404 of SOX requires a public company's annual report to include an internal control report. What are the two required components of management's report on internal control? 2. What obligation does a public company's independent auditor have relating to internal control over financial reporting under Section 404?