In the United States which Internal Control Framework is recognized and should be used when conducting a SOX $404$ Audit?

Question $3$ options:

Guidance on control $($Coco$).$

COBIT $5.$

COSO's $2013$ Internal Control $-$ Integrated Framework

ISO $31000.$