3. Which of the following statements is true? a. COSO's enterprise risk management framework is narrow in scope and is limited to financial controls. b. COSO's internal control integrated framework has been widely accepted as the authority on internal controls. c. The Foreign Corrupt Practices Act had no impact on internal accounting control systems. d. It is easier to add controls to an already designed system than to include them during the initial design stage