Which of the following is NOT a Sarbanes$-$Oxley $($SOX$)$ Act requirement?

An external audit evaluates management's assessment of the effectiveness of the system of internal control.

An internal audit report that confirms that management did not review financial statements before they were published.

An internal control report included in the annual financial statements.

An external audit that includes a disclosure of internal control deficiencies.