Which of the following statements about audit trails is true?

a. Unlike most internal controls, the audit trail can be established and implemented by management

b. An audit trail is a control that needs a description of only the source documents that are currently being used to record transactions

c. SOX 404 requires the disclosure of audit trail procedures in the internal control report

d. Audit trails are useful as detective controls because they help the user(s) uncover whether financial data and information are inaccurate, incomplete, and/or invalid