Which of the following statements about internal control is incorrect, based on the COSO framework? a. Internal controls starts with a strong set of policies and procedures. b. Risk assessment and control activities are two of the compoments of the COSO model. . c. Internal control can be expected to provide only reasonable assurance that business objectives will be achieved. d. Monitoring of a company's internal controls are acoomplished with ongoing supervision and independent reviews