Which of the following need not be included in management’s report on internal control under section 404(a) of the sarbanes-oxley act of 2002? a. an identification of the framework used for evaluating internal control. b. management’s acknowledgment of its responsibility to establish and maintain internal control that detects all significant deficiencies. c. a statement that the company’s auditors have issued an audit report on management’s assertion. d. management’s assessment of the effectiveness of internal control.