Which of the following statements about internal control is incorrect, based on the COSO framework?
a. Internal controls starts with a strong set of policies and procedures.
b. Risk assessment and control activities are two of the compoments of the COSO model. .
c. Internal control can be expected to provide only reasonable assurance that business objectives will be achieved.
d. Monitoring of a company's internal controls are acoomplished with ongoing supervision and independent reviews.