According to the US Sarbanes-Oxley Act, auditors should audit the internal controls of financial reporting (SOX 404). However, from prior research it can be concluded that users of the auditor's opinion on financial statements assume an unqualified opinion implicates internal controls being adequately designed and operating. Explain why this expectation cannot be met by an audit of financial statements. Describe major differences in evaluating internal controls over financial reporting in a financial statements audit and auditing internal controls over financial reporting as a separate engagement.