Sox requires companies to use coso or coso erm as the framework in evaluating internal controls.
a) true
b) false