Under Section 404 of the Act, management is required to produce an“internal control report" as part of each annual Exchange Act report. See 15 U. S. C. § 7262. The report must affirm“the responsibility of management for establishing and maintaining an adequate internal control structure and procedures for financial reporting. ”15 U. S. C. § 7262 (a). The report must also“ contain an assessment, as of the end of the most recent fiscal year of the Company, of the effectiveness of the internal control structure and procedures of the issuer for financial reporting. ”To do this, managers are generally adopting an internal control framework such as that described in COSO.

读完这一段，结合原文中对上市公司的提及，我们知道，会计师事务所针对上市公司内控报告的相关内容出具《内部控制鉴证报告》原来是美国法律的要求。我们找到了这些说法的根源。维基百科这段文字还告诉我们“管理层的责任是建立健全内部控制并保持其有效性”这句话的由来， 以及管理层对内控有效性的“认定”其实就是assessment。但会计师事务所的“评价”(“鉴证”）怎么表述，这段话没有提及。

进一步调查，看到美国证券与交易委员会（SEC)网站中的相关内容：

Management's Report on Internal Control Over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports 

SECURITIES AND EXCHANGE COMMISSION 

AGENCY: Securities and Exchange Commission.

ACTION: Final rule.

SUMMARY: As directed by Section 404 of the Sarbanes-Oxley Act of 2002, we are adopting rules requiring companies subject to the reporting requirements of the Securities Exchange Act of 1934, other than registered investment companies, to include in their annual reports a report of management on the company's internal control over financial reporting. The internal control report must include: a statement of management's responsibility for establishing and

maintaining adequate internal control over financial reporting for the company；