Final answer:
Option (b), The primary responsibility of documenting and testing a company's internal controls lies with the company's management, not with its auditors.
Step-by-step explanation:
The answer to the student's question, "Both the company and its auditors have to document and test the company's internal controls," is b. False. It is the company's management that is primarily responsible for the establishment, documentation, maintenance, and testing of the company's internal controls.
The auditors' role is to independently evaluate and test the effectiveness of these controls to ensure they are functioning as intended and to provide an audit opinion. This process is a critical aspect of corporate governance and financial reporting.
In the context of the Sarbanes-Oxley Act (SOX), for example, Section 404 requires that management and auditors report on the adequacy of the company's internal control over financial reporting. While both parties have crucial roles, the primary responsibility for documentation and testing remains with the company. The auditors then perform independent audits as a check on the accuracy and completeness of management's report on internal controls.