Choice "B" is correct. An engagement to report on an entity's internal control is best described as an attestation engagement to examine and report on management's written assertion about the effectiveness of its internal control.
Choice "a" is incorrect. Attestation standards do not permit a review engagement to be performed on a nonissuer's internal controls.
Choice "c" is incorrect. A prospective engagement is not appropriate for a report on internal control. In fact, the CPA's report includes an "inherent limitations" paragraph stating that projections of the internal control evaluation to the future are risky, since conditions or the degree of compliance may change.
Choice "d" is incorrect. In a consulting engagement, the practitioner develops findings, conclusions, and recommendations, but does not report on an assertion that is the responsibility of another party. When a CPA reports on an entity's internal control, he or she is in effect reporting on management's assertion.
