Explain the differences between an audit of internal controls as required by section 404 of the US Sarbanes–Oxley Act 2002 and the testing of internal controls for the purposes of expressing an opinion on the financial report as mandated by ASA 315 (ISA 315). Refer to the standard and legislation in your answer.