An auditor is performing a review of a nonissuer's interim financial information. The entity is also subject to an annual audit. During the review, the auditor inquires about the entity's internal control. Which of the following statements is TRUE regarding the auditor's responsibility for internal control in an interim review?

The auditor must perform tests of controls to support the review conclusion.

The auditor has no responsibility to understand internal control for a review engagement.

The auditor should obtain an understanding of internal control and its changes to identify types of potential material misstatements.

The auditor must issue a separate report on internal control if significant deficiencies are found.