What should an auditor express when reporting on internal controls for nonissuers?

When reporting on internal controls for nonissuers, the auditor should express an opinion on the effectiveness of those internal controls. This opinion provides valuable insight into the organization’s internal control systems, which helps in assessing the reliability of the financial statements. The auditor's assessment is crucial because it informs stakeholders whether the internal controls are adequately designed and operating effectively to prevent material misstatements in financial reporting.

Expressing an opinion involves evaluating the design and implementation of the internal controls and determining if they are functioning as intended. This is a key component in audits for nonissuers since stakeholders, such as management and owners, often rely on this feedback to make informed decisions regarding operational effectiveness and financial reporting.

The other options present ideas that do not align with the auditor's responsibilities. A statement of conformity with management assertions would imply that the auditor is merely agreeing with management rather than conducting an independent assessment. Reporting solely on financial statements does not address internal controls and therefore lacks crucial information for stakeholders regarding the entity's operational integrity. Providing only a negative assessment of internal controls without a comprehensive opinion does not fulfill the auditor's role in evaluating and communicating effectiveness.