What is the difference of the role between the internal and external auditor in terms of responsibility?