Who has responsibility for internal control in an organization? According to guidelines set forth in Section 404 of the Sarbanes-Oxley Act, what role does the auditor play in internal control?