Explain one way the external auditor's responsibilities regarding a public company's system of internal controls have changed since SAS 78 became effective in the late 1990s. Were these changes necessary? Do you believe the changes have been effective at reducing risk for the company and the users of the financial statements?