Under section 404 of the Sarbanes-Oxley Act, auditors are required to:

• Attest to and report on management's assessment of internal controls.
• Establish and maintain internal controls for audited companies.
• Advise management on its preparation of the Report on Internal Controls.
• Evaluate the company's internal control system periodically throughout the year.
• All of these.