Why can’t the external auditor also be the internal auditor for a public company who has to comply with SOX?