The correct answer is: The directors.
The directors are ultimately responsible for a company's system of internal control. This includes setting policy, implementing systems and monitoring those systems, although putting the systems in place and monitoring them may be delegated to other employees (eg internal auditors will monitor systems and report their findings to the directors). The external auditors have no such responsibility - their remit is to provide an opinion on the truth and fairness of the company's financial statements.
