How to Comply with Sarbanes-Oxley Section 404: Assessing the Effectiveness of Internal Control