SOX 404 top-down risk assessment