Building an Effective Internal Audit Function: Learning from SOX 404 Reports Academic Article