SOX 404 compliance process shows room for improvement