The process of building a sustainable, comprehensive internal control environment sufficient to comply with section 404 of the Sarbanes-Oxley act of 2002 (SOX) requires a significant investment of organizational resources.