Navigating SOX 404(a): How to Balance Risk, Budget, and Operational Goals