SOX internal control framework design