An evidential reasoning approach to Sarbanes-Oxley mandated internal control risk assessment · Study