SOX 404 top–down risk assessment — US financial risk assessment