Sarbanes-Oxley Three Years On: An Evolving Compliance Structure