Methodologies for conducting information system audit : case study of Sarbanes-Oxley compliance