Business Process-Based Regulation Compliance: The Case of the Sarbanes-Oxley Act