Auditing in a distributed data processing environment : a model for the evaluation of internal control