The discovery and reporting of internal control deficiencies prior to SOX-mandated audits

We use internal control deficiency (ICD) disclosures prior to mandated internal control audits to investigate economic factors that expose firms to control failures and managements' incentives to discover and report control problems. We find that, relative to non-disclosers, firms disclosing ICDs have more complex operations, recent organizational changes, greater accounting risk, more auditor resignations and have fewer resources available for internal control. Regarding incentives to discover and report internal control problems, ICD firms have more prior SEC enforcement actions and financial restatements, are more likely to use a dominant audit firm, and have more concentrated institutional ownership.