The Effect of SOX Internal Control Deficiencies on Firm Risk and Cost of Equity

TLDR

The Sarbanes‑Oxley Act mandates management evaluation and independent audits of internal control effectiveness, a costly requirement that may reduce information risk and lower cost of equity. The study investigates whether changes in internal control quality affect firm risk and cost of equity by using unaudited pre‑SOX 404 disclosures and SOX 404 audit opinions. The authors employ these disclosures and audit opinions to evaluate how internal control quality changes influence firm risk and cost of equity. Firms with internal control deficiencies exhibit higher idiosyncratic and systematic risk and higher cost of equity, and auditor‑confirmed improvements in control quality are associated with 50–150 basis‑point reductions in cost of equity, confirming that internal control reports influence investors’ risk assessments and firms’ cost of equity.

Abstract

ABSTRACT The Sarbanes‐Oxley Act (SOX) mandates management evaluation and independent audits of internal control effectiveness. The mandate is costly to firms but may yield benefits through lower information risk that translates into lower cost of equity. We use unaudited pre–SOX 404 disclosures and SOX 404 audit opinions to assess how changes in internal control quality affect firm risk and cost of equity. After controlling for other risk factors, we find that firms with internal control deficiencies have significantly higher idiosyncratic risk, systematic risk, and cost of equity. Our change analyses document that auditor‐confirmed changes in internal control effectiveness (including remediation of previously disclosed internal control deficiencies) are followed by significant changes in the cost of equity that range from 50 to 150 basis points. Overall, our cross‐sectional and intertemporal change test results are consistent with internal control reports affecting investors' risk assessments and firms' cost of equity.