The Effect of Internal Control Deficiencies on Firm Risk and Cost of Equity Capital

Theoretically, internal control quality is related to the cost of capital through its effect on information risk. The Sarbanes-Oxley Act (SOX) mandates audits of internal control and disclosure of material internal control weaknesses, but do firms benefit from strong internal controls? In this paper, we use unaudited section 302 and audited section 404 disclosures to assess internal control deficiency (ICD) effects on idiosyncratic risk, systematic risk, and ultimately, the cost of equity capital. We find that after controlling for other risk factors, firms with ICDs have higher idiosyncratic risk, systematic risk, and cost of equity capital, and that the median market-adjusted cost of capital increase following the initial disclosure of an ICD is economically important at 104 basis points. Furthermore, we observe that the remediation of ICDs is followed by significant cost of equity capital reductions. Overall, the results of our cross-sectional and change analysis tests are consistent with strong internal controls being valued by the capital market.