The Effect of SOX Internal Control Deficiencies on Firm Risk and Cost of Equity

ABSTRACT The Sarbanes‐Oxley Act (SOX) mandates management evaluation and independent audits of internal control effectiveness. The mandate is costly to firms but may yield benefits through lower information risk that translates into lower cost of equity. We use unaudited pre–SOX 404 disclosures and SOX 404 audit opinions to assess how changes in internal control quality affect firm risk and cost of equity. After controlling for other risk factors, we find that firms with internal control deficiencies have significantly higher idiosyncratic risk, systematic risk, and cost of equity. Our change analyses document that auditor‐confirmed changes in internal control effectiveness (including remediation of previously disclosed internal control deficiencies) are followed by significant changes in the cost of equity that range from 50 to 150 basis points. Overall, our cross‐sectional and intertemporal change test results are consistent with internal control reports affecting investors' risk assessments and firms' cost of equity.