Advice to board of directors traditionally focused on board structure, composition, size, and independence, but was short on risk management and practical IT control effectiveness. Sarbanes– Oxley requirements have changed that and made a significant impact on executive and board attention to governance over IT control. Therefore, we investigate factors affecting companies' IT control quality from the perspectives of senior management, independent directors, and audit committees.