We use internal control deficiency (ICD) disclosures prior to mandated internal control audits to
investigate economic factors that expose firms to control failures and managements’ incentives to
discover and report control problems. We find that, relative to non-disclosers, firms disclosing ICDs
have more complex operations, recent organizational changes, greater accounting risk, more auditor
resignations and have fewer resources available for internal control. Regarding incentives to discover
and report internal control problems, ICD firms have more prior SEC enforcement actions and
financial restatements, are more likely to use a dominant audit firm, and have more concentrated
institutional ownership.