2005. For each firm identified as having a material weakness, we read the auditor's 404 report to determine whether the weakness was IT related. Two of the authors independently categorize the
material weakness as IT related. The percentage agreement between the two coders is 95%. At the end of the coding process, the two coders meet to reconcile differences and arrived at a consensus. Examples of IT control material weaknesses are provided in the Appendix. We identify 110 companies with IT control material weaknesses, which constitute 17.5% of all client firms reporting material weaknesses. Following the recommendation of Srinivasan (2005) and Desai et al. (2006), each company with IT material weakness is matched with a control company having similarities in both industry (SIC code) and size (revenue) during the year preceding the SOX 404 report.2 The above procedures yield our final sample: 110 companies having IT material weakness in the ICOFR matched with 110 companies reporting effective ICOFR. We obtain information about senior management, the board of directors, and audit committees for the 220 firms from the proxy statements that are filed with SEC. All other financial data are from Compustat.