Internal control weaknesses and client risk management

We study auditors' client risk management in the first year of the Sarbanes-Act Oxley (SOX) 404 implementation, and find that a pecking order exists among auditors' strategies to manage control risk resulting from internal control weaknesses. We first examine the relation between internal control weaknesses and audit fees, modified opinions, and auditor resignations, respectively, and establish that these are viable strategies to manage control risk on a stand-alone basis. We also find that changes in audit fees and changes in modified opinions are positively associated with changes in reported internal control weaknesses. When we investigate these strategies simultaneously, descriptive evidence suggests that a pecking order exists among auditors' client risk management strategies. Ordered logit analyses further confirm that, as clients' control risk increases, auditors are likely to respond in the order of audit fee adjustments, modified opinions, and auditor resignations. Our comprehensive evidence suggests that auditors use an array of ordered strategies to manage client-related control risk.