...) and a significant portion of internal control weaknesses are not remediated within a year time‐frame (Chan et al., 2009). As Khanin and Mahto (2012) note, a firm's risk attitude toward regulatory risk (i.e. SOX 404 risk assessment) is associated with the level of managerial risk deemed acceptable...