We study auditors' client risk management in the first year of SOX 404 implementation, and find that there exists a pecking order among auditors' strategies to manage control risk resulting from internal control weaknesses. We first examine the relations between internal control weaknesses and...