From a sample of firms reporting internal control deficiencies (ICD), I compare corporate governance structures to industry, exchange, and size – matched firms. I examine market reactions to reports of ICDs in 8-K filings. Additionally, I examine shifts in corporate governance characteristics since the Sarbanes-Oxley Act of 2002 (SOX). Results indicate that weaker boards, larger audit committees, less independent nominating committees, and high growth companies are associated with ICDs. Market reaction is negative to ICD disclosures when they are associated with controls over revenue. Firms have made changes post-SOX including reduced non-audit services, more frequent audit committee meetings, formation of nominating and governance committees, creation of internal audit functions, and implementation of corporate governance policies.