Purpose – The purpose of this study is to investigate the relationship of weaknesses in IT-related internal controls to companies' overall financial performance and health. Design/methodology/approach Design/methodology/approach – The study examines four accounting measures: liquidity, solvency, profitability, and market value. During the four-year period of 2004-2007, the authors identified companies that reported at least one material IT weakness and matched them with a similar set of companies with no reported material weaknesses. Additionally, for a subset of the companies in which a good match could be identified, a second data set was developed for comparison of companies reporting only material non-IT weaknesses. Findings Findings – As expected, companies reporting IT weaknesses experienced less of an ability to pay short-term and long-term debts, earned lower profits, and possessed lower market value than companies with no weaknesses. Companies reporting IT weaknesses experienced worse financial performance and health than companies with non-IT weaknesses. Research limitations/implications Research limitations/implications – At the time of this study, most foreign registrants listed on US stock exchanges had not completed and filed their initial SOX 404 assessment with the SEC. Furthermore, small public companies (i.e. under a $75 million market capitalization) were not required to comply with 404 reporting requirements at the time of this study. In addition, Compustat provides information only on publicly traded companies. Originality/value Originality/value – The current study builds on IT governance research in two key ways. First, academia and industry must move past the discussion of IT governance design