Sarbanes-Oxley (SOX) requires an internal control system. Yet the current financial crises indicates that the needed internal controls are not effectively implemented in many companies.