To protect investors, regulators increasingly rely on regulating firms' internal controls over financial reporting, but they punish noncompliance only if an internal control weakness enabled accounting manipulation. In other words, enforcement is manipulation-contingent. We develop an economic...