This study examines whether a firm’s business strategy is an underlying determinant of the quality of its internal control over financial reporting (ICFR). Organizational theory suggests that firms following an innovative “prospector” strategy are likely to have weaker internal controls than firms following an efficient “defender” strategy. We find that business strategy is a significant predictor of material weaknesses, incremental to known determinants of material weaknesses. We also find that relative to defenders, prospectors are less likely to remediate or disclose material weaknesses on a timely basis. Finally, we find that guidance in AS No. 5 instructing auditors to take a risk-based approach to ICFR evaluation improved auditors’ ability to link business strategy risks to internal control deficiencies by improving the timeliness with which material weaknesses are reported. Our results indicate that prospectors are riskier audit clients and suggest that business strategy is a useful summary indicator for evaluating firms’ internal control strength.