Regulation by disclosure: the case of internal control