Prior studies conclude that an unintended consequence of firms complying with the Sarbanes-Oxley Act is lower levels of risk-taking activities, including investment. We first show that prior studies cannot isolate the effects of SOX from other contemporaneous events. We then use the implementation requirements of SOX404 to construct a natural experiment that isolates the effects of SOX404 for a sample of small firms. We do not find a reduction in investment and other risk-taking activities for firms that had to comply with SOX404, relative to other firms. Because small firms are expected to be the most adversely affected by the regulation, our results cast doubt on the notion that SOX404 had a negative impact on larger firms.