COSO-Based Internal Control and Comprehensive Enterprise Risk Management: Institutional Background and Research Evidence from China

China’s internal control framework follows the Committee of Sponsoring Organizations (COSO) framework, emphasizing enterprise risk management and encompassing financial reporting, operations, compliance, and strategies. The authors review research that uses the COSO-based Internal Control Index to assess internal control quality among all publicly listed firms in China. Unlike the binary classification of internal control weaknesses under the Sarbanes-Oxley Act Section 404, this continuous index captures more nuanced variations in internal control effectiveness and provides two key advantages over traditional assessment of internal control over financial reporting (ICFR). First, while financial reporting can enhance a firm’s monitoring and decision-support systems, the underlying information is determined by operations. Thus, internal control over operations has a greater impact on a firm’s performance than ICFR. While U.S.-based research argues that the effects of ICFR extend to operations, the COSO-based index includes operational controls, allowing for a more direct study of internal control effects. Second, many U.S. corporations fail to report internal control weaknesses, particularly during misstatement years. In contrast, the COSO-based index, compiled by independent scholars, avoids managerial incentives to withhold negative internal control information. Covering institutional background and research evidence from China, the authors survey a wide range of internal control studies related to various aspects of enterprise risk management, such as earnings quality, crash risk, stock liquidity, resource extraction, cash holdings, mergers and acquisitions, corporate innovation, receivable management, operational efficiency, tax avoidance, and diversification strategy.