Association between Internal Control and Sustainability: A Literature Review Based on the SOX Act Framework

Abstract

With the integration of sustainable development into all aspects of the economy, politics, society, culture, and ecology, the effectiveness and innovation of enterprises in sustainability have become global research issues. Internal control affects the current operation and management as the main means for enterprises to maintain normal production and operation and prevent risks. Therefore, it is closely related to the future development of enterprises. This study uses 84 papers from Web of Science to systematically trace the determinants of enterprise sustainability using Vosviewer software and the Sarbanes–Oxley Act (SOX) as a manifestation of internal control to analyze the role and controversies of internal control in the process of enterprise sustainable strategic planning. The results show that internal control has, on the one hand, positive effects on enterprise sustainability by improving the quality of financial information, derived effects, and spillover effects. However, on the other hand, internal control can be detrimental to enterprise sustainability by increasing compliance costs and legal liabilities. This study points out opportunities and directions for improving enterprise internal control regulation and empirical research in response to such results. Finally, this study provides implications for enterprises seeking to achieve a sustainable level of development regarding the proper implementation of internal controls, as well as avenues for further research.

1. Introduction

Sustainable management and development are considered core concepts in business and society today [1]. However, the rapid development of science and technology and the global economy destroy natural resources on which people depend. To maintain the sustainability of human society, the World Commission on Environment and Development introduced the concept of sustainable development in 1987. The theory of sustainable development has gradually developed over the years [2]. Subsequently, governments worldwide have put the concept of sustainable development into action in its economic, social, and environmental aspects. For enterprises to achieve their sustainability goals, they need sufficient funds to implement sustainable growth strategies to meet the needs of their investors. The goal of internal control is to achieve sustainable development of the enterprise [3]. The quality of internal control determines the enterprise’s operating results and management performance. Good business operations contribute to enterprises achieving their long-term growth goals. In addition, the harmonious internal environment resulting from internal control helps enterprises to eliminate unscientific jobs and unreasonable expenditures, optimize their capital operations, and achieve an optimal capital structure.

From the late 1990s to the beginning of this century, fraud cases against large enterprises emerged in the United States. After such financial fraud was exposed, public enterprises such as Enron and WorldCom declared bankruptcy. Overnight, stock certificates growing rapidly in price turned into “scrap paper”. Investors were outraged by the lack of financial fraud regulation. In 2002, US Congress promoted the Sarbanes–Oxley (SOX) Act to protect the interests of investors and strengthen the responsibilities involved in enterprise integrity. The primary goal of the SOX Act is to protect investors by improving the accuracy and reliability of enterprise information disclosures. However, whether the specific mechanisms and provisions of the SOX Act prevent investors from achieving sustainable development of enterprises has become a topic of debate in theoretical, practical, and political aspects following its implementation.

In order to more comprehensively understand the relationship between internal control and enterprise sustainability under the SOX Act framework, this study uses 84 English-language papers from a core database, i.e., Web of Science between 2006 and 2021, as its research object, uses a literature review and bibliometric graph as the research method, uses Vosviewer software to trace the determinants of enterprise sustainability systematically, and uses the Sarbanes-Oxley Act as a manifestation of internal control to explore the role and controversies of internal control in the process of enterprise sustainable strategic layout. The results show that the factors affecting enterprise sustainability mainly include enterprise characteristics, managerial characteristics, social responsiveness, environmental responsiveness, and external effects. At the same time, internal control positively affects enterprise sustainability by improving the quality of financial information, derived effects, and spillover effects. However, it can be detrimental to enterprise sustainability as well due to increased compliance costs and legal liabilities. In addition, an analysis of the impact of internal control on enterprise sustainability under the SOX Act framework at the country level reveals that the SOX Act framework has been implemented to varying degrees in different countries, providing practical insights into the proper implementation of internal control in enterprises.

In recent years, there has been a great deal of research exploring the economic consequences of internal control quality and the factors influencing enterprise sustainability, with a wide variety of research perspectives. For example, in terms of influence on enterprise sustainability, the main factors are related to enterprise characteristics [4,5], managerial characteristics [6,7], social responsibility [8,9], environmental responsibility [10,11], and external factors [12,13]. In terms of the economic consequences of internal control, the main factors include financial information quality [14,15], governance decisions [16,17], earnings management [18,19], other stakeholders [20,21], compliance costs [22,23], and social response costs [24,25].

The purpose of this study is to synthesize the relevant literature on the economic consequences of internal control and the factors influencing enterprise sustainability, as well as to discuss the impact of enterprise internal control on enterprise sustainability. Our findings are relevant to managers, investors, creditors, and internal and external auditors. This study reviews the determinants of enterprise sustainability. It uses the SOX Act as a manifestation of internal control to analyze the role and controversies of internal control in the sustainable strategy of enterprises. On this basis, this study points out opportunities and directions for improvement in supervision of and empirical research on the internal control of Chinese enterprises, taking into account the reality of China today, which can provide a reference for how enterprises can achieve a sustainable level of development, and thus reasonably use the internal control of enterprises, while providing additional implications for further research in this field.

This study extends previous reviews, thereby making a distinct and incremental contribution. First, this study provides an update of internal control and enterprise sustainability studies published after 2006 using enterprise data from various countries. Prior reviews have focused on the ten years post-SOX adoption. A substantial body of research offers new insights into the value, importance, and efficacy of internal control reporting. As enterprise sustainability has received increasing attention, many studies have examined the effects of enterprise characteristics, internal governance, social responsiveness, and environmental policies on enterprise sustainability through research studies and have explored their main influencing factors [7,26,27]. However, the two discourses have not been analyzed. This study reviews the determinants of enterprise sustainability and explores the role and controversies of internal control in the sustainable strategies of enterprises.

Second, this study uses the unique perspective of the SOX Act as a manifestation of internal control to answer the controversy surrounding internal control’s role in the sustainable strategy of enterprises. Several studies have shown that the SOX Act improves audit quality and reduces financial scandals and internal agency problems [28]. Conversely, other studies have argued that the existence of anti-SOX interest groups is necessary [29], because the establishment of the SOX Act greatly reduces enterprise wealth and lowers bondholders’ bond values. After a literature review, this study suggests that the US SOX Act is positive for the sustainable development of large enterprises and enterprises with good fundamentals, but burdensome for small- and medium-sized enterprises and enterprises with poor fundamentals in a way which is not conducive to the sustainable development of these enterprises.

Finally, the derived and spillover effects of the SOX Act’s implementation on internal control are extended. On the one hand, this study analyzes the inner logic of the derived effect from the path of governance decisions, earnings manipulation, and risk avoidance to the sustainable development of the enterprise. On the other hand, from the perspectives of auditors, markets, and other stakeholders, achieving financial, operational, and compliance goals generates spillover effects that affect the goals of different investors and impact the enterprise’s sustainability. This study provides a systematic theoretical basis for the extension effect of internal effects.

The rest of this paper is organized as follows. Section 2 is an introduction to the data sources and research methods. Section 3 presents the results of the literature analysis, including the determinants of enterprise sustainability and the economic consequences of internal controls. Finally, Section 4 provides a summary and discussion of the findings, including the impact of the SOX Act on enterprise sustainability in various countries and future research directions.

2. Materials and Methods

This study presents a comprehensive review of the literature on enterprise internal controls and sustainable development of enterprises from 2006 to 2021. “Enterprises internal controls”, “Sustainable development of enterprises”, and “Sarbanes–Oxley” were selected as the subject terms and published in the Web of Science database core collection, Google Scholar, Science Direct, Emerald, Taylor and Francis, Wiley, and Springer LINK, and a total of 6685 papers were collected. The annual distribution of each theme is shown in Figure 1.

As shown in Figure 1, research on enterprise sustainability has undergone rapid growth since 2016, indicating that enterprise sustainability has received increasing academic attention in recent years. The study of enterprise internal control and of SOX has changed little over time. Internal control has been discussed in conjunction with other topics as a long-standing enterprise hot topic. Although the SOX Act, as an older topic, has diminished in heat, exploring its contribution requires a unique perspective.

In addition, in order to explore the association between internal control and sustainability in the SOX-based context, this study used Vosviewer to draw a bibliometric graph, as shown in Figure 2.

The bibliometric graph shows that there is a close logical relationship between corporate sustainability, internal control, and the SOX Act. For example, “governance”, “agency costs”, “innovation”, “quality”, and “audit committee” can be used as a bridge between the two.

At the same time, the following criteria were followed to further screen the literature from the first round of searching in order to determine the final pool of literature for inclusion in the analysis. First, the theme of the study was limited to enterprise sustainability; thus, purely descriptive, introductory, and briefly evaluative papers on external sustainability and environmental policies were eliminated. Second, we aimed to synthesize the literature related to the economic consequences of internal control and the influencing factors of enterprise sustainability, and therefore deleted the literature related to the factors of enterprise internal control and the economic consequences of sustainability. Third, only papers from peer-reviewed journals were selected, and the types of papers were mainly empirical studies and case studies. At the same time, news reports, column introductions, conference reviews, book reviews, and policy interpretations were deleted. Fourth, the study sample and content had to be independent, and duplicate studies using the same data were excluded. Eighty-four papers were screened for inclusion in the analysis, dividing the results into the determinants of enterprise sustainability and the economic consequences of internal controls.

3. Results

3.1. Determinants of Enterprise Sustainable Development

Sustainable enterprises are more efficient, have more resilient business models, and generate stable cash flow from an economic perspective. Regarding social and environmental perspectives, sustainability refers more to enterprise responsibility than an obligation. Many prior studies [7,26,27] have examined the effects of enterprise characteristics, internal governance, social responsiveness, and environmental policies on sustainable enterprise development and explored their main influencing factors. For example, ref. [30] found that government support for Chinese enterprises to develop financing guarantee services is one of the key external environmental factors constraining sustainable enterprise development. Furthermore, among the internal environmental factors, improvement at the management level has an important positive role in an enterprise’s sustainable development. Therefore, this section explores the impact of internal and external factors on an enterprise’s sustainability. Furthermore, this is linked to the economic consequences of internal control in the following section. The related literature is summarized in

Table 1. Determinants of sustainable development (31 studies).

Authors	Influencing Factor	Sample	Research Method	Country	Main Findings
Panel A: Enterprise Characteristics (nine studies)
[5]	Ownership	1000	empirical study 2016	US	Family businesses pay more attention to enterprise reputation, brand image, and other factors that affect the long-term development of enterprises.
[32]	Contact trade	9843	research study	Ecuador	To achieve the sustainable development of enterprises, the upstream and downstream enterprises must form a more consistent value standard.
[33]	Operating age	1200	empirical study 2007–2011	Italy	The longer the business time frame, the more enterprises will achieve long-term development by actively fulfilling social responsibility.
[34]	Organization resilience	232	research study	US	Resilience is seen as a key organizational capacity for sustainable development.
[35]	Enterprise statement and strategy	3034	research study	Turkey	A clear corporate mission is conducive to achieving organizational goals, including sustainable development.
[36]	Information and communication technology	16	research study	Columbia	Information and communication technologies for product and service design increase opportunities for sustainable enterprise development.
[37]	Advanced manufacturing technology	72	empirical study 2009–2012	UK	Advanced technologies in product and service design increase opportunities for sustainable development.
[38]	Human resource management	150	research study	Poland	Green human resource management is of positive significance to the sustainable development of organizations.
[4]	customer concentration	13,437	empirical study 2009–2017	China	There is a significant inverted-U-shaped relationship between customer concentration and sustainable enterprise innovations.
Panel B: Manager Characteristics (seven studies)
[39]	Managerial attitudes	260	research study	Malaysia	The positive attitudes of business managers towards green initiatives makes environmental sustainability a solid competitive tool for development.
[40]	Transformational leadership	281	research study	China	Transformational leaders achieve sustainable development by promoting their subordinates’ innovative work behaviors.
[41]	Sustainable leadership practice	439	research study	Thailand	Sustainable Leadership (SL) practices play an important role in corporate financial performance.
[42]	Top management team with behavior integration	40	research study	Iran	Behaviorally integrated top management teams promote interaction among professionals to form core competencies.
[12]	Organizational and entrepreneurial resilience	222	research study	South Africa	Improving organizational and entrepreneurial resilience contributes to building positive and sustainable performance relationships.
[7]	Managerial power	179	empirical study 2009–2015	Pakistan	Managerial power enables managers to take actions in favor of the enterprise, thereby providing impetus for its development.
[6]	On-the-Job Consumption	19,021	empirical study 2008–2019	China	Reasonable and excessive on-the-job consumption has positive and inhibitory effects, respectively, on the sustainable development of enterprises.
Panel C: Social Responsiveness (four studies)
[8]	Social performance	348	empirical study 2015	Italy	The sustainable development of enterprises depends largely on the enterprise’s views on national sustainable development strategies and their strengths.
[27]	Community responsibility	153	research study	Zambia	Corporate social responsibility has a positive impact on sustainable performance.
[43]	Social problem	—	normative study	the Netherlands	Improving the sustainability of SMEs in manufacturing requires a combination of social, environmental, and commercial issues.
[9]	Community responsibility	15,094	empirical study 2010–2017	China	The good performance of corporate social responsibility can provide key resources for the strategy of enterprises and help the harmonious development of enterprises.
Panel D: Environmental Responsiveness (six studies)
[44]	Eco-innovation	42	research study	the Netherlands	Ecological innovation capability may become a new source of competitive advantage for sustainable development.
[45]	Eco-innovation	439	empirical study 2006–2013	Poland and Hungary	Ecological innovators have higher returns on assets and rights, lower retained earnings, a larger scale than other enterprises, and more free cash flow.
[11]	Environmental policy	222	research study 2017	South Africa	Mandatory isomorphic pressures have a significant impact on all three dimensions of sustainable development, namely, economy, environment, and society.
[46]	Environmental management system	9	action research 1999–2004	Sweden	Enterprises can use learning networks to overcome obstacles to the implementation of environmental management systems to achieve sustainable development.
[47]	Green innovation	252	research study	India	The adoption of green innovations is driven by economic and institutional pressures that create value for their social sustainability.
[10]	Business Ecosystem	—	case study	China	How to create a good business ecosystem and sustainable development is the main problem faced by enterprises.
Panel E: External Effect (five studies)
[48]	Market circumstances	3497	empirical study 2007–2009	South Korea	An effective market environment is conducive to the sustainable development of enterprises.
[11]	Regulatory pressure	238	research study	South Africa	Mandatory isomorphic pressures from governments, environmental pressure groups, and other stakeholders have a profound impact on enterprise sustainability.
[13]	Internationalization level	304	research study	Pakistan	International finance, international technology, international experience, and international networks have a positive impact on the sustainable competitive performance of enterprises.
[49]	Market conditions	175	research study	Italy	The customer’s cognition dimension of enterprise sustainability practice has a significant influence on the economic performance of SMEs.
[50]	Changes in the external environment	476	empirical study 2017	Germany	Opportunities and challenges are closely related to the sustainable development of enterprises.

based on [31].

First, an enterprise’s characteristics have an important impact on sustainable development. Ref. [5] find that family enterprises have complex issues that affect their image and management. They pay more attention to factors that affect the long-term development of their enterprise, such as its reputation, brand image, and financial value. Ref. [33] demonstrate that an enterprise’s age is associated with its perceptions of sustainability. The longer the enterprise is in business, the more profound the understanding of sustainable development, and the more it actively fulfills various social responsibilities to achieve long-term enterprise development. At the same time, resilience is a key organizational capability for sustainability. Making organizations more sustainable and resilient requires innovative responses to the marketplace through continuous reform and improvement [34]. Enterprises must identify the environmental and social factors most relevant to their organizational operations through continuous learning [51]. In addition, several previous studies [36,37] argue that advanced technologies for product and service design and information and communication technologies increase opportunities for enterprise sustainability.

Second, managerial characteristics and transformational leadership play an important role in an enterprise’s sustainability. Ref. [7] argue that managers can quickly become aware of the various problems encountered in enterprise development and act accordingly in favor of the enterprise, thus providing the impetus for enterprise development. Ref. [39] find that managers view environmental sustainability as a competitive tool for enterprise growth. Ref. [41] confirm the importance of sustainable leadership (SL) practices on enterprise financial performance, including shared vision, friendly labor relations, valuing employees, and social responsibility. Transformational leaders promote innovative behaviors among their subordinates through trust, empowerment, and work engagement to achieve sustainable enterprise growth [40]. Behaviorally integrated top management teams facilitate interaction between professionals within the organization, promoting innovative solutions and strategies to develop core competencies to improve the enterprise’s sustainability. In addition, many prior studies [11,34] suggest ways to improve organizational and entrepreneurial resilience to build positive sustainability performance relationships.

Finally, many previous studies suggest that enterprise stakeholders, social responsiveness, and environmental responsiveness impact enterprise sustainability. For example, several prior studies highlight the important influence of stakeholders on sustainability performance relationships in terms of achieving enterprise reputation, competitive advantage, customer satisfaction, and social engagement [8,27]. In addition, ref. [8] find that enterprises’ awareness of sustainability strategies and subsequent returns to practice is critical to positive sustainable financial performance relationships. Social issues need to be integrated with environmental and business issues to improve the sustainability of manufacturing SMEs [43] finds that the good fulfillment of corporate social responsibility (CSR) can provide key resources for the strategy of enterprises, which can make consumers trust more in their products, attract more capital investment, and provide many aspects for further harmonious development. In addition, the ability to “eco-innovate” is becoming increasingly important under increasing global pressures, and could be a new source of competitive advantage to influence the sustainability of enterprises [44]. Ref. [45] find that strong assets and financial capacity strongly influenced 22 SMEs to adopt eco-innovation to improve their financial performance. Therefore, governments and other stakeholders need to consider the tolerance range of enterprises when putting pressure on them to enhance sustainability in order to achieve a win–win situation [12].

In addition, the impact of external factors on enterprise sustainability mainly focuses on the market environment [48], regulatory pressure [12,52], and level of internationalization [13]. For example, ref. [48] found that Korean enterprises’ group membership and listing status favorably moderate the effect of environmental innovation on enterprise performance. Ref. [49] demonstrate the significant impact of customers’ perceptions of enterprise sustainability practices on Italian enterprises’ economic performance. In addition to the impact on the market environment, regulatory pressures from the government, the environment, and other stakeholders challenge the survival and sustainability of enterprises [11]. Therefore, ref. [53] argue that obtaining sustainability certification is the key to enterprise survival. Enterprises should consider sustainability strategies’ returns and opportunity costs, not just review the financial costs. In addition to this, studies have explored other influencing factors. For example, ref. [13] examine the role of international finance, international technology, international experience, and international networks in the sustainable competitive performance of SMEs. SMEs are a major source of employment and value creation, and are closely linked to national economic and social development as well as to increased sustainability. Ref. [50] explore the relevance of the opportunities and challenges associated with Industry 4.0 to the sustainable development of enterprises, which have to adapt to the changes in the external environment by learning advanced technologies and management styles in order to achieve sustainable development.

3.2. Economic Consequences of Internal Control in the SOX Act Framework

By establishing a sound and reliable internal control system and then strictly implementing it, enterprises can create a good business environment, monitor irregular activities, balance legitimate rights and interests among stakeholders, and achieve sustainable development. In addition, numerous empirical studies explore the economic consequences arising from the SOX Act. On the one hand, many prior studies argue that the introduction of the SOX Act benefits enterprises and other stakeholders and facilitates sustainable synergistic development of enterprises, society, and investors. However, on the other hand, a large body of literature argues that the SOX Act is negatively associated with enterprise sustainability. The related literature is summarized in

Table 2. The economic consequences of internal control on sustainable development (53 studies).

Authors	Association(s) Examined	Sample	Period	Country	Main Findings	Effect of IC on Attribute
Panel A: Internal Control and Financial Information Quality (ten studies)
[55]	Sarbanes–Oxley Act, GS and analysts’ information environment	6590	1997–2006	Columbia	SOX and the concurrent analyst regulations are associated with a temporary increase in the quality of common information.	Positive
[56]	Internal control and growing concern for audit opinions	39,749	2004–2009	Canada	Enterprises with serious internal control deficiencies face greater uncertainty.	Positive
[57]	Internal control and accrual quality	705	2002–2005	US	Internal control can improve the accrual quality of enterprises.	Positive
[58]	Internal control and financial reporting	16,191	1986–1992 1995–2001	US	Internal control can improve the quality of financial reporting.	Positive
[59]	Internal controls and conditional conservatism	1098	2000–2001 2003–2005	US	Internal control can improve robustness.	Positive
[60]	Internal control and management forecasts	11,531	2004–2006	US	Better internal controls are associated with more accurate management forecasts.	Positive
[61]	SOX Section 404 and corporate transparency	1923	2001–2007	EU-15	The SOX Act helps to reduce information opacity.	Positive
[62]	Analyst regulations and capital market information environment	459,546	1983–2011	US	The implementation of SOX improves analyst precision and reduces enterprise information opacity.	Positive
[15]	Forced internal control and information quality	213,072	2001–2007	US	SOX-404-forced internal control audit improves the quality of accounting information.	Positive
[14]	Internal control regulation and reporting quality	14,028	2008–2017	China	C-SOX has a positive effect on reporting quality and triggers no side effects, harming firms’ long-term value.	Positive
Panel B: Internal Control and Governance Decisions (22 studies)
[63]	Major defects of internal control and cost of equity	24,806	2004–2009	US	Significant defects in internal control have a negative impact on the cost of equity.	Positive
[64]	Internal control disclosure requirements and CFO	27,797	1997–2006	US	Mandatory internal control disclosure under SOX can effectively judge executive governance decisions.	Positive
[65]	IC quality over inventory and firms’ inventory management	8953	2004–2009	US	Enterprises with high-quality internal controls have more inventory management.	Positive
[66]	IC weakness and corporate fraud	14,093	2005–2010	US	There is a strong positive association between material IC weakness and future fraud revelation.	Positive
[67]	IC weakness disclosures and loan reserves and provisions in the banking sector	8167	2002–2013	US	Loan reserves and provisions are higher in years of IC weakness disclosures.	Positive
[68]	Disclosure of IC weakness and investment efficiency	5544	2004–2007	US	After SOX IC weakness disclosures, enterprises’ investment efficiency improves significantly.	Negative
[69]	Internal control weaknesses and industry-specialist audits	7172	2004–2008	US	Earnings quality of IC weakness enterprises audited by Big 4 industry specialists is higher than those audited by Big 4 nonspecialists.	Positive
[70]	Management’s IC reports and reporting quality proxied by discretionary accruals	2339	2004–2010	US	Management reports on IC quality improve financial reporting quality even in the absence of attestation.	Positive
[71]	IC weakness and accounting conservatism	3492	2004–2009	US	ICW enterprises exhibit greater accounting conservatism in the post-SOX period than enterprises with effective internal controls (non-ICW).	Negative
[72]	Internal control weakness disclosure and firm investment	16,555	2004–2012	US	Enterprises that receive adverse auditor internal control opinions have significantly lower investments than enterprises that receive clean opinions.	Positive
[73]	IC weaknesses and earnings quality, and management	60	2009–2010	Japan	Accrual and real earnings management remain unchanged (increase) for enterprises not disclosing (disclosing) IC weaknesses following J-SOX.	Positive
[74]	Compliance with IC legislation on corporate profitability	160	2011	Saudi Arabia	Two components of the IC system (risk assessment and control of procedures) have a positive effect on corporate profitability.	Positive
[75]	IC weakness disclosures and discretionary accruals	470	2006	Canada	A positive and significant association exists between IC weakness disclosures and discretionary accruals.	Positive
[76]	IC weakness and misstatements in financial information	5249	2005–2008	US	IC weaknesses under SOX 404 are positively associated with misstatements in financial information.	Positive
[19]	Tax-related material IC weakness and firms’ corporate tax avoidance	6696	2004–2009	US	Tax-related internal controls represent an important underlying determinant of tax avoidance, with significant cash flow effects.	Positive
[77]	IC effectiveness and tax avoidance	11,606	2004–2010	US	Effective IC systems are negatively related to effective tax rates.	Positive
[78]	Auditor-provided tax services and the association between tax-related IC and book-tax differences	3705	2005–2011	US	Enterprises with significant defects in internal control have higher tax avoidance and earnings management activities.	Positive
[79]	Material IC weakness disclosures and real earnings management	23,409	2004–2012	US	Enterprises with material IC weaknesses engage in more manipulation of real activities.	Positive
[80]	IC weaknesses and firms’ greater savings of cash from internally generated cash flows	10,214	2005–2010	US	IC weaknesses are associated with stronger cash-to-cash-flow sensitivities and with a weaker impact of higher asset liquidity on stock liquidity.	Positive
[81]	IC weaknesses and accounting conservatism	1059	2010–2011	China	IC weaknesses have a negative effect on accounting conservatism.	Positive
[16]	IC quality and investment efficiency	20,437	2004–2008	China	ICOFRs are more likely to make inefficient investments.	Positive
[17]	Internal controls, risk management, and cash holdings	19,792	2007–2015	China	Internal controls help companies shape reasonable cash policies that lead to value creation.	Positive
Panel C: Internal Control and Earnings Manipulation (five studies)
[82]	Implementation of SOX and earnings management	8157	1987–2005	US	The implementation of SOX reduces the earnings management of enterprises.	Positive
[18]	Material IC weakness disclosures and real earnings management	7475	2004–2010	US	There is a positive association between enterprises reporting IC weaknesses and real activities manipulation.	Positive
[19]	Internal control defects disclosed under SOX and corporate tax avoidance	6696	2004–2009	US	Significant reduction in corporate tax avoidance with significant tax-related internal control deficiencies.	Positive
[83]	Major defects of internal control and timeliness and compliance of company 8-K declaration	118,808	2005–2010	US	IC deficiencies reduce enterprises’ 8-K filing compliance and reporting timeliness.	Positive
[84]	Internal control reporting and audit report lags	5678	2008–2009	US	The improvement of SOX’s internal control quality can encourage enterprises to comply with laws and regulations.	Positive
Panel D: Internal Control and Other Stakeholders (ten studies)
[85]	SOX Section 404 material weakness disclosures and audit fees	660	2003–2005	US	Enterprises with internal control deficiencies are significantly more expensive than enterprises without internal control deficiencies.	Positive
[86]	Internal control defects and audit fees	410	2003–2004	US	Audit fees increase significantly after the disclosure of internal control deficiencies.	Positive
[87]	Permanently exempt from SOX 404 market reaction	12,984	1994–2002	Germany	The market reaction was negative when SOX 404 permanent immunity was granted to small enterprises.	Positive
[21]	Information disclosure and the same industry	49,092	2005–2014	US	Disclosures of corporate information with internal control deficiencies can lower shares in other enterprises in the same industry.	Positive
[20]	Internal control weakness, investment, and firm valuation	1170	2004–2013	US	Enterprises that disclose internal control deficiencies have poor market performance and low investor evaluation.	Positive
[88]	Internal control weaknesses and information uncertainty	330	2004	US	SOX requirements for establishing and improving internal controls have a positive impact on small and medium investors.	Positive
[89]	SOX internal control deficiencies, risks, and equity costs	1053	2003–2005	US	Internal control defects lead to concerns on the part ofof minority shareholders about the enterprise’s risk and the protection of legitimate rights and interests.	Positive
[90]	Financial report quality and debt contract	2231	2002–2008	US	Defects in internal control cause creditors to distrust financial information.	Positive
[91]	Auditor’s internal control opinions and creditors	111	experimental study	US	Enterprises where creditors are willing to accept better internal controls.	Positive
[92]	Internal control weakness and bank loan contracting	1363	2005–2009	US	Banks demand higher interest rates from borrowers when internal controls are inadequate.	Positive
Panel E: Internal Control and Compliance Costs (three studies)
[93]	Internal control system and operating costs	470 going-private transactions	1998–2005	US	Strict compliance with the SOX Act and re-establishing internal sound controls could place a huge cost burden on enterprises.	Negative
[22]	SOX implementation and audit costs	1499	2003–2004	US	The increase in audit fees after SOX implementation is much larger than the increase in accrued quality.	Negative
[23]	SOX regulation and enterprise intent	7249	1998–2004	US	Enterprises choose to avoid SOX regulation by exiting secondary markets to reduce compliance costs.	Negative
Panel F: Internal Control and Social Response Cost (three studies)
[82]	SOX Act and corporate risk-taking	14,604	1992–2006	US	The SOX Act increases the cost of corporate responsibility and reduces risk appetite.	Negative
[25]	Sarbanes–Oxley and corporate risk-taking	4342	1994–2006	US, UK, Canada	SOX regulation significantly limits corporate risk-taking and innovation.	Negative
[94]	SOX liability avoidance and corporate behavior	6946	1999–2001 2003–2005	US	Enterprises obtain SOX exemptions by disclosing more bad news and reporting lower returns.	Negative

based on [54].

Figure 3 shows a framework of the economic consequences of the SOX Act. The economic implications of the SOX act are mainly divided into positive and negative aspects. The positive aspects include improving the financial information environment, spillover, and derivation effects. The spillover effect refers to the other impacts of improving the information environment, such as improving corporate governance. The derivation effect refers to the ability of the SOX Act to influence enterprises’ stakeholder behavior and decisions. The negative aspects mainly include increased compliance costs and increased legal liability.

3.2.1. Positive Consequences

A large body of empirical literature in the US shows that implementing the SOX Act leads to several positive consequences for enterprises and investors due to internal control audits, thus contributing to a higher level of enterprise sustainability. First, the SOX Act can improve internal control objectives related to financial reporting objectives, effectively ensuring the quality of financial information and improving information transparency, as reflected in the direct impact of the SOX Act on improving the enterprise information environment. Second, the SOX Act can improve enterprise non-financial reporting-related objectives, such as compliance with operational and compliance objectives, as demonstrated by improvements to governance mechanisms.

(1)

Financial information quality and information transparency

One of the most important aspects of the SOX Act’s positive impact on enterprise sustainability is the improvement of enterprises’ internal control audits on the financial reporting information environment. This is closely related to the SOX Act’s requirement that auditors focus on the effectiveness of internal controls as identified with financial reporting objectives. Most of the existing literature follows information economics for theoretical derivation. Therefore, internal control directly affects the enterprise accounting information environment. Effective internal controls can improve the accuracy of forecast information and the quality characteristics of accounting information and reduce information asymmetry and agency costs between enterprises and investors, and thus contribute to the long-term synergy between enterprises and investors.

The primary goal of the SOX Act is “to protect investors by improving the accuracy and reliability of enterprise disclosures”. In addition, the SOX Act improves the quantity and quality of disclosed information through various disclosure requirements and corporate governance mandates [95,96,97]. Internal control improves the quality of accounting information and enhances enterprise sustainability through investor protection. Previous studies focus on the ability of internal control audits to improve the accrual quality and conservatism of accounting information, earnings management forecasts, and analyst forecasts. For example, refs. [57,58] argue that internal control can improve the accrual quality and prevent and correct misstatements and omissions that are intentional or unintentional. They find that enterprises that implemented a compulsory audit have improved earnings quality. In addition, ref. [59] argue that internal control can improve conservatism, an important characteristic of accounting information quality. They find that the internal control of an enterprise increases with accounting conservatism. Finally, ref. [60] explain that internal control can affect the enterprise information environment by examining management forecasts. The quality of internal control significantly affects the management forecast report, and those of enterprises with poor internal control are less accurate.

On the contrary, the better the internal control, the more accurate the management forecast. Refs. [61,62] investigate the impact of the SOX Act’s implementation on analysts’ forecast accuracy and find that the SOX Act increases the information transparency of enterprises. Nevertheless, ref. [59] argue that, on the one hand, serious deficiencies in internal control expose financially distressed enterprises to greater uncertainty. On the other hand, the information asymmetry caused by internal control deficiencies makes it more difficult for auditors to recognize the future evaluation of enterprises. Ref. [15] examine the quality of financial information by comparing the accrual level of quarterly financial reports between the enterprises implementing the SOX 404 mandatory internal control audit before and after 2004 and those that do not. The results show that the quality of quarterly accounting information in enterprises implementing the SOX 404 mandatory internal control audit is significantly better than those that do not.

Ref. [95] highlights that the SOX Act provides executives and auditors with new and powerful incentives to disclose control system weaknesses. In addition, the interaction between disclosure and liability risk further improves the incentives to eliminate weaknesses and invest more resources in internal controls. As a result, implementing the SOX 404 mandatory internal control audit significantly improves enterprises’ accounting information, which is conducive to their sustainable development.

(2)

Positive evidence of the SOX Act derivation effects

Good internal controls further strengthen corporate governance by improving the derivation effects of the information environment to enhance enterprise sustainability, which is in line with the COSO Committee’s internal control objectives of 1992. The derivation effect means that a subject performing a specific activity has the expected effects resulting from that activity and affects other subjects. COSO’s interpretation of the internal control structure considers that the effectiveness of internal control is reflected in the reasonable assurance of financial reporting objectives and requires that internal control provides reasonable assurance of the efficiency and effectiveness of enterprise operations and compliance with laws and regulations. The relevant empirical evidence is quite ample. The main theoretical logic is that the effectiveness of internal control first acts directly on the information environment for financial reporting. Changes in the financial reporting information environment further generate factors that affect the achievement of other enterprise objectives, such as operational and compliance objectives, thereby contributing to the enterprise’s sustainability in an improved external environment.

First, the SOX Act moves enterprises toward protecting investor interests by changing their governance decisions. For example, ref. [98], from the perspective of diversification discount, argue that enterprises with effective internal controls are more advantageous in terms of information communication and collaboration, which can increase the operational efficiency and overall enterprise value within diversified enterprises. Enterprises with deficient internal controls have higher levels of diversification discount. Ref. [65] find that enterprises with high-quality internal controls have more inventory management. As evidenced by lower inventory turnover rates and higher inventory impairment allowances, deficient internal controls can lead to significant deficiencies and weaknesses in the recording, maintenance, valuation, and tracking of inventories. Ref. [63] argue that disclosed material internal control deficiencies affect the capital costs of an enterprise. The higher the number of internal control deficiencies disclosed by an enterprise and the longer the duration of internal control deficiencies, the higher the enterprise’s cost of equity capital.

Conversely, after correcting internal control deficiencies, enterprises’ cost of equity is significantly lower. Thus, internal control significantly affects the financing cost of enterprises. Ref. [64] examines how the increased internal control disclosure requirements mandated by the SOX Act affect the annual corporate governance decisions of the CFOs involved. The findings show that enterprises with weak internal controls have lower CFO compensation and suffer higher mandatory replacement rates following the passage of the SOX Act. In comparison, enterprises with strong internal controls have higher CFO compensation but no change in mandatory replacement rates. Thus, the findings suggest that mandatory internal control disclosure under the SOX Act is a credible mechanism for distinguishing between good and bad CFOs by disclosing the quality of an enterprise’s internal controls. In addition, the evidence supports the view that mandatory disclosure reduces information asymmetry in the managerial labor market.

Second, internal control can reduce manipulation of earnings, improve enterprises’ operating profits, and avoid market risks, thus promoting sustainable enterprise development. Ref. [18] find that enterprises with internal control deficiencies are more likely to use real earnings management to manipulate earnings than other enterprises with good internal control. These manipulations do not perform as well as they should the following year. The findings suggest that enterprises with high quality internal controls can effectively inhibit such manipulations that deviate from production and business objectives, improving enterprises’ business objectives. Ref. [19] argues that internal controls as a governance mechanism can unify objectives between shareholders and enterprise managers, reducing the associated agency costs regarding the quality of enterprise financial information and the enterprises’ tax avoidance derivation. These findings suggest that enterprises with significant tax-related internal control deficiencies lead to significantly lower levels of tax avoidance. This conclusion is only consistent with internal control deficiencies at the overall level of financial reporting.

Moreover, ref. [24] interviewed 30 managers and partners (all auditors) from the Big 4 after the SOX Act. They found that auditors perceive that the enterprises’ governance environment improved significantly after the SOX Act. Audit committees have become more active, diligent, professional, and empowered. These findings indicate a significant enhancement of corporate governance after the SOX Act’s implementation. The SOX Act can improve compliance objectives as well. Ref. [83] find that enterprises with effective internal controls comply more with the regularity and timeliness requirements when filing 8-K documents with the SEC. Refs. [84,99] find that enterprises with internal control deficiencies after the SOX Act’s implementation are more likely to delay filing their 10-K and related audit reports with the SEC, suggesting that the improved quality of the SOX Act’s internal controls can provide incentives for enterprises to comply with laws and regulations, contributing to such enterprises’ sustainability.

(3)

Positive evidence of the SOX Act spillover effects

The SOX Act can achieve other goals, such as financial or operational goals and compliance goals, and create spillover effects through an improved information environment or spillover effects that affect different investors’ goals and the enterprise’s sustainability. For example, there is a large body of literature on whether the implementation of the SOX Act effectively enhances and protects the interests of small- and medium-sized investors in the capital markets, as well as on the impact of the SOX Act on the cost of capital and on the reactions of other stakeholders.

From an auditor’s perspective, ref. [85] find a significant increase in the mean and median audit fees before and after implementing SOX 404, with significantly higher fees for enterprises with than those without internal control deficiencies. However, audit fees do not differ significantly with the enterprise’s type of internal control deficiency. These findings suggest that auditors make an effort to implement the SOX Act. Meanwhile, ref. [86] examine the correlation between the disclosure of internal control deficiencies and auditor fees. They find that auditors can mitigate the inspection risk by increasing substantive testing when control risk rises. For clients who subsequently issue internal control deficiencies, the enterprise does not expend more effort, and therefore audit fees increase significantly after enterprises disclose internal control deficiencies.

From a market perspective, small- and medium-sized investors’ evaluations of the SOX Act after its implementation provide evidence of its positive impact. Ref. [87] find a significantly negative market reaction when a permanent exemption from SOX 404 was announced for small enterprises, suggesting that auditors value the market for internal control audits, thus indirectly demonstrating the positive effect of the SOX Act. Ref. [21] find that after disclosing information, the stock prices of enterprises with deficiencies in internal control fall, as do those of other enterprises in the same industry. Ref. [20] find in examining the capital market that enterprises that disclose the existence of internal control deficiencies have poorer market performance and lower investor evaluations after implementing the SOX Act.

The literature assesses whether the SOX Act protects other stakeholders through financial costs and positively affects enterprise sustainability. Refs. [88,89] find that internal control deficiencies increase the equity cost of enterprises. These findings suggest that internal control deficiencies lead to concerns among small- and medium-sized shareholders about enterprise risks and the protection of their legitimate rights and interests, which implies that the SOX Act’s requirements for the establishment and improvement of internal control have a positive effect on small- and medium-sized investors. Ref. [90] suggest that deficiencies in internal controls result in lenders being less inclined to trust financial information when entering into terms, thus relying less on financial information and more on non-financial information terms to constrain and monitor capital borrowers. Refs. [91,92] find that banks demand higher interest rates from borrowing enterprises when internal controls are deficient. These findings suggest that creditors are receptive to enterprises with better internal controls, illustrating the SOX Act’s positive effect on the protection of creditors.

3.2.2. Negative Consequences

The discussion of the negative impact of internal controls on enterprise sustainability is mainly based on the market efficiency hypothesis. However, much of the literature shows that the high compliance costs and legal liabilities of the SOX Act can be costly to enterprises. At the same time, using existing resources to bear high costs and social responsibility further reduces the level of enterprise risk-taking. As a result, it discourages various investors, which is detrimental to the long-term development of enterprises.

(1)

Negative evidence of the SOX Act and high compliance costs

The SOX Act includes many requirements requiring enterprise executives to disclose more detailed financial information and establishing a sound and effective internal control system. Legal compliance costs are particularly high for smaller enterprises and enterprises with high agency costs. Small enterprises with relatively simple operations can incur significant cost burdens when they strictly comply with the SOX Act and re-establish good internal controls [93]. As a result, their survival may be seriously threatened. Ref. [93] find that after the announcement of privatization earnings for small enterprises, the market is favorable towards privatizing these enterprises, suggesting that the cost–benefit ratio of the SOX Act is inappropriate for small enterprises. Ref. [100] finds that the SOX Act damages SMEs values, implying that external legal compliance is costly and uneconomical for small enterprises. Ref. [22] finds that the increase in audit fees after the SOX Act’s implementation is much larger than the increase in accrual quality. In addition, stock prices increase significantly when small enterprises defer and waive the SOX 404. Therefore, non-compliance with the SOX Act is a favorable choice for small enterprises’ value and their shareholders’ equity, thus contributing to the sustainable development of the enterprise.

In addition, enterprises with high agency costs that strictly enforce the SOX Act bear the challenge of external investors and strict scrutiny from regulators, damaging the enterprise’s value or de-listing. Ref. [101] finds that more foreign private issuers (FPIs) de-list after implementing the SOX Act. The returns are negative for enterprises which announce de-listing before adopting the SOX Act and positive after its adoption, with a highly significant difference. Such enterprises’ fundamentals experience a significant improvement after their privatization. The evidence mentioned above indicates that the SOX Act’s implementation causes adverse effects on enterprise operations for cross-listed FPIs. Many studies in the literature support the view that the SOX Act reduces the attractiveness of enterprises to the US capital market, with listed enterprises undertaking privatization to avoid the Act. For example, ref. [23] point out that enterprises choose to avoid SOX Act regulation by de-listing into the capital market purely to achieve two objectives. First, such enterprises’ poor fundamentals make it difficult to withstand the huge cost pressure brought by the SOX Act. Second, such enterprises face more scrutiny after the SOX Act, and reduce information transparency by de-listing into the capital market in order to avoid the risk of scrutiny and litigation and thereby maximize their interests. The post-SOX Act period leads many enterprises with poorer fundamentals or higher agency costs to go private or enter the capital market in order to avoid the impact of the SOX Act and seek sustainable development.

(2)

Negative evidence of the SOX Act and legal liability

The SOX Act increases the liability of enterprise management, such as the requirement to seek recovery of property proceeds from misleading statements and the requirement to disclose insider trading information for less than two days. Violations can result in large fines and up to 20 years in prison. For legal reasons, enterprise management may undertake more short-sighted actions, such as risky and innovative investments and negative enterprise value. Implementing these measures makes the enterprise think only about immediate benefits and not about its sustainable development. Ref. [24] find that the SOX Act leads to lower CEO incentives, lower willingness of enterprises to take risks, and lower levels of investment, suggesting that the Act is detrimental to enterprise innovation and long-term growth. Ref. [25] argue that at least two aspects of post-SOX Act regulations significantly constrain enterprise risk-taking and innovation. They find that US enterprises affected by the SOX Act are less willing to engage in risky investment, and have a significantly lower willingness to take risks compared to other countries at around the same time. Ref. [94] finds that certain enterprises obtain exemptions from the SOX Act by reducing investments, paying more dividends to shareholders, reducing the shareholding of non-affiliates in their shares, disclosing more bad news, and reporting lower earnings to circumvent the SOX Act. Ref. [102] find that CEOs and CFOs face a higher probability of being rotated out due to violations of laws and regulations after the SOX Act’s implementation. The implementation of the SOX Act put tremendous pressure on enterprises’ management and constrained their sustainable development.

Extensive evidence suggests that the SOX Act leads to a loss of enterprise wealth rather than increased enterprise wealth. Ref. [103] finds that US capital market-listed enterprises reacted in a significantly negative way around significant points in time associated with the SOX Act, suggesting that the capital market does not view the SOX Act favorably. Ref. [104] finds that enterprises subject to the SOX Act experienced a significant decline in stock prices before and after the passage of the SOX Act compared to enterprises not affected by it. Ref. [29] find that the SOX Act does not improve the quality of accounting information for bondholders, and reduces bondholders’ value. This finding suggests that the SOX Act is significantly and negatively associated with the sustainability of both bondholders and enterprises.

3.3. Analysis at Different Country Levels

The SOX Act originates from the US implementation of a mandatory internal control audit system. However, the legislation in practice and the empirical evidence from academia show that the SOX Act has created a huge controversy regarding enterprise sustainability. Therefore, it is worth considering the future of the SOX Act and what it means for the sustainable development of Chinese enterprises. Based on this, the present study summarizes and examines the impact of the SOX Act on enterprise sustainability in various countries through on a literature review.

3.3.1. The Impact of Internal Controls in the SOX Act Framework on the Sustainable Development of U.S. Enterprises

Ref. [105] note that anti-SOX interests have taken several strategic actions to reshape the SOX Act, including the appointment of an enterprise-friendly SEC chair, threats to block SEC funding allocations, and several other strategic activities to effectively leverage its positive effects on enterprise sustainability and minimize or avoid negative impacts. In addition, the PCAOB has expressed concern about the declining disclosure of internal control deficiencies over the years due to continued delays in compliance with mandatory internal control audits by small enterprises before the permanent exemption and the replacement of AS2 by AS5 for internal control audits.

Meanwhile, ref. [28] find that the quality inspections imposed by the PCAOB on auditor enterprises lead to a significant increase in auditor enterprises’ post hoc audits. The empirical evidence is consistent with [105] assertion that financial scandals drive the SOX Act to reduce public outrage. Yet, financial fraud and insider trading in “repeated violations of the US securities laws” lead accounting historians to argue that many of these laws are symbolic and ineffective. The SOX Act may have been weakened after the emergency relief of investor fear and anger. On the other hand, the transient nature of inspections by the relevant regulators may have led to a significant improvement in the quality of internal controls of the regulated enterprises.

An important question is whether internal control audits and disclosure need to be enforced in the form of legislation. For example, ref. [106] imply that although hedge funds are not subject to the SOX Act’s internal mandatory control audits, enterprises with higher ex ante agency costs, such as in places with poor offshore investor protection, managers actively seek internal control audits for institutional investors. This implication suggests that internal control audits as a governance mechanism to reduce agency costs are not externally imposed, and are rather the result of market demand. Conversely, enterprises that opt for privatization or de-listing tend to be small or fundamentally poor [22,23]. Thus, the US SOX Act responds to the market demand of large enterprises and enterprises with good fundamentals, which is positive for their sustainable development, while burdening SMEs and enterprises with poor fundamentals, which is not conducive to their sustainable development.

3.3.2. The Impact of Internal Control on the Sustainable Development of Chinese Enterprises under the SOX Act Framework

This subsection compares the economic consequences of China’s SOX Act in four dimensions: purpose and background, institutional provisions, theoretical evolution, and empirical investigation.

In terms of the purpose and background of the legislation, unlike in the US, internal controls in China are not implemented to prevent financial fraud in listed enterprises, but instead to better serve sustainable development. China’s capital market was established just over thirty years ago. It has rapidly grown from eight listed enterprises with a market capitalization of about USD 2.4 billion in 1990 to over 4000 listed enterprises with a total market capitalization of over USD 70 trillion in 2020. As a result, enterprises are becoming larger. Their business is becoming more complex. They urgently need a standardized system to control risks. In particular, the failure of many large SOEs to operate globally has led the Chinese government to consider introducing internal controls to reduce risk and develop a “Chinese-style Sarbanes–Oxley Act” to protect the sustainable development of enterprises and of the whole society and economy.

The Singapore CNA bankruptcy case is a typical case triggered by the lack of internal control. Founded in 1993, CNOOC Singapore is an overseas subsidiary of a large state-owned enterprise directly under the Central Government. In 2001, CNOOC Singapore was listed on the Singapore Exchange, becoming the first Chinese-owned enterprise to use its assets to list abroad. From a trading enterprise on the verge of bankruptcy, CNOOC Singapore developed into a combined industry and trade entity, expanding its business from a single purchase of imported jet fuel to international oil trading, growing its net assets from USD 219,000 in 1997 to over USD 100 million in 2003. However, in 2006, the president of CNOOC Singapore violated the law by trading high-risk oil options, resulting in serious losses and the eventual bankruptcy of the enterprise. The cause was a lack of internal control in the enterprise. The manager conducted high-risk business irregularities according to his wishes rather than following strict procedures, which ultimately led to the failure of the business.

In terms of the institution, the Chinese version of the SOX Act is less strict than the US and more flexible. The introduction of the SOX Act in China was marked in June 2008 by the Ministry of Finance, the Securities Regulatory Commission, the Audit Office, the Banking Regulatory Commission, and the Insurance Regulatory Commission, which jointly issued the “Basic Standard for Enterprise Internal Control” requiring the disclosure of internal control information by the above enterprises. In 2012, listed enterprises were formally required to implement a mandatory internal control audit system. Despite the short time that the this version of the SOX Act has been in force, there has been a great deal of research and discussion on topics related to internal control auditing and sustainability. However, the theoretical framework of internal control continues to be based primarily on an information economics perspective that explores the economic consequences of internal control. Related empirical studies focus on the positive effects of internal control, such as the information environment, spillover effects, and derivation effects. However, almost all studies show that improving the quality of internal control increases the positive impact of sustainable business growth. There is little empirical literature examining the negative effects of internal controls.

However, the Chinese version of the SOX Act is more flexible in its practical operation. For example, in practice, CPAs in China often carry out internal control audits during the auditing of financial reports, known as “integrated audits”, in order to reduce costs. In contrast, the US version states that audits of financial reporting and internal control reports cannot be performed as an integrated audit, and need to be completed by different auditors. In addition, in terms of audit scope CPAs need to focus on the effectiveness of internal control over financial and non-financial reporting, unlike in the US, where the emphasis is on the former.

In terms of theoretical evolution, there have been two major changes in studying the economic consequences of internal control in China. The first was in 2008, when empirical studies on the economic consequences of internal controls began to emerge. The reason for this is that in 2008, the Chinese government began to promote the construction of an internal control system by drawing on the COSO framework, which has sparked theoretical concerns. However, the disclosure of internal control information of listed enterprises was not fully implemented then, and the empirical data were mainly based on the information voluntarily disclosed by listed enterprises. The second time was in 2013, when research on internal control in China shifted from normative to empirical studies. As a result, 2013 is the second year of full implementation of internal control audits and disclosure for listed enterprises in China, for which access to data has now become easy. At this time, research on the economic consequences of internal control in China has shifted from a mainly normative to empirical research, and empirical research has become the main stream of research focus in China.

There are several distinctive features of domestic empirical studies on internal control. First, the research paradigm follows the US empirical research idea. The theoretical framework of internal control continues to be based primarily on an information economics perspective that explores the economic consequences of internal control. Second, while the empirical content framework is the same as that in the United States, the empirical findings are biased toward positive consequences. Related empirical studies focus on the positive effects of internal control, such as the information environment, spillover effects, and derived effects. However, almost all studies show that improving the quality of internal control increases the positive impact of sustainable enterprise growth. There is little empirical literature examining the negative effects of internal controls, as shown in Figure 4. A possible explanation is that China has become more flexible in its legal provisions and specific practices to reduce enterprise compliance costs, such as consolidation of audits and exemptions for SMEs, after taking into account the delayed or exempted implementation of the system in the US for this reason. The difficulty of directly estimating compliance costs is another possible reason. Third, more studies have been conducted in the context of local characteristics in China, such as how ownership attributes affect the role of internal control [107] and exploring the role of internal control in the context of policy and regulatory enactments [108].

• Positive evidence of the SOX Act’s impact on the information environment

Ref. [109] find that internal control can eliminate earning-management practices in financially distressed enterprises, significantly improving sustainability. Ref. [14] examine changes in the quality of enterprise financial information before and after the mandatory implementation of China’s internal control audit and information disclosure system. They find that enterprises’ financial information quality significantly improves after implementing the Chinese SOX Act. Consistent with this, ref. [110] find that Chinese listed enterprises began implementing internal control audits on a trial basis in 2007. The audit quality of enterprises that voluntarily implemented and disclosed internal control audits was significantly better than in the previous year.

2.

Positive evidence of SOX derivation effects

Ref. [111] find that high-quality internal control can improve stock liquidity in the capital market. For internal enterprise management, ref. [112] find that internal control can effectively implement the time budget, although ex ante moral hazard increases the possibility of budget slack. Ref. [17] find that internal controls effectively reduce redundant cash holdings or cash holding shortages, increasing the value of cash holdings. Ref. [113] find that poor internal control exacerbates overinvestment and underinvestment in investment and financing. Finally, ref. [114] find that internal control can significantly increase enterprise value. Various studies provide the positive impact of derivation effects on enterprise sustainability.

3.

Positive evidence of SOX spillover effects

The quality of internal controls affects the decisions of stakeholders such as bondholders, suppliers, and auditors, and thus the level of enterprise sustainability. Ref. [115] find that the more effective the internal control, the higher the quality of commercial credit liabilities and assets and the larger the size of commercial credit funding. These results suggest that a higher quality of internal control makes it easier to gain the trust of suppliers and obtain more high-quality credit funding. Ref. [116] find a significant positive association between internal control deficiencies and debt financing costs. Their results indicate that enterprises with poor internal control quality trigger concern among debt holders, increasing the borrowing interest rate. From a litigation perspective, ref. [117] find that the internal controls of offending enterprises are more likely to be deficient and to have higher audit fees. This suggests that internal control deficiencies affect auditors’ perception of risk.

3.3.3. The Impact of Internal Control under the SOX Act Framework on the Sustainable Development of Enterprises in Other Countries

The Japanese version of the SOX Act (J-SOX) was designed to prevent the growing number of financial fraud scandals, such as the Liverdoor and Seibu Railway scandals that occurred in Japan around 2000. In 2005, the Business Accounting Council in Japan began to explore ways to improve the quality of corporate financial reporting in Japan by drawing on the SOX Act.

The Japanese version of the SOX Act has the following characteristics in its theoretical construction, judicial practice, and findings of empirical studies. First, from the perspective of internal control framework theory, Japan advocates for comprehensive internal control, including non-financial internal control under the COSO framework. Second, judicial practice of internal control has significantly reduced the legal liability of auditors in Japan by focusing their responsibility on the effectiveness of internal control over financial reporting and by making them responsible only for the effectiveness of internal control as declared by management, rather than directly for the effectiveness of internal control audits. Third, the findings of the empirical study assert the positive consequences of internal control. For example, the enactment of the Japanese SOX Act was able to improve information quality and correct discontinuity in the distribution of profits due to corporate manipulation of accounting earnings [118], with spillover effects such as lower investor evaluations of enterprises with internal control deficiencies [119] This is mainly because Japanese law allows management to establish a system of internal controls commensurate with its affordability, and does not bring about problems such as high implementation costs and the flight of foreign capital which occurred due to the implementation of SOX in the United States.

Other countries, such as the UK, Germany, and Canada, have different regulations concerning the internal control framework, the scope of responsibilities of the CPA, and the scope of internal controls of concern.

Table 3. Comparison of SOX studies among countries.

Country	Theoretical Framework and Scope	Scope of Responsibility of CPA	Scope of Practice	Empirical Findings
United States	A comprehensive internal control framework system under the COSO Committee	Audit and express an opinion on the effectiveness of management’s statement and audit and express an opinion on the effectiveness of internal control over financial reporting.	Internal Control over Financial Reporting	Positive and negative effects are combined [57,58]
China	Based on the comprehensive internal control framework system under the COSO Committee	An audit opinion on the effectiveness of the company’s internal control over overall reporting.	Comprehensive Internal Control	Positive impact [17,112]
Japan	Based on the comprehensive internal control framework system defined by the COSO Committee	The CPA is required to express an audit opinion only on the validity of the management’s statement, and is not permitted to express a separate audit opinion.	Internal Control over Financial Reporting	Positive impact [118,119]
United Kingdom	A comprehensive internal control framework system under the Turnbull Standard	Requires only a statement from the board of directors that it is responsible for the effectiveness of internal controls.	Internal Control over Financial Reporting	Positive Impact
Germany	Based on the comprehensive internal control framework system under the COSO standard	The audit opinion on the effectiveness of internal control must be provided to the supervisory board.	Comprehensive Internal Control	Positive effects [87]
Canada	A comprehensive internal control framework system under the integration of COSO and COCO standards	No CPA audit required.	Internal Control over Financial Reporting	Positive Impact

presents the theoretical, practical, and empirical findings on SOX-based systems in the countries concerned. These compendiums further our understanding of the lineage of internal control theory and practice in various countries.

4. Discussion

The results of this study are analyzed here in three main aspects. The first aspect includes 31 papers that analyze the determinants of sustainability, mainly in enterprise characteristics, managerial characteristics, social responsiveness, environmental responsiveness, and external effects. The second aspect includes 53 papers that analyze the economic consequences of internal control on sustainability under the SOX Act framework, mainly in financial information quality, governance decisions, earnings manipulation, other stakeholders, compliance costs, and social responsiveness costs. The final aspect is an exploration of the impact of internal controls on enterprise sustainability in different countries under the SOX Act framework, focusing on the specific cases of the United States and China, followed by Japan, the United Kingdom, Germany, and Canada.

The concept of enterprise sustainability originated from the TBL concept proposed by [120]. Subsequently, studies investigating the factors influencing enterprise sustainability and the economic consequences of internal control have invariably built interconnected bridges. The results of this review show that many studies have examined the effects of enterprise characteristics, internal governance, social responsiveness, and environmental policies on enterprise sustainability through survey studies [7,26,27]. Based on these influencing factors as well as the economic consequences of internal control of the enterprise, there are conflicting results in the relationship between sustainable enterprise development of and internal control. On the one hand, the SOX Act positively improves audit quality, decreases financial scandals, and reduces internal agency problems [28]. However, on the other hand, many studies argue that the creation of the SOX Act has greatly reduced enterprise wealth by increasing enterprise compliance costs and the risk of lawsuits, reduced bondholders’ bond values, and recognized the need for anti-SOX Act interest groups [29].

This study’s results show a significant association between enterprises’ internal control and sustainable development. For most countries, internal control positively effects enterprises’ sustainability by influencing the information environment and its derived and spillover effects. While this is consistent with the findings of [19,84], this issue deserves deeper attention.

In addition, findings gathered from Web of Science reveal that studies were conducted across different geographical locations, both in a developing-economies setting and in developed institutional environments. Few studies provide comparisons across countries. For example, ref. [121] identify the strategic factors and operational objectives of sustainable development by investigating the definition, characteristics, and current status of sustainable development indicators in Eastern European countries. Ref. [122] review the energy efficiency and sustainability performance of about 500 small and medium-sized enterprises (SMEs) in Austria, the Czech Republic, Hungary, Italy, and Slovenia. Finally, [123] aim to review selected transitioning countries: Croatia, Slovenia, Serbia, and Bosnia and Herzegovina.

Develop current practices and trends in internal controls and provide practical implications for developing its human resources, legislative framework, and funding system. Ref. [124] examine the impact of performance in enterprise sustainability-related practices and internal controls on the economic performance of SMEs using a sample of 119 UK, French, and Indian SMEs. However, these studies do not provide detailed information on how enterprises in these countries compare regarding sustainability performance. Considering the few comparative studies at the country level, this study explores the specific impact of internal controls on enterprise sustainability under the SOX Act framework in different types of countries, including the largest developed country, the United States, and the largest developing country, China, as well as Japan, the United Kingdom, Germany, and Canada.

Finally, the methodological analysis in this study reveals that the data analysis focused on questionnaires, empirical studies, case studies, conceptual reviews, normative studies, and a mixture of methods. Among the various approaches, case studies and empirical research have an advantage, mainly because case-oriented research is valuable for dealing with uncertainty and unique situations in complex enterprise contexts and requires a very small sample size. However, while empirical research oriented toward large sample processing is used by a wide range of researchers because of its easier access to secondary data and its structured form, this creates a problem that makes the theoretical framework in this research area more akin to theoretical insights in empirical research or experimental findings in case studies, lacking a clear theoretical framework to support them. More research with theoretical contributions is thus needed to enrich the theoretical framework of this research area.

The findings in this study reveal the three main aspects. First, in recent years the issue of enterprise sustainability has received increasing attention from studies, and there is a significant association between enterprise internal control and sustainable development. Second, internal control based on the SOX Act framework has a positive effect on the sustainable development of enterprises, mainly through improved information quality and derived, and spillover effects. However, it has a negative impact on enterprise sustainability as well, mainly through increased compliance costs and legal liabilities. Third, while the SOX Act has been implemented with varying degrees of effectiveness in different countries, the impact on enterprise sustainability is generally positive.

Interest in enterprise sustainability and internal control in Web of Science-indexed journals has been growing since 2016, with a significant percentage of the literature indirectly bridging the link between the two in different ways. Overall, this study’s findings suggest that previous enterprise sustainability studies have received limited attention in the literature. However, this study provides evidence of major limitations and gaps as well, which can aid in determining future research directions. As is evident from the lack of development of the above literature, several of the issues for further reflection include the lack of a more in-depth communication between enterprise sustainability and internal control, the lack of diversity in research methods leading to a lack of clear theoretical framework studies, and the relative lack of comparative studies between different countries.

This study’s findings contribute to the SOX Act framework for enterprise internal control and sustainability, identify several under-explored or lacking issues, and offer several contributions to further developing the literature. Considering the importance of enterprise in managing limited global environmental and social resources and advancing sustainable development goals, more research on enterprise sustainability is critical. The analysis in this study provides insights for academics, practitioners, and policymakers to help enterprises engage in sustainability-related practices by adapting their internal control efforts. At the same time, this study has identified several limitations and opportunities for further research that could assist management studies.

The results obtained in this study fully validate our main idea that there is a strong association between internal control and sustainable development and that the SOX Act plays a role in this. Based on this, in addition to following the development of international research, adopting diversified research methods, and enhancing cross-country comparative studies, national studies can expand the exploration of national experiences and the improvement of theories in the following aspects.

First, the relationship between internal control and sustainable development of enterprises needs to be studied in greater depth. For example, additional attention can be paid to the intersection of enterprise behavior and issues such as social sustainability, social construction, and social quality. The generally accepted concept of sustainable development includes three dimensions: economic, social, and environmental. However, most empirical studies on enterprise sustainability practices only deal with the environmental (environmental policies and energy efficiency) or economic (enterprise characteristics and performance levels) aspects, and rarely consider all aspects of sustainable development. Moreover, despite the significant contribution that many enterprise actions make in maintaining social stability, there is very limited research that deals specifically with social aspects. Therefore, future research should focus on the intersection of enterprise behavior in management with social sustainability, social construction, and social quality in sociology, as well as comparative research on the differences between different social systems, in order to facilitate cross-fertilization among countries.

Second, the theoretical framework of internal control and sustainable development should be further clarified. Therefore, future researchers should utilize the four core points of overall internal organizational characteristics, semi-structured sustainability model, empowering social responsibility infrastructure, and competing for balance to deepen the study of sustainable development systems under enterprise internal control, whereby the theoretical framework of this research area can be further investigated and expanded. However, as the boundaries of the current theoretical framework are difficult to define, study design requires more subjective judgment, combining qualitative and quantitative methods to set the study boundaries. The theoretical framework can be expanded by understanding the specific results of enterprise sustainability and then extrapolating the specific parameters of internal control through expert interviews (experts, managers, and media reporters) in order to enhance the dynamics of internal control.

Third, a more detailed international comparison is essential to further understanding of the relationship between enterprise internal controls and sustainable development. The dimensions of comparison can involve comparisons between developed countries, comparisons between developing countries, comparisons between developed and developing countries, and comparisons between different social systems. For example, developing the SOX Act as an imported product in various countries raises problems that must be solved. In addition, combining it with sustainable development raises new theoretical and practical issues. Exposure to differentiation allows for better “local adaptation” and more accurate practical advice for different economies.

At the same time, this review may have limitations in all four of these aspects. For example, the choice of keywords may have resulted in the exclusion of specific studies that were eligible without explicitly linking them to the broader issue of internal control and sustainability. Further research could extend the search and analysis of keywords to include such research areas as social responsibility, tax behavior, and enterprise culture in order to provide insights into specific topics, which could help enrich the collected literature. Second, this study only reviewed papers published in English. Manuscripts written in other languages (e.g., Chinese, French, German) and published in scholarly journals may be an important addition to the literature. Future research could review the literature published in other languages.

Fourth, this study only selected searchable papers in the database, and did not include books and journals distributed in paper versions. These may contain newer research questions and results that could be included in future studies to broaden the scope of the search. Fourth, the sample in this study consists of papers published between 2006 and 2021. Future studies could compare periods using specific events as a breakpoint. Examples include the subprime mortgage crisis in 2008 and the COVID-19 pandemic in 2020. Future studies could analyze whether such unprecedented and disruptive events have increased interest in academic research on enterprise internal controls and sustainability.