China SOX: What's New?

Since the Basic Standard for Enterprise Internal Control (“China SOX” or “C-SOX”) was announced in China with in the summer of 2008, there have been several changes to its scope and timing.   While the full details of this internal control and corporate governance regulation have not yet been published, I have picked up on some of the changes to the scope and roll-out schedule.  Here is a quick analysis to help companies and China watchers understand C-SOX news.

Who will China SOX impact?

The Basic Standard for Enterprise Internal Control was originally targeted at domestically-listed Chinese companies.  There are about 900 companies listed on the Shanghai Stock Exchange and about 700 listed on the Shenzhen Stock Exchange.  The China SOX regulation was intended to impose stricter corporate governance, risk management and internal control standards on those companies.  However, the Ministry of Finance realized that many of these firms simply did not have the infrastructure or resources to effectively implement the changes that the government wanted.

As a result, the regulation was pointed at a smaller, easier target: overseas listed firms.  These are large, well-run companies that list their shares in Hong Kong, New York or London, and are already compliant with stricter regulations (such as the US’s Sarbanes-Oxley law).  Since these companies already have the people, processes and systems required by these external markets, the government figured it would be more straightforward for them to implement China SOX.

Another recent addition to the China SOX universe are China’s state-owned enterprises (SOEs).  These are mostly very large organizations under state control and include many of the best known companies in China.  While C-SOX was originally intended to be “optional” for private firms, the Ministry of Finance is now targeting the largest SOEs (namely the 150 ones controlled by China’s SASAC, or State-owned Assets Supervision and Administration Commission) among the first wave of companies that must comply.  These are large organizations with the management skills and resources required to effectively implement the controls that China SOX demands.

But these are mostly issues of timing.  The Basic Standard for Enterprise Internal Control will eventually be required for all listed Chinese companies.  Companies that comply with China SOX will be rewarded by the market with lower costs of capital and higher valuations.

What areas of Business will be affected by China SOX?

Internal controls are the focus of China SOX, which means that companies must define their controls and implement systems to manage them.  While the C-SOX regulation is intended to cover all areas of a Chinese company’s operations, there have been some modifications to this requirement.  For example, the first priority for China SOX is the safeguarding of financial assets, so much emphasis is placed on financial risk management and controls.  Corporate governance and  operational risk management, while still important, are not top priority.

What’s not Changing?

Risk management is still high on the business agenda in China and companies are eager to improve their business systems and internal controls.  China SOX still mandates that companies make effective use of IT in their compliance strategies and that they hire outside advisors to work with them and audit the effectiveness of their internal controls.  In addition, management teams are being made more accountable for their risk management and internal control implementation.

Tighter government control of disclosure, risk management and corporate governance is a “one way street” meaning that the regulations are only getting tighter.  Companies that invest now in complying with China SOX will gain substantial business rewards.