Internal control (IC) disclosure in corporate financial reporting is of considerable interest to both the academic and business communities, particularly following the passing of the Sarbanes-Oxley Act (SOX). Nevertheless, few studies have examined the management incentives of IC reporting. According to Leone (2007), this is partly because most prior research has been conducted in an environment of mandated IC disclosure, not voluntary IC disclosure. There are some exceptions. Bronson et al. (2006) examine the association between firm characteristics and voluntary IC disclosure. Deumes and Knechel (2008) do examine incentives for voluntary IC disclosure. Lin and Rao (2009) study the determinants of disclosing an auditor’s attestation of an IC report using only one year (2007) data. Fang et al. (2009) also discuss IC disclosure but without discussing the IC self-assessment report and the auditor’s attestation. Using a unique dataset from the Shanghai Stock Exchange (SSE) during the period 2006–۲۰۱۰, we examine not only why firms would choose voluntarily to disclose their IC self-assessment reports, but also why some of these firms prefer, in addition, to have an auditor’s attestation on these reports, a new aspect of the literature. Owing to the fact that no IC weakness/deficiency is reported in their voluntary IC disclosure samples, all the previous authors do not address the identification problem; that is, whether independent variables explain the presence/absence of IC weakness, or the presence/absence of disclosure, or both. With Chinese data, we can identify firms with IC weaknesses and therefore better examine the incentives and determinants of voluntary IC reporting and the option of including an auditor’s attestation on the report. This also distinguishes our study from the existing literature. The SSE required its listed firms to establish an IC system and disclose an IC report as of 2006. However, firm management has full discretion in releasing IC information due to the lack of minimum requirements. For example, some firms report their ICs very briefly, with a statement such as “The IC system generally met the 2006 guidelines,” whereas others provide detailed explanations of specific risk management, such as management control over subsidiaries, accounts receivable, accounts payable, etc. Some even provide an IC self-assessment with an external auditor’s attestation in the report. During our sample period, about 17.3% of SSE-listed firms voluntarily disclosed self-assessments with an auditor’s attestation and 12.7% only disclosed self-assessments in their IC reports.