1. Introduction

Vietnamese commercial banks have had a remarkable development in recent years, becoming an important source of capital for the fast-growing economy and deep integration with the world. However, in the context of increasing uncertainty in the domestic and international economy, a healthy and sustainable banking system is always an important goal and using resources effectively as well (Dao & Le, 2012; Margono et al. 2020). To do that, banks need to do well in risk management, especially credit risk, and have a close supervision by state regulators (Akwaa-Sekyi & Gené, 2016). Therefore, an effective internal control system, complying with international standards should be implemented in a synchronous and serious manner that can help banks manage risks, including credit risk, and thus, fostering banks to reach the regional market as well as all over the world (Napitupulu et al., 2020).

In this study, the COSO framework (2013), with five ingredients was applied. The COSO framework (2013) is also applied by many previous researchers in their works, both in Vietnam and other countries, such as Asiligwa and Rennox (2017), Akwaa-Sekyi and Gené (2016 & 2017), Koutoupis and Malisiovas (2019), and Nguyen (2017). These studies use primary and secondary data to explore the impact of five components in the COSO framework (2013) on credit risk of commercial banks. All previous studies applied traditional statistics, which is currently criticized by many due to unreliable results in many cases (Briggs & Nguyen, 2019; Anh et al., 2018; Kreinovich et al., 2019). In this study, we apply Bayesian method to analyze the result, which is the novelty of our study. The findings of this study suggest important implications for bank management and for policymakers in Vietnam and emerging economies as well.

The paper is structured as follows. The next section reviews the relevant literature. Section 3 deals with data sources and methodology. Section 4 describes the results of the study and discussion. The last section concludes the paper and suggests policy implications.

2. Literature Review

Research on the relationship between internal control and credit risk of commercial banks is based on Agency theory. In a release in 1976, Jensen and Meckling introduced the Agency theory to explain the relationship between the principal and the agent. This theory was developed on the basis of previous research on psychology, that is, people always have individual tendencies, opportunity, and self-interest. However, the important issue is how to reconcile the interests of individuals to achieve the highest benefit together. Jensen and Meckling (1976) argue that conflict will arise when there is inadequate and disproportionate information between the principal and the agent. Both of them have different, even conflicting interests, and this problem is minimized by using appropriate mechanisms to limit the differentiation of interests between them, by the establishment of appropriate remuneration mechanisms for managers, and establishing an effective monitoring mechanism to limit abnormal behavior and selfinterest of authorized persons (i.e., company managers).

Agency theory explains why the internal control system must be applied to provide information to ensure benefits for investors and stockholders. Especially in the context of Vietnam, when there has not been a fully developed stock market, and thus, the accurate and complete information of internal control provided is really meaningful to investors. Agency theory is also the basis for building internal banking reports, assessment reports that are consistent with the decentralized system in Vietnam’s commercial banks today. In the operations of commercial banks, credit plays a very important role, being the backbone of the entire operation of the bank, contributing mainly to the bank’s revenue and profit. Therefore, controlling risks well in credit activities is an indispensable and compulsory requirement for all banks. To do that, it is necessary to build an effective internal control system, to help prevent and detect risks that may occur in credit activities, to achieve the targets that shareholders have set for the bank managers and employees.

2.1. The COSO’s Internal Control Framework

In 1992, the COSO committee, a committee of the United States National Council to combat fraud in financial statements, commonly known as the Treadway Committee, introduced the definition of internal control through the release of the consolidated internal audit framework–COSO report 1992. The COSO 1992 report is the first document in the world to provide a complete and systematic theoretical framework for internal control. COSO (1992) defines that internal control is a process influenced by actors such as the board of directors and relevant people, designed to provide reasonable assurance to achieve effectiveness, operational efficiency, reliable financial reporting, compliance and applicable with laws and regulations.

In response to the changing business environment in the new situation, especially since the introduction of the Sarbanes-Oxley Act in 2002, the COSO commission issued a new report in 2013. According to COSO (2013), there are five main components of internal control activities, namely, control environment, risk assessment, control activities, information and communication, and monitoring activities. Therefore, when setting up and operating an internal control system, businesses and banks need to pay attention to these five components, and at the same time pay attention to the impact of these components on the control effectiveness to achieve the highest efficiency.

In Vietnam, there are many different views on the internal control system due to different requirements and perspectives. According to Vietnamese Auditing Standard No. 315, internal control is a process designed, implemented and maintained by management and other individuals in the entity to create a reasonable assurance of the ability to achieve the goal and to ensure the reliability of financial statements, ensuring efficiency, performance, compliance with relevant laws and regulations. Meanwhile, as per the Accounting Law (2015), internal control is the establishment and implementation within the accounting internal mechanisms, of policies, processes and regulations in accordance with the law to ensure risk prevention, detection and timely treatment and meet set requirements.

In the banking sector, Circular No. 44/2011/TT-NHNN of The State Bank of Vietnam regulates the internal control system and internal audit of credit institutions, and foreign bank branches. According to the content of this circular, the internal control system is a collection of mechanisms, policies, processes, internal regulations and organizational structure of the unit that are built and implemented to ensure prevention, promptly detecting and handling risks and meeting requirements previous set.

The above definitions show that there are similar views on the internal control from COSO (2013), Vietnam Auditing Standard No. 315 (2012), Accounting Law (2015), and Circular No. 44/2011/TT- NHNN (2011). In the scope of the study, the author agreed on the point of view on internal control of COSO (2013), because this definition is widely accepted in practice and applied by many prestigious companies in the world such as Basel (2010) or related studies. This is also the basis for the author to build the research model.

2.2. Empirical Studies

Asiligwa and Rennox (2017) evaluated the impact of internal control on the financial performance of commercial banks in Kenya. Based on the primary data set of 43 commercial banks in Kenya, research results show that commercial banks achieve good financial efficiency if implementing and maintaining the internal control system including five elements of COSO (2013).

Koutoupis and Malisiovas (2019) investigated the impact of internal control on credit risk, profitability, and compliance with the banking system in the US. Based on a sample of 210 largest commercial banks in the US from 2013 to 2017, the research results show that there are four components of COSO (2013) that affect credit risk, including the control environment, control activities, information and communication, and monitoring activities.

Akwaa-Sekyi and Gené (2016) studied the impact of internal control on credit risk of commercial banks in Spain from 2004 to 2013. Research results show that internal control factors have strong impact on credit risk, including control environment, control activities, risk assessment, monitoring activities. Subsequently, in a similar study but expanded to European banks, Akwaa-Sekyi and Gené (2017) found that internal control has a significant impact on credit risk, with specific variables including risk assessment, return on assets, organizational ownership, bank size, inflation, interest rates, GDP growth.

According to the author’s assessment, up to the present time, in Vietnam, there are only a few studies on the impact of internal control on risks in banking operations. For example, Nguyen and Duong (2017) investigate the effects of internal control on operational efficiency and bankruptcy risk at 32 Vietnamese commercial banks in the period 2013-2015 using quantitative methods. The study uses primary data sets. It shows that some constituent parts of internal control affect the operational efficiency and bankruptcy risk of commercial banks in Vietnam. Nguyen (2017) investigates the relationship between internal control and credit risk of state-owned commercial banks in Vietnam for the period 2005-2016. The author uses the secondary data set with the variable representing the credit risk, the non performing loan ratio and the FEM, REM regression method. The results show that risk assessment and control activities are inversely related to the credit risk, while the control environment and information and communication factors have a positive relationship.

All of the previous studies with traditional statistical methods such as Pooled OLS, Fix effect model (FEM), random effect model (REM), or generalized method of moments (GMM). These methods can identify what factors affecting bank liquidity risk, but many problems are occurring when using these techniques and much criticism arises from modern statisticians as they gave unreliable results in many cases as well (Briggs & Nguyen, 2019; Anh et al., 2018; Kreinovich et al., 2019; Nguyen, 2011; Nguyen, 2020). For that reason, in this paper, we employ Bayesian linear regression and Gibbs sampling, which produces more reliable results (Nguyen, 2020), contributing to filling the gap with previous studies. And it can be seen as the novelty of our study

2.3. Hypotheses

H₁ : Board size has a negative impact on credit risk as the diversification of members of the Board of Directors reduces the risk.

H₂ : There is a negative relationship between experience in management and credit risk.

H₃ : There is a positive relationship between bank loans and credit risk of commercial banks.

H₄ : There is a positive correlation between loan to total deposit and credit risk.

H₅ : There is a negative relationship between the reliability of financial statements and credit risk.

H₆ : Quality of audit report and credit risk have a positive relationship.

H₇ : Financial leverage and credit risk have a positive relationship.

H₈ : Bank size and credit risk have a negative relationship.

H₉ : There is a negative relationship between years of operation and credit risk.

H₁₀: There is a positive relationship between the inflation of the economy and the credit risk.

H₁₁: There is an negative relationship between GDP growth and credit risk.

3. Data and Methodology

3.1. Data Collection

We use balanced panel data from 2007 to 2018. Data is collected from the financial statements and annual reports of 30 commercial banks in Vietnam. According to the State Bank of Vietnam, as of December 31, 2018, the total number of commercial banks was 35, including 31 joint stock commercial banks and four commercial 100% state-owned banks. The total assets of 30 commercial banks used in this study account for approximately 86% of the total assets of commercial banks, ensuring the representativeness of commercial banks in Vietnam. We collect data from Vietnam Bureau of Statistics and the State Bank of Vietnam for macroeconomic factors.

3.2. Methodology

In science, there are two schools of statistics: the school of Frequentist and the Bayesian school of statistics. These two statistics schools differ in their philosophy of science and in particular their understanding of the concept of probability. Conclusions in the Frequentists are based on sample data. Meanwhile, the Bayesian statistics is based on the known data and the observed data to produce the current statistics, called posterior inference. The parameters in the Frequentists are fixed, but unknown, meanwhile, the Bayesian parameters are random and obey the law of distribution. In Bayesian statistics, the prior information constitutes a theoretical basis, and the conclusions derived from prior information are combined with observed data (Nguyen, 2020). Therefore, the Bayesian approach is used more and more, especially in the field of social sciences. With the strong development of data science, big data as well as computational software, Bayesian statistics became a favorite tool (Kreinovich et al. 2019).

In Bayesian analysis, we use conditional probability:

To derive Bayes’s theorem:

where A, B are random vectors.

Since previous studies on the factors of internal control affecting commercial banks’ NPLs are carried out by the Frequentist approach, we do not have information about the prior distributions of variables in the research model. So, we use the normal distribution N (0, 100) for the prior distributions and the Igamma distribution (2.5, 2.5) for the variances in the model. We can rewrite as follows:

Prior distributions

α ∼ N(0; 100)

σ2 ∼ Invgamma(2.5; 2.5)

In this study, we apply the Bayesian method via the Random-walk Metropolis-Hastings algorithm and Gibbs sampling. Metropolis et al. (1953) were the first to propose the algorithm and Hastings (1970) developed it more efficient. In which, the Gibbs sampling is a special case of the MetropolisHastings algorithm (Gelfand et al. 1990). From the research hypotheses, we propose the following research model:

\(\begin{aligned} \mathrm{NPL} &=\alpha_{0}+\alpha_{1} \mathrm{BOD}+\alpha_{2} \mathrm{FBB}+\alpha_{3} \mathrm{LOAN}+\alpha_{4} \mathrm{LDR} \\ &+\alpha_{5} \mathrm{FINS}+\alpha_{6} \mathrm{MONITOR}+\alpha_{7} \mathrm{LR}+\alpha_{8} \mathrm{SIZE} \\ &+\alpha_{9} \mathrm{AGE}+\alpha_{10} \mathrm{INFLAT}+\alpha_{11} \mathrm{GGDP}+\varepsilon \end{aligned}\)

The descriptions of the variables are provided in Table 1.

Table 1: Variable definitions

4. Empirical Results and Discussion

4.1. Descriptive Statistics

Table 2: Descriptive statistics

Table 3: Estimation results of the model​​​​​​​

4.2. Bayesian Simulation Results

The dependent variable that reflects the credit risk used in this study is the non performing loans (NPLs) (Akwaa-Sekyi & Gené, 2016; Koutoupis & Malisiovas, 2019). Non performing loans ratio is measured by the percentage of non performing loans divided by total loans of each bank. According to Vietnam’s loans classification decision, non performing loans include outstanding loans from groups 3 to 5 on the balance sheets of banks, that are 90 days or more overdue. Group 3, 4, 5 items are taken from the financial statements and the income statement each year. Total loans are collected from the balance sheets of banks.

In order to ensure that Bayesian inference based on MCMC simulation is reasonable, we use MCMC chains convergence diagnostics.

Convergence testing of MCMC chains is done through trace plots, a post-distribution chart (histogram), autocorrelation chart, kernel density (plot density). The test results from Figure 1 show that the traces run quickly through distribution, the correlation chart falls quickly, shows the low correlation, the shape of the histogram diagrams simulating the shape of the precise distributions are homogeneity. From this it can be concluded that the Bayesian inference is reasonable.

Figure 1: Graphical diagnostics for MCMC convergence​​​​​​​

Board size, which represents the control environment, is negatively related to the NPL. This result is similar to previous studies by Zhang et al. (2007), Koutoupis and Malisiovas (2019), Akwaa-Sekyi and Gené (2016). However, the studies by Uwuigbe and Fakile (2012), Nguyen (2017) have conflicting results . This implies that banks with large board sizes are less likely to be manipulating information, and have arguments among members of the board to control risks. From there, promoting an effective internal control mechanism, building a substantive and highly effective control and monitoring environment, helping to reduce the bank’s NPLs.

Management experience (FBB), which represents the risk assessment factor, has a negative impact on the NPLs. This means that the number of members of the Board of Directors with background in finance and banking tends to decise a less risky operation strategy for the bank due to their understanding in finance and banking sector. With their expertise in finance - banking, bank leaders can identify, counterfeit and control risks, and orient the banks to operate safer and healthier. This result is similar to the study of Nguyen (2017), which states that the risk management factor of internal control requires experienced managers to effectively manage risks as well as ensure the performance of the internal control system.

Loans to Total Assets (LOAN), which represents control activities, has a positive impact on credit risk, meaning that the more banks offer credit, the more they do not guarantee credit limits, the more credit risk increasing. Banks that lend more, but do not control well the quality of loans can increase credit risk. In addition, lending more means that the bank will have liquidity problems and cannot meet the withdrawal needs of customers promptly. Therefore, securing the credit limit requires strict banking governance, strict compliance with the credit granting process, and ensuring the safety of the bank’s assets (Casu et al., 2006). An effective system of internal controls ensures the bank complies with safety regulations in banking operations, which in turn can reduce credit risk in banking operations. This result is in contrast to the study by Koutoupis and Malisiovas (2019), which shows that banks with a high ratio of outstanding loans to total assets, do not ensure credit limits, tend to reduce credit risk. However, another element of control activities, Compliance and Prudence (LDR), which has a negative impact on credit risk, which implies that the banks lend more on the deposit, reducing the credit risk. Banks reduce their liquidity reserves, allocate funds to more secure assets, such as government bonds, which can reduce credit risk.

The reliability of financial statements (FINS), representative for information and communication systems, has a positive impact on credit risk. That means the longer the time from the end of the fiscal year to the date of signing the audit report, showing the difficulty of the bank’s financial status, the more credit risk increases.

Quality of auditing report (MONITOR), representative for monitoring activities, has a positive relationship to credit risk. This is contrary to our initial expectation. Banks audited by reputable auditing firms do not guarantee safer operations. In the case of Vietnam, such banks operate in a more risky manner to seek high profits.

In term of control variables, age of banks and NPLs have positive relationship, implying that the longer a bank’s operating history, the more the NPL increases. The characteristics of the Vietnamese commercial banking system include large, long-standing, state-dominated banks and small banks with limited operating time. In particular, the big banks still have bureaucratic management style, slow to change, relying heavily on the government’s preferences. Therefore, these banks are often stagnant and less innovative. And that makes risk management less flexible, increasing the NPLs for the bank itself. The results of this study are in contrast to Akwaa-Sekyi and Gené (2016), Tang et al. (2014), who believe that the longer a bank has a long history, the better it is able to manage risk.

Bank size has negative impact on NPL. Bank size can reflect bank’s strength and its ability to deal with difficult problem. And thus, reduce NPLs.

Banks that use high financial leverage can reduce NPLs. A bank with high financial leverage means it is operating at higher risk to seek higher profits, leading to an increase in NPLs (Akwaa-Sekyi & Gené, 2017; Takasu & Nakano, 2019). However, in this study, the results show that commercial banks using high financial leverage can reduce NPLs, similar to the results of Nguyen (2017), but different with the study of Hillegeist et al. ( 2004), Altman (1968), which show that, although banks use high financial leverage in their business operations, if their portfolios, lending are diversified, comply with regulations in banking operations, hold more secure profitable assets like government bonds, can reduce the NPLs for banks.

Inflation rate (INFLAT) moves in the same direction to the NPLs. High inflation may make it easier to provide credit by reducing the real value of a loan. However, high inflation may require banks to impose high interest rates, making it difficult for borrowers to pay to banks for their obligations. When borrowers cannot pay their debts on time, NPLs increases. The research results are consistent with the research of Akwaa-Sekyi and Gené (2016).

Economic growth (GGDP) has a negative effect on the NPL. When the economy develops better, customers can pay their debts on time due to the employment and business in good status. The study results are similar to those of Salas and Saurina (2002), Dash and Kabra (2010), Nguyen (2017).

5. Conclusion and Policy Implications

5.1. Conclusion

The objective of this study is to examine the impact of internal control on the credit risk of Vietnamese commercial banks in the period from 2007 to 2018. By using Bayesian regression method, the empirical research results show that factors in the COSO framework (2013) that affect the credit risk of Vietnamese commercial banks are the control environment, risk assessment, information and communication, monitoring activities, and control activities. In addition, factors related to banks’ characteristics as well as macroeconomic factors that affect credit risk are bank size, financial leverage, inflation, and GDP growth.

5.2. Policy Implications

In order to improve the quality of credit activities in particular and the banking system in general, the study offers the following solutions to perfect the internal control system of commercial banks.

Completing the credit control environment as the foundation for the construction of the rest of the internal control system. Specifically, raising awareness of compliance with regulations and credit processes, avoid using too high financial leverage attaching importance to the integrity and ethical values of not only employees, but also senior managers of the system; Clearly define the responsibilities of individuals and departments when participating in the credit process to prevent and promptly detect mistakes. Besides, do not lower credit standards, ensure clear decentralization, separate appraisal and loan responsibilities.

Completing the legal basis, creating a corridor for improving the efficiency of the internal control system. Banks should issue safety regulations for the system based on the State Bank’s regulations, widely accepted accounting and auditing standards and principles, and apply the principles. on banking supervision of Basel II.

Improving supervision of credit controls, to ensure transparency and strengthen supervision of the Board of Directors; Banks need to separate the supervisory function from the business executive function of the Board of Directors. In addition, banks need to improve the internal control system according to the 17 expansion principles of COSO. Accordingly, it is necessary to evaluate the internal control system based on three defensive routes: the class directly dealing with customers; approval block; and system of supervision and disbursement departments.

The most important goal of commercial banks is the capital supply channel for the economy, operating in a healthy and safe manner, avoiding chasing profits and pushing the banking system to face high risks. Therefore, in order to ensure the sustainable development goal, the bank leaders need to have proper investment in the operation of the bank’s internal control system, so that the internal control system becomes an effective tool in detecting, warning and preventing mistakes in banking operations in general and credit operations in particular.