“The effectiveness of the internal control system in Vietnamese credit institutions”

In the context of global economic integration, there are many opportunities for pro- moting economic development, but there are also challenges of complexity and risk in business activities. This always raises many questions that need to be resolved for credit institutions. The internal control system of credit institutions has become increasingly important for the sustainable development of the national financial system. The purpose of the paper is to evaluate the effectiveness of the internal control system in the practical application of Vietnamese credit institutions. Descriptive statistics are applied to analyze data using SPSS software. The structured questionnaire is designed to collect objective opinions and purposive sampling techniques among 382 experts who are managers of credit institutions in 2020. The results show that all five components improve the effectiveness of the internal control system, and the internal control system plays a role in the safety of Vietnamese credit institutions. Thus, the Central Bank of Vietnam should improve the legal framework and related internal control pro- visions for credit institutions in accordance with international principles to improve the effectiveness of the internal control system.


INTRODUCTION
The banking sector is of great importance for a nation's economy. The safety of the financial and monetary system creates stability and development of a country. All activities in the economy depend on the stability and safety of the banking sector, so the internal control system in the banking sector is necessary. Thus, effective internal control is crucial in this area (Gamage et al., 2014). Internal control of banks is designed to prevent frauds causing economic damage to the banking sector. The effectiveness of internal control is at the heart of all activities in an organization; if it fails, it will affect the organization and can lead to financial breakdown (Ayagre et al., 2014). The failure of the internal control system leads to the inability of company operators to control operations. This is the cause of the company's financial scandals. Organizations must ensure that the internal control system is efficiently maintained and aligned with operations (Mcnally, 2013). Internal control ensures effectiveness, reduces the likelihood of errors, and helps to timely detect fraud (Kumuthinidevi, 2016). Internal control can be financial control or non-financial control. It has become one of the essential elements for the effective operation of an organization. Effective internal control is the cornerstone of the banking sector that contributes to safety and well-being. The internal control system is essential in organizations, especially in banks, since the banking sector is so important for economic development related to macroeco-nomic issues (Kumuthinidevi, 2016). Tunji (2013) believes that the effective internal control system is an important element for bank managers. That is a condition for a safe and healthy banking sector. Weak or ineffective internal control can lead to losses in banks. This is the cause of the systemic crisis in the world.
In recent years, the State Bank of Vietnam is gradually setting up legal corridors to limit risks of credit institutions. The regulations of the State Bank of Vietnam on the internal control of credit institutions have been amended and supplemented to contribute to the completion of the legal framework. It supports stability in the system of credit institutions. However, many significant problems with large losses of assets of Vietnamese credit institutions are caused by fraudulent collusion of managers and employees (Vietnamese Ministry of Finance, 2017). In addition, some of financial crises of Vietnamese credit institutions have arisen due to the weaknesses of internal control (Vietnamese Banking Association, 2019). This has caused a great loss for Vietnamese credit institutions. Due to the essential nature of the completion of the internal control activities, the evaluation of the effectiveness of internal control activities in Vietnamese credit institutions is of great importance. This is even more important in the context of the fact that Vietnam has increasingly integrated the economy with the region and the world.

LITERATURE REVIEW
Some studies consider internal control as a broad concept, so it is widely used in many different ways. Millichamp (2000) argues that internal control is the entire control system set up by the board of directors to orderly conduct an organization's business, ensure compliance with and adherence to management policies, protect assets, and ensure that information is complete and accurate. Internal control includes controlling the entire management system to effectively conduct business operations (Kumuthinidevi, 2016). The internal control system is a rigorous process that ensures that banks achieve their goals, maintain reliable information, and comply with the law to reduce the risk of loss or damage to the reputation of banks (Gamage et al., 2014). Internal control is designed to ensure the effectiveness and efficiency of operations, the reliability of the reporting, and compliance with regulations (Tunji, 2013).
The official concept of internal control was announced by The Committee of Spo nsoring Organizations of the Treadway Commission (COSO) in 1992. According to a recent version in 2013, this is a process carried out by the board of directors, the executive board, and all employees, designed to provide a relative assurance to achieve three goals -operational, reporting and compliance (COSO, 2013). Basel (BIS, 1998) considered internal control as a process carried out by the board of directors, the executive board, and all employees. These are procedures and policies that are implemented during the operation process in the banking system. The board of directors and the executive board are responsible for establishing a cultural environment, creating favorable conditions for the effective operation process, and assessing the effectiveness of the process (BIS, 1998). The amended Law on Credit Institutions (2017) stipulates that internal control is a set of mechanisms, policies, processes, internal regulations, the organizational structures of credit institutions and branches of foreign banks. It is built in accordance with the guidance of the Central Bank and is organized to ensure the prevention, detection and timely handling of risks, as well as meeting the requirements set out (National Assembly of Vietnam, 2017).
Basel (BIS, 1998) issued this framework to evaluate the internal control system. A system of the effective internal control is a foundation for the safe and sound operation of credit institutions. Basel (BIS, 1998) also considers that internal control activities are important for the prudent operation of credit institutions and for ensuring the stability of the financial system. The internal control process has the following three specific objectives: efficiency and effectiveness of activities (performance objectives); reliability, completeness, and timeliness of financial and management information (information objectives); and compliance with applicable laws and regulations (compliance objectives). These are important regulations on internal con-trol. This framework consists of five components with thirteen principles, namely management oversight and the control culture according to principles 1 to 3; risk recognition and assessment specified in principle 4; control activities and segregation of duties included in principles 5 and 6; information and communication included in principles 7 to 9; monitoring activities and correcting deficiencies included in principles 10 to 12; assessment of the internal control system by the banking supervisory authority expressed in principle 13. These principles are intended for general application, and supervisory authorities should use them to monitor the internal control system of credit institutions (BIS, 1998).
The Central Bank of Vietnam has issued an official regulation on internal control on organization and inspection activities in credit institutions operating in Vietnam. Due to the trend of integrating financial and monetary markets in the region and the world, the Central Bank of Vietnam has made amendments and additions to complete the regulations regarding the internal control system, such as the Circular 44/2011/TT-NHNN on the internal control system of credit institutions. Thus, unlike Basel, the Central Bank of Vietnam did not issue an internal control framework, but the internal control regulations of credit institutions are reflected in Circular 44/2011/TT-NHNN with four focus contents -specific requirements and operational principles of the internal control system; building and maintaining the operation of the internal control system; self-inspection and evaluation of the internal control system; and independent evaluation of the internal control system (Central Bank of Vietnam, 2011).
Recently, the Central Bank of Vietnam has issued regulations on the internal control system of commercial banks and foreign bank branches by Circular 13/2018/TT-NHNN (Central Bank of Vietnam, 2018a) and Circular 40/2018/TT-NHNN to amend and supplement some articles of Circular 13/2018/TT-NHNN (Central Bank of Vietnam, 2018b). These changes are updated in content in line with international principles, in particular senior management supervision; internal control system; risk management system (regulations on risk management; credit risk management, market risk management, operational risk manage-ment, liquidity risk management, centralized risk management, interest rate risk management on bank books, internal assessment of sufficient capital); and an internal audit system. Some previous studies have considered many different perspectives to assess the effectiveness of the internal control system in the banking sector. Thus, Amudo and Inanga (2009) reviewed the process of the internal control system in the Uganda banks. The study uses descriptive statistics for evaluation. The research results show that the effectiveness of internal control has not been clear in banks. Some control components of the internal control system are ineffective. Tunji (2013) evaluated the effectiveness of the internal control system in the banking industry of Nigeria. The sample included 65 bank employees and was analyzed using a simple percentage. The results showed that Nigerian banks' internal control systems are effective in eliminating banking fraud in order to improve the accuracy and reliability of bank records. However, there is still non-compliance by employees with the requirements when implementing the internal control system. Ayagre et al. (2014) assessed the control environment and the supervisory operational components of the internal control system in banks in Ghana. The authors also used descriptive statistics for analysis. The study results indicate that the control and monitoring environment are two important components of the internal control system in Ghanaian banks with a medium mean of 4.72/5 and 4.66/5, respectively. Gamage et al. (2014) considered the effectiveness of the internal control system of 128 subjects in bank branches in Sri Lanka. The authors also used descriptive statistics. The results showed the effectiveness of the internal control system. However, the perception of employees and some problems of risk still exist in the internal control system. Kumuthinidevi (2016) examined the internal control system of private banks in Trincomalee. The sample included 130 permanent employees, and the descriptive statistics was used. The results showed that internal control was effectively promoted by elements related to environmental control, risk assessment, accounting, information and communication. However, the effectiveness of this system was influenced by the minimum time the bank spent correcting errors or frauds, as well as the ineffective use of resources in the internal con-trol system of a bank. Yakubu et al. (2017) assessed the effectiveness of the internal control system in five branches of Ghana banks. This article surveys 37 employees of these banks. Data analysis is used by descriptive statistics. The research results point that all elements of the internal control system are effectively implemented by the bank but the lack of human resources and inadequate training are the main causes of fraud and limitations in internal control of banks in Ghana. Shaman and Senan (2019) studied the effectiveness of the internal control system in Saudi banks. They explored 90 subjects -bank experts -who were considering the impact of each component on the internal control system. The article also used descriptive statistics. The research results showed that the internal control system was effective and satisfactory but needed some improvements in the control environment, risk assessment, and communication system.
In Vietnam, no empirical studies evaluate the effectiveness of the internal control system components in Vietnamese credit institutions, but there have been some studies related to this issue under different perspectives. Nguyen (2018) surveyed 114 employees of some commercial banks in the Thai Binh province of Vietnam to examine the effectiveness of the internal control system. For analysis, multivariate regression was used. The results explore that all factors of internal control affected the effectiveness of the internal control system, in particular as control environment; risk assessment; information and communication; control activities; and self-assessment. Tran (2019) studied the internal control factors affecting business performance in commercial banks in Vinh Long province of Vietnam. The main research method is quantitative verification method. The article used 209 samples of employees working at commercial banks. The analysis results indicated that all five factors of internal control had a positive influence on the efficiency of business operations at commercial banks in this province. In general, there are currently no previous Vietnamese studies on the effectiveness of internal control on the basis of components according to Basel, while there are specific regulations to support credit institutions in completing their internal control system.
Due to the important nature of the banking sector, the evaluation of the effectiveness of the cred-it institutions' internal control system is of great importance for stability and safety of the credit institution system. Studies on evaluating the effectiveness of the internal control system in the Vietnamese context are still limited, especially recent research when the Vietnamese government has made adjustments to internal control regulations of credit institutions. The main objective of this study is to evaluate the effectiveness of the internal control system of Vietnamese credit institutions, following the Basel components in recent times. Specifically, this study answers the following research question: Is each component of the internal control system (management oversight and control culture; risk recognition and assessment; control activities and segregation of duties; information and communication; and monitoring and correcting deficiencies) effective in Vietnamese credit institutions?
The research hypothesis is as follows: Hypothesis: Each component of internal control (management oversight and control culture; risk recognition and assessment; control activities and segregation of duties; information and communication; and monitoring activities and correcting deficiencies) enhances the effectiveness of the internal control system in Vietnamese credit institutions.

METHODOLOGY
To collect data for this study, a questionnaire was used. The questionnaire was made available to respondents to collect data for the study. A structured questionnaire was used to gather the objective respondents' opinions. The questionnaire consisted of two parts: the first part included questions about the demographics of respondents and the second part included questions related to five main parts corresponding to five Basel components (BIS, 1998).
The purposive sampling technique is intended for use in sampling. The study is intended for experts who are managers, since managers are well versed in the internal control system of credit institutions. The sample for this study includes permanent ex-perts of credit institutions. The research sample is obtained from 382 surveyed subjects (out of 400 issued survey forms). All the surveyed experts who are working in most Vietnamese credit institutions have many years of experience in banking and finance. The survey period is the first quarter of 2020.
The study uses a Likert scale with 7 assessment levels, specifically Poor: 1; Weak: 2, Moderate: 3; Average, fair: 4 Fair: 5; Good: 6, and Very good: 7. Likert scale is used for convenience and ease of filling for surveyors. The paper uses the Likert scale to measure the level of knowledge and perceptions of respondents about the effectiveness of the internal control system of the Vietnamese credit institutions.
The collected data was analyzed using the Statistical Package for the Social Sciences computer software program, version 22.0. The paper used statistical tools such as mean, standard error, and standard deviation. Cronbach's alpha was also calculated to test the elements for each internal control component. Descriptive statistics was used to analyze data.

RESEARCH RESULTS
The survey results show that the internal control system of Vietnamese credit institutions is reliable, although there are still limitations. Research findings are summarized for each component, such as management oversight and control culture; risk recognition and assessment; control activities and segregation of duties; information and communication; monitoring activities and correcting deficiencies.

Management oversight and control culture
The condition under which the Cronbach alpha scale makes sense is that the statistical value must be greater than 0.6 (Hair et al., 2006). Based on the survey results of three items related to management oversight and control culture, Cronbach's alpha is 0.702, which is in line with statistical requirements (Table 1). According to the survey respondents, all components related to the assessment of management oversight and control culture are above average, while the errors and standard deviations are not significant ( Table 2). The manager's attitude to the internal control system is assessed as almost fair (4.91/7). This shows that managers of credit institutions are interested in the internal control system and aware of the importance of the system in the operation process. The level of operational inspection of the board of directors for measuring and assessing risk is not high (4.12/7). This is worth noting because fraud and risk are main concerns for control managers. An organizational structure suitable for the scope of activities was also rated modestly (4.35/7). This can be explained by the fact that the arrangement of full-time personnel in each functional area, especially related to independent control departments, is still an issue to consider. This comes from the training, recruiting, rotating arrangement, and personnel coordination in the system of headquarters and branches of credit institutions.

Risk recognition and assessment
With two items of risk recognition and assessment, Cronbach's alpha is 0.892, so the scale ensures reliability (Table 3). According to the survey results, managers determine the risks, and the assessment of the likelihood of risk is acceptable with a rating above 4 -4.62 and 4.81, respectively. The criteria have negligible errors and standard deviations (Table 4). This can be explained by the fact that managers in credit institutions have fairly stable qualifications and professional competence. However, along with that development, the diversity and abundance, as well as the complexity of the international business environment in the field of credit institutions are a matter of concern. The problem is in forecasting and identifying potential risks.

Control activities and segregation of duties
Control activities and segregation of duties include six items. The result of Cronbach's alpha is calculated as 0.702 and corresponds to the measurement reliability (Table 5).
According to the survey results (see Table 6), control activities and segregation of duties have not been highly appreciated. This is the most underrated component. Similar to the above, the errors and standard deviations of the items are not significant. Credit institutions have fully complied with these regulations and expressed in place for policies and procedures for the authorization and approval of highly rated operations 4.91/7 (near level 5). This is also consistent with the content of the incompetence of a credit institution with a rating of 2.21/7 (below level 3), which is also consistent with the problem of handling cases of non-compliance, which are rated at 4.82/7. The understanding of the staff's duties related to the control issue is assessed not as high as 3.78/7 (below level 4). This problem shows that internal control is difficult, com-   plex, and requires high professional and broad knowledge of employees. With regard to personnel issues, as analyzed above, for the content of supervisors who have enough time to get the work done, the results show a low level of 2.85/7 (below level 3). This is because the current status of resource allocation to the control department is limited, while these employees must handle all control issues in all activities of their credit institutions. In particular, compliance with risk limits is only acceptable (3.28/7). This content is perceived in accordance with the statement of risk recognition and assessment.

Information and communication
Information and communication have two items. Cronbach's alpha is 0.786, so the confidence level of the scale is accepted (Table 7). Information and communication are assessed as relatively fair, and errors and standard deviations are negligible. The survey results on the content related to communication and information related in terms of reliability and effectiveness of the information are highly appreciated at the proximity of 5, specifically 4.25/7 and 4.87/7 ( Table 8). The application of information technology to the network of credit institutions is increasingly popular and developed, so the information update is quick and timely. The information communicated in writing is primarily intended for implementation guidance, so it ensures reliability and enforcement.
However, professional development of employees is also important for the effective information receipt and feedback.

Monitoring activities and correcting deficiencies
With seven items of monitoring activities and correcting deficiencies, Cronbach's alpha of 0.745 satisfies the reliability of the scale (Table 9). As Table 10 shows, the error and standard deviation are not significant. The regular supervision of credit institutions' operations is highly appreciated, nearly at level 5. These results show that credit managers are always interested in and monitor the activities continuously. Meanwhile, the periodic review and evaluation of the effectiveness of the internal control system have not been given adequate attention (4.18/7). The role of internal audit is generally effective in testing internal control. However, professional qualifications and specialized issues are also a matter of concern as the score is only average (4.16/7). This shows once again that more attention needs to be paid to training and retraining of full-time officials for supervision. The issue of periodic review of the internal control system, as well as the implementation of corrective measures for the shortcomings of the internal control system, has not been highly appreciated (4.24/7). This can be seen as the professional competence of a manager and a supervisory officer, who cannot fully and systematically understand the whole thing.

DISCUSSION AND POLICY RECOMMENDATIONS
The results show that all components enhance the effectiveness of the internal control system in Vietnamese credit institutions and are also quite similar to previous studies in Vietnam (Nguyen, 2018;Tran, 2019). Based on the results of the survey, which combines in-depth interviews with some experts of the Central Bank of Vietnam, it can be seen that the internal control system in Vietnamese credit institutions is assessed as effective. Firstly, managers have been aware of the importance and interest in the internal control system, as well as monitoring the activities continuously. In addition, a management team has qualifications, professional capacity and skills to undertake the work in the internal control system. Secondly, managers of credit institutions have fully complied with regulations on policies and procedures for authorization and approval, ensuring the concurrent imposition and thoroughly handling cases of non-compliance. Credit institutions have been proactively deploying the application of increasingly developed information technology, so the information update is quick and timely, and the communication ensures reliability and implementation. Finally, the role of internal audit has been effective in examining internal control activities. This role has been retained to ensure control.
However, in addition to these achievements, the problems should be noted such as inadequate human resources to undertake internal control activ-ities in each constituent component. In addition, resource allocation to the control department is not timely and complete. Further, the level of risk identification and risk assessment of managers is unsatisfactory. Finally, the initiative and timeliness are not high in adjusting and supplementing the shortcomings of the internal control system. This will make it difficult to control.
According to a survey of some leaders of Vietnamese credit institutions, the cause of the above shortcomings can come from many problems. Firstly, the Central Bank of Vietnam has not fully regulated the internal control according to the international principles and has not paid much attention to the inspection and supervision of internal control in the banking system. In addition, managers of Vietnamese credit institutions are not fully aware of the importance of the internal control systems. Finally, specialists involved in the internal control process do not understand the importance and role, so the application was not consistent across divisions and departments within the unit.
In the current period, the Central Bank of Vietnam should amend and supplement the regulations regarding the internal control system of credit institutions in accordance with the Basel principles, and needs regular updates to timely guidance. After that, the Central Bank needs to develop an internal control framework for credit institutions formed with five components and thirteen principles on the basis of Basel's regulations to establish the legal framework standard in accordance with the international practice. The Central bank should develop a common set of templates on internal control procedures for credit institutions to facilitate and ease the application. Next, the Central Bank should conduct periodic inspection and supervision of some internal control activities of credit institutions to ensure compliance. Moreover, the Central Bank should have sanctions for credit institutions that have not yet fully implemented the regulations related to the internal control system. The Central Bank should standardize the professional qualifications of internal controllers and begin to establish the conditions for internal controllers to be certified practitioners. At the same time, the Central Bank should clearly stipulate the specifics and independence of internal controllers in the internal control system.
Moreover, Vietnamese credit institutions should raise awareness of compliance with internal control regulations. Managers of credit institutions need appropriate orientations and strategies to strongly develop an internal control system. At the same time, credit institutions create a healthy control environment to ensure independence, objectivity and effectiveness in the timely process of risk assessment and response. Credit institutions should invest more funds and pay more attention to recruiting, training and fostering a contingent of internal controllers. They also should pay attention to enhancing the application of information technology to promptly control information. In addition, credit institutions should be proactive in assigning resources, organizing personnel according to the characteristics and scale of operations, to ensure that internal control personnel are professional and time sensitive.

CONCLUSION
The internal control system in credit institutions plays an important role in controlling economic resources. This is even more significant for credit institutions that have a great impact on the national financial system and influence the economic growth of Vietnam. The results also demonstrate that the internal control system of Vietnamese credit institutions has a certain effectiveness, but there are still certain shortcomings in each internal control component. There are two components that better improve the effectiveness of internal control, including "information and communication" and "monitoring activities and correcting deficiencies", while "control activities and segregation of duties" are of lower effectiveness, and the other two components are only relatively effective, such as "management oversight and control culture" and "risk recognition and assessment". Maintaining the internal control system has recently helped to ensure the stability of Vietnamese credit institutions. Therefore, the Central Bank of Vietnam needs to pay more attention to building a complete legal corridor for the internal control system in accordance with the Basel principles. This contributes to the stability and sustainable development of Vietnamese credit institutions in line with the trend of international integration.