Hoàn thiện hệ thống kiểm soát nội bộ tại ngân hàng nông nghiệp và phát triển nông thôn việt nam theo tiêu chuẩn quốc tế COSO tt tiếng anh

MINISTRY OF EDUCATION AND TRAINING STATE BANK OF VIETNAM BANKING ACADEMY NGUYEN THI QUYNH HUONG IMPROVING INTERNAL CONTROL SYSTEM OF VIETNAM BANK FOR AGRICULTURE AND RURAL DEVELOPMENT ACCORDING TO COSO INTERNATIONAL STANDARD ECONOMICS PHILOSOPHY DOCTOR THESIS HA NOI - 2020 THIS THESIS IS MADE AT BANKING ACADEMY Professional Adviser: Associate Professor, PHD LE VAN LUYEN PHD NGUYEN QUANG THAI IMPROVING INTERNAL CONTROL SYSTEM OF VIETNAM BANK FOR AGRICULTURE AND RURAL DEVELOPMENT ACCORDING TO COSO INTERNATIONAL STANDARD Critic 1: Critic 2: Critic 3: This Thesis will be presented to the Thesis Committee at Banking Academy at …., the … day … year 2020 INTRODUCTION The urgency of research After more than 10 years of becoming a member of the WTO, Vietnam's economy has gained initial achievements The operating environment and institutions of the banking system have had positive changes with remarkable achievements in terms of regulatory frameworks, internal governance, organizational structure, quality of human resources and development of modern banking services But the performance of the banks has been vulnerable because of changes in the internal and external environment In order to prevent possible losses and risks of business activities, the banks must take effective measures The most important measure is that the banks must establish an effective internal control system (ICS) In response to that request, the Governor of State Bank of Vietnam (SBV) issued Circular 44/2011/TT-NHNN stipulating the ICS and internal audit of credit institutions (CIs), foreign banks This legal document contributed to improve internal control to the right level and its role However, the actual implementation and evaluation of the suitability of the ICS showed that the provisions of Circular 44/2011/TT-NHNN was still general, did not really complete and meet regulations on the real role of an ICS in banking activities Therefore, the Governor of SBV issued Circular 13/2018/TT-NHNN regulating the ICS of commercial banks, branches of foreign banks The provisions of Circular 13/2018/TTNHNN are quite specific and clear, especially close to the international practices on the establishment of the ICS This is also consistent with the actual implementation of Basel II in Vietnam Accordingly, the ICS is defined prominently on three independent defenses to control, prevent, detect and promptly handle risks in banking activities In addition, Circular 13/2018/TT-NHNN also stipulates that ICS performs five functions: supervision of senior management, internal control, risk management, internal assessment of adequate capital and internal audit It can be said that developed countries have given the definition, the measure of establishing the ICS for many years ago and have systematized globally recognized standards In 1992, Committee of Sponsoring Organizations (COSO) issued a report on the first internal control framework So far, through many adjustments and updates, the COSO internal control framework has really become the basis for the establishment of ICS in the world The application of internationally recognized standards will help banks in Vietnam accelerate the progress and efficiency in the process of developing and improving ICS; thereby saving time, funding and most importantly improving the conformity of the ICS against the international practices in order to increase the management efficiency and meet the rigorous requirements of integration Within the Vietnamese banking system, Vietnam Bank for Agriculture and Rural Development (Agribank) is the largest banking system in terms of capital, assets, staff, network of operations and number of customers However, this is a banking system that reveals many weaknesses in governance as well as control gaps From the above reasons, improving the ICS at Agribank becomes an urgent issue in management, which makes sense in both theory and practice in the current period Therefore, the author has chosen topic: “Improving Internal Control System of Vietnam Bank for Agriculture and Rural Development according to COSO International Standard” as the subject for the doctoral thesis Overview of previous studies 2.1 The foreign studies Research on internal control in relation to corporate governance is carried out in several studies: The COSO 1992 report, research “Control in Business Organizations” of Merchant, K.A (1985); research “Management Control System” by Anthony R.N and Dearden, Jbedford (1989); research on risk management in relation to internal control by Laura F Spira and Michael Page (2002); the study of the relationship between business strategy of enterprises and internal control of Faudizah, Hasnal and Muhamad (2005); research on the role of market and entrepreneurship orientation and internal control affecting on the new product development activieties of Chinese Firms by Yuan Li, Yi Liu, Youngbin Zhao (2006); study on effects of the ICS on financail performance in an university in Ugandan by Mawanda (2008); research on impacts of internal control strategy on efficiency operation of organization of Thai listed firms by Varipin Mongkolsamai and Phapruke Ussahawanitchakit (2012); The study of the impact of the ICS on financial performance at health institutions in Ghana by Sahabi Ibrahim, Gordon Diibuzie and Mohammed Abubakari (2017) Research on internal control in relation to audit: Initial studies on internal control are mainly in connection with internal audit and gradually supplement the objectives of internal audit The term of internal control appeared from Price Waterhouse Auditing Company In 1905, Robert H Montgomery gave his opinion on the content of the internal inspection system that later evolved into internal control in “Auditing - Theory and Practice” In 1929, the announcement of the Federal Reserve System (FED) for the first time introduced the concept of internal control In 1936, American Institute of Certified Public Accountants (AICPA) also introduced the concept of internal control, supplementing the objective of internal control which is to ensure accurate accounting data Later, in the book “Modern Internal Audit - Evaluation of activities and control systems” by Victor Z Brink and Herbert Witt (1941), the ICS was also mentioned with relatively full comments of internal audit In 1949, AICPA added the objective of promoting effective operation and encouraging the compliance of management policies into the concept of internal control After 1949, AICPA also issued many audit standards addressing different concepts and aspects of internal control In 1958, in the report on SAP 29 (Statement on Auditing Procedure Statement) of the Committee on Auditing Procedure (CAP) under AICPA, it was the first time to distinguish internal control in terms of management and accounting In 1962, this organization issued SAP 33, further clarifying the concept of internal control in broad sense; since then, the auditing standards have been developed, which require the auditing company to limit the internal research on accounting In 1972, CAP issued SAP 54 “Understanding and evaluating internal control”, which introduced four accounting control procedures After that, AICPA issued Statement on Auditing Standard (SAS) to replace SAP, in which SAS1 (established in 1973) on the responsibilities of auditors review SAP 54 and provide a more complete framework for accounting control In 1976, Alvin A Arens and James K Loebbecke in “Auditing: An Integrated Approach” gave the reason for companies to build an ICS In 1992, the COSO Report, “Internal Control - Integrated Framework”, became the theoretical framework for ICS which was studied and presented in a complete and systematic manner Research on internal control in the relationship of financial accounting information quality of listed companies was conducted through a number of studies such as study of the US Committee of Sponsoring in 1987; Defond's research (1991); Angella.A’s study (2009); J Altamuro’s research (2010); N KLai’s research (2011); Alvin A.Arens’s research (2012) The above studies all show the important impact of internal control on the quality of financial accounting information of listed companies Research on internal control in the banking sector: Applying regulations on internal control of COSO to CIs and banks, the Basel Report of the Basel Committee increasingly focused on the importance of internal control in the banking sector The Basel report emphasized that internal control is a process influenced by management, senior management and employee levels And then, there were researchs of Karagiorgos, Drogalas and Dimou (2008); Olatunji (2009); Amudo and Inanga (2009), Njanike, K et al (2011); Adeyemi et al (2011), Socol A (2011), Sultana & Haque (2011), Charles, E.I (2011); Hayali et al (2012), William and Kwasi (2013); Ayagre, Applian-Gyamerah and Nartey (2014); Gamage CT et al (2014); Gamage CT, Low, Lock Teng Keving (2018)… 2.2 The national studies The researches related to theory of internal control: The book “Auditing” by University of Economics Ho Chi Minh City in 2005; the book “Financial Audit” by Nguyen Quang Quynh in 2006; the book “Internal control” by Tran Thi Giang Tan and Department of Auditing in 2012; Research by Pham Quang Huy (2014) Research on internal control in specific units: The researches are conducted in an industry, ministry or corporation in Vietnam on a number of research topics and theses Regarding the banking sector, there are also many studies on internal control, the ICS but for the whole banking system Conclusion: There have been many studies on internal control and the ICS in the world as well as in Vietnam However, after doing the literature review, the thesis identified the research gap as that there was no research to build a theoretical framework of the ICS in commercial banks, mainly applying the common uniform framework for different types of enterprises The studies conducted in Vietnam were mainly on economic groups or the whole commercial banking system but not yet on a specific commercial bank For above reasons, the thesis focuses on researching the ICS framework in commercial banks based on the specific characteristics of these banks and the COSO internal control framework as well as the internal control regulations of the Basel Committee; conditions for applying COSO internal control framework in commercial banks; learning practical experience on establishing the ICS in banks in some countries; offering views on the improvement of the ICS in banks and criteria for measuring the improvement And then, the thesis explores and assesses the current situation of the improvement of the ICS at Agribank based on the components and the principles of the COSO internal control framework; identifies the affecting factors on the effectiveness of the ICS and measures the impact of each factor on the effectiveness of the ICS at Agribank through the application of the Exploratory Factor Analysis (EFA) method and the multiple regression model; access the current improvement situation of the ICS at Agribank Finally, the thesis offers solutions to improve the ICS at Agribank according to the COSO internal control framework Research objectives: (1) General objective: Improvement of the ICS at Agribank according to COSO international standards (2) Specific objectives: Building a theoretical framework for the ICS in commercial banks on the basis of COSO internal control framework and in accordance with characteristics of commercial banks, conditions for applying COSO internal control framework in commercial banks, criteria for measuring the improvement of the ICS in commercial banks; Evaluating the improvement situation of the ICS at Agribank according to COSO internal control framework, measuring the effectiveness of the ICS at Agribank, retesting on the basis of identifying factors and measuring the impact of each factor on the effectiveness of the ICS at Agribank, assessing the improvement situation of the ICS at Agribank; Proposing solutions to improve the ICS at Agribank to suit the operational characteristics of this bank based on the COSO internal control framework Object and scope of the research - Research’s object: The improvement of the ICS and the effecting factors on the effectiveness of the ICS according to COSO internal control framework - Research’s scope: (1) About space: The study was conducted at Agribank (2) About time: From 2016 to 2020 Research Design 5.1 Analytical Framework Figure Research Framework of the Thesis 5.2 Research methodology: The thesis uses empirical methods, qualitative research methods and quantitative research methods 6 The structure of the thesis Chapter Overview of the internal control system at commercial banks according to COSO international standard Chapter Improvement situation of the internal control system at Vietnam Bank for Agriculture and Rural Development according to COSO international standard Chapter Solutions to improve the internal control system at Vietnam Bank for Agriculture and Rural Development according to COSO international standard CHAPTER OVERVIEW OF THE INTERNAL CONTROL SYSTEM AT COMMERCIAL BANKS ACCORDING TO COSO INTERNATIONAL STANDARD 1.1 RATIONALE FOR INTERNAL CONTROL SYSTEM ACCORDING TO COSO INTERNATIONAL STANDARD 1.1.1 Concept of internal control system according to COSO international standard The concept of internal control is a broad meaning that has been defined by many researchers and organizations However, currently the widely accepted definition is the COSO’s definition with three objectives: operations – reporting - compliance In 2009, Robert R Moeller had set another control objective “integrity and ethical values” In Vietnam, the definition of internal control is also stated in Article 39 of the Vietnam Accounting Law 2015 The concept of the ICS is also mentioned by many different authors In the United States, one of the first concepts of the ICS was defined by the AICPA and later in the International Standards on Auditing (ISA) on Risk Assessment and Internal Control No 400 (ISA No.400) of the International Federation of Accountants (IFAC) In Vietnam, Ngo Tri Tue et al (2004) stated different views on the ICS and gave a general concept As an alternative to Vietnamese Standards on Audit No.400 (VSA 400), VSA No.315 (2012) also gave the definition of internal control that is considered to be approach oriented to risk assessment and is similar to COSO's point of view: Internal control is a process, not a system like previous concepts 1.1.2 The components of the internal control system according to COSO international standard: The COSO Report (1992) suggested that an ICS consists of five components, namely: Environment Control; Risk Assessment; Control Operations; Information and Communication; Monitoring 1.2 INTERNAL CONTROL SYSTEM AT COMMERCIAL BANKS ACCORDING TO COSO INTERNATIONAL STANDARD 1.2.1 The necessary for establishing an internal control system in commercial banks: Commercial banks are a specific type of enterprise operating in the field of finance, typically operating to receive and convert risks into profits, the organizational structure usually has a large scale, many branches, transaction offices operating on a wide area, with many complex and constantly changing financial business operations Therefore, the establishment of the ICS in commercial banks becomes even more necessary 1.2.2 The characteristics of commercial banks affecting the establishment and implementation of internal control system according to COSO international standard (1) Affecting the establishment of control environment; (2) Affecting the establishment of risk assessment; (3) Affecting the establishment and operation of control activities; (4) Affecting the establishment of information and communication; (5) Affecting the implementation of monitoring of controls 1.2.3 Establishment and implementation of internal control system in accordance with international practices: According to Suzanne Steyn (1997), there are 05 documents considered as the basis for establishing and implementing the ICS according to international practices, namely: COSO framework; Enterprise Risk Management - A COSO integrated framework (ERM); The Control Objectives for Information and Related Technology (COBIT); Inspection and Control Framework of The Institute of Internal Auditors (IIA); Standards to consider internal control in auditing financial statements of AICPA (SAS55, SAS78, SAS94) In addition, particularly in the banking sector, in 1998 the Basel Committee on Banking Supervision issued documents on the internal control framework in banks The Basel report on the internal control framework did not offer new theory but only applied the COSO framework 1992 to banking activities It can be said that, COSO report provides a complete framework of internal control such as objectives, components, principles The compliance with the principles of the COSO report almost guarantees the Basel Committee's principles when estabishing the ICS in banks as well as the provisions of Circular 13/2018/TT-NHNN regulating the ICS in commercial banks Therefore, the study chose COSO internal control framework to esatablish and improve the ICS in commercial banks in general or at Agribank in particular 1.2.4 Establishing internal control system in commercial banks according to COSO international standard: Basing on COSO internal control framework as well as Basel Committee's regulations and commercial banks' specific characteristics; the study proposed the ICS in commercial banks should be established including the following contents: 1.2.4.1 Identify the objectives of internal control system in commercial banks according to COSO international standard: (1) Operation; (2) Reporting; (3) Compliance 11 CHAPTER IMPROVEMENT SITUATION OF INTERNAL CONTROL SYSTEM AT VIETNAM BANK FOR AGRICULTURE AND RURAL DEVELOPMENT ACCORDING TO COSO INTERNATIONAL STANDARD 2.1 INTRODUCTION ABOUT VIETNAM BANK FOR AGRICULTURE AND RURAL DEVELOPMENT 2.1.1 The establishment and development of Agribank: Agribank is a state-owned commercial bank, the operation of the bank is always associated with the role of implementing monetary and credit policies of the Government, leading implementation of the policy promotion for green credit growth, building safe agriculture, sustainable development, and also fulfilling social security responsibilities of a corporate, contributing to the development and increase of positive living values for the community, becoming one of the largest microfinance service providers in Vietnam 2.1.2 Overview of Agribank's operations: Agribank is currently the commercial bank with the largest asset size in the system; always ensure safety ratios as prescribed; widest operating network; largest automatic banking network; largest staff in the system; offerring nearly 220 types of products and services In the coming time, Agribank determined to continue the successful implementation of the phase restructuring; project of development strategy to 2025, orientation to 2030; accelerate the implementation of IT projects creating an important technical foundation for developing e-banking services and requirements of risk management; implement the roadmap to ensure compliance with the regulations of SBV in Circular 13/2018, Circular 41/2016 and gradually towards the application of safety standards under Basel II; improve financial capacity, labor productivity, and aim to operate effectively to be equitized successfully 2.2 IMPROVEMENT SITUATION OF INTERNAL CONTROL SYSTEM AT VIETNAM BANK FOR AGRICULTURE AND RURAL DEVELOPMENT ACCORDING TO COSO INTERNATIONAL STANDARD 2.2.1 Legal basis for the establishment of internal control system in commercial banks in Vietnam 2.2.1.1 Regulations of SBV: The Law on Credit Institutions 2010 and Circular 13/2018/TTNHNN regulating the ICS in commercial banks 12 2.2.1.2 Internal regulations of Agribank: Decision 600/QĐ-HĐTV/2012 on promulgating the regulation on organization and operation of Agribank; Decision 102/QĐ-HĐTVKTNB/2014 on the Regulation on internal control of Agribank; Decision 206/QĐBKS/2019 on the Regulation on organization and operation of Agribank’s internal audit 2.2.2 Improvement situation of internal control system at Agribank according to COSO international standard 2.2.2.1 Situation of control environment a Demonstrates commitment to integrity and ethical values: Agribank has issued an Agribank cultural handbook; regulations on standards, manners, transaction style of tellers in Agribank system; labor regulations which are widely disseminated in the system through the Website, Eoffice to encourage and ensure individuals and departments to grasp control messages, thereby actively identify and control risks Since then, creating a relatively healthy control culture in this bank b Board of Directors and Supervisory Board: Agribank's Board of Directors has established a high-level supervision function for the ICS The Chairman of the Board of Members and members are all professional people; most of them are aware of risk management and quite independent of the Board of Management c Organizational structure and the division of authority and responsibility: The organizational structure at the Head Office is structured in the direction of clearly defining the functions and duties of the units, avoiding overlapping, enhancing risk control throughout the system Agribank is currently building a draft of job description and has not have KPIs The criteria for evaluating salaries and promotions are still based on achievements in making profits d Commitment to competence: The quality of human resources has been increasingly improved at Agribank, the average labor productivity has been raised e Personnel Policy: Agribank has also issued regulations related to recruitment, training and employee evaluation, promotion in a specific and fairly transparent manner 2.2.2.2 Situation of risk assessment a Specifying suitable objectives: Basically, the objectives were established at Agribank, namely: operational objectives, reporting objectives and compliance objectives 13 b Risk identification: Agribank has chosen a relatively safe, scientific risk management model that can be easily operated consistently and basically ensures the “testability” of internal control + Risk Management Committee: The Risk Management Committee under the Board of Directors advises the Board of Directors in issuing policies related to risk management However, Agribank has not developed an operational regulation of the Risk Management Committee according to its functions and tasks based on the research, access to Basel as well as international practices, in accordance with the actual operation and the provisions of SBV + Risk Council: Risk Council and Capital Management Council are established The Deputy General Director in charge of risk management is the chairman of the Risk Council; members of the Risk Council are classified into credit risk, market risk, operational risk, liquidity risk and interest risk in banking book, centralized risk, new product and new market risk + The committees and centers at the head office according to their functions and tasks managing each type of risk must have a risk management department c Change management: Agribank has not focused on change management - a content recommended by international practice 2.2.2.3 Situation of control activities: Agribank's ICS has also been established with independent three-line defense associated with the organizational structure but there is no guarantee of complete independence between the first and second line of defense In each business process, on the basis of identifying and assessing risk, control activities have been established at Agribank based on purpose or form but risks and frauds still occur because of weakness of staff’s morality 2.2.2.4 Situation of information and communication a Situation of information: Agribank has established a system of information reports on business results for all operations, the system of reporting forms to the SBV has been issued uniformly, most of which are automatically exploited from the IPCAS program system (MIS Report Module) In addition, Agribank also established an Eoffice program system to facilitate the smooth transfer and process documents and reports in the system However, Agribank has not built MIS so that it can implement the information exchange mechanism throughout the system 14 b Situation of communication: Internal communication ensure that the control information is transmitted accurately and timely to individuals and departments in the bank Agribank's external communication activities should be proactively implemented so that the bank's control messages are transmitted to external objects such as customers, investors, regulatory agencies, auditors … 2.2.2.5 Situation of monitoring the controls: Including supervision of the Board of Directors, the Supervisory Board through the internal audit department under the Supervisory Board and the General Director's supervision through a specialized internal inspection and control department 2.3 QUANTITATIVE RESEARCH ON THE IMPACT OF FACTORS ON EFFECTIVENESS OF INTERNAL CONTROL SYSTEM AT VIETNAM BANK FOR AGRICULTURE AND RURAL DEVELOPMENT ACCORDING TO COSO INTERNATIONAL STANDARD 2.3.1 Results of qualitative research to explore factors affecting the effectiveness of internal control system at commercial banks: The thesis uses a qualitative research method, specifically through in-depth interviews with experts to identify the factors affecting the effectiveness of the ICS in banks Associating with the perspective of the effectiveness of the ICS is shown in the fact that the system has a full range of factors and each factor operate in practive to help bank achieve the control objectives The thesis interview results with the inheritance of the COSO framework and identifies the following five factors affecting on the effectiveness of the ICS in commercial banks; they are: (1) Control environment; (2) Risk assessment; (3) Control activities; (4) Information and communication; (5) Monitoring 2.3.2 Quantitative research results of the factors affecting the effectiveness of internal control system at Agribank 2.3.2.1 Sample: The questionnaire was developed and sent to the survey subjects in the following forms: (1) Phone; (2) Email; (3) Direct Interview With 350 votes issued, the author collected 315 votes (90% rate) Through the cleaning process, the number of votes has been processed and analyzed is 278 2.3.2.2 Research orientation: After determining the factors affecting the effectiveness of the ICS in banks as above and survey results, the thesis measures the impact of these factors on the effectiveness of the ICS at Agribank by using the Explored Factor Analysis (EFA) 15 method and multiple regression models to solve the following research question: How the determined factors affect the effectiveness of the ICS at Agribank? 2.3.2.3 Results of measuring the effectiveness of the internal control system at Agribank: The control objectives have not been achieved at Agribank, this means that the ICS at Agribank has not really achieved the effectiveness Therefore, in general, the ICS has not been improved because it has not met the “effectiveness” of this system in helping banks to achieve the control objecitves 2.3.2.4 Results of measuring factors affecting the effectiveness of internal control system at Agribank a Summary of scale quality testing results: Through analysis of Cronbach’s Alpha test, 06 scales of model ensure good quality with 33 specific variables b Results of explored factor analysis (EFA): (*) Testing the appropriateness of the method and data collected (KMO and Bartlett's Test) we have a coefficient of KMO = 0.856, satisfying the condition: 0.5