Summary of Information on the Subject's Capacity and Training Level

The synthesis, calculations and summaries for analysis purposes are presented in the Appendix.

2.2. Based on the interview results, the Author classifies the banks by group. Next, the Author evaluates the internal control system according to the mentioned group of commercial banks and compares the evaluation results to see the differences. In addition, the use of the analysis results is presented and explained in detail in each content below for each issue.

Table 2: Years of experience of auditors

interviewed and responded

Years of experience

Number of responses

Ratio %

Under 3

From 3-5

From 5-10

Over 10 No

Total

16%

32%

23%

100%

Maybe you are interested!

( Source: Author synthesized and calculated from survey results)

Table 2 shows that the experience of internal auditors and certified public accountants (referred to in Table 3) increases the reliability of feedback as well as the stability of findings for internal control.

Table 3 below summarizes the responses on training quality from the respondents. Training quality is important in the feedback process as well as the reliability of their assessments. This affects the quality of the author's findings. More specifically, many interviewees have training in more areas, as shown in the total index by competency and training level of the respondents is 123 instead of 93 - the total number of respondents in the author's study.

Table 3. Summary of information on the capacity and training level of the subjects

interviewed and responded

Professional Certificate	Quantity feedback	Percentage vs. 93
1.	CIA or equivalent	18	19%
2.	State Auditor Certificate	0	0%
3.	Certificate of Control Assessment	9	10%
4.	Information Audit	6	6%
5.	Practicing Auditor	57	61%
6.	Certificate in Management Accounting	3	3%
7.	Fraud Investigation Certificate	3	3%
8.	Practicing Accountant	0	0%
9.	Certified Public Accountant	0	0%
10.	No certificate	12	13%
11.	Other (For example, have a relevant university degree)	15	16%
	Total	123

( Source: Author synthesized and calculated from survey results)

The results of the responses showed that 61% of the respondents out of 93 individuals who responded had a practicing auditor certificate, followed by 19% of the respondents who had an internal auditor certificate or equivalent. Table 4 presented below provides information combining the number of years of auditing experience with the areas in which the respondents were trained. The results showed that 12 respondents did not have a certificate or degree related to auditing, of which 6 individuals had experience working in auditing.

3 have less than 3 years of experience, 3 have 3-5 years of experience and 3 have 5-10 years of experience.

Table 4. Summary of responses by years of experience combined with training of respondents

Interviewed Object

Years of experience

CIA or equivalent present	Certificate of inspection Accountant	Certificate in assessment price control	Auditing information believe	Auditor practice	Auditor	Investigation Certificate cheat	Accountant/Technician practice	Public Accountant proof	No evidence only	Other (Bachelor's Degree) related studies)	Total
From 5-10	12	0	3	3	18	0	3	0	0	3	6	30
Over 10	3	0	3	3	12	3	0	0	0	0	6	21
Are not	0	0	0	0	21	0	0	0	0	0	0	21
From 3-5	3	0	0	0	6	0	0	0	0	3	3	15
Under 3	0	0	0	0	0	0	0	0	0	6	0	6
Total	18	0	6	6	57	3	3	0	0	12	15	93

( Source: Author synthesized and calculated from survey results)

Among the 15 individuals with other professional qualifications, there were 6 responses from individuals with 5-10 years of experience, 6 responses from individuals with over 10 years of experience, and 3 responses from individuals with 3-5 years of experience.

The process of selecting samples for the specific survey and the results of the survey are described and summarized by the author in the above section. The detailed analysis of the specific collected results will be presented in Chapter 2 of the Thesis.

6. Significance of Thesis Topic

The topic develops the theory of internal control based on the COSO Framework for organizations in general and commercial banks in particular, especially with suggestions for improving and developing internal control in the operating conditions in Vietnam. Therefore, these contributions help commercial banks develop specific guidelines to build, perfect and develop internal control along with the Basel Control Framework in the context of changes inside and outside the unit. Develop the basis for designing internal control, especially building the method

Evaluating internal control in banks helps managers to evaluate and improve internal control deficiencies.

In practice in Vietnam, the Thesis can help managers of Vietnamese commercial banks in particular and enterprises in general to evaluate and build an internal control model that approaches the "standard" in implementing internal control according to the COSO 1992 Framework, the "standard" in internal control according to the new Control Framework, 2017 (Control Framework according to COSO 2017) and the Internal Control Framework according to Basel III.

The thesis also helps managers of commercial banks have a template for evaluating different aspects of internal control according to the 5 components of the COSO 2015 Framework. Based on that template, managers can develop a way to evaluate internal control, determine the status of internal control in relation to control effectiveness, and thereby take appropriate management actions in the actual conditions of the unit.

7. Structure of the Thesis

In addition to the Introduction and Conclusion, the Thesis consists of 3 chapters: Chapter 1: Theory on internal control of commercial banks;

Chapter 2: Current status of internal control of Vietnamese commercial banks;

Chapter 3: Some solutions to improve internal control in Vietnamese commercial banks.

CHAPTER 1

THEORY OF INTERNAL CONTROL IN COMMERCIAL BANKS

1.1. Internal control and corporate governance

1.1.1. Internal control in corporate governance

According to published research by Zanetos (1964), Lee (1971), the concepts of governance and internal control do not have new meanings. Even later studies have shown similar conclusions ([192], [134]). Ramamoorti's (2003) research found clear links between governance and the establishment of internal control; he also argued that in the control activities in the previous stage, the nature of internal control remained unchanged, such as traditional control activities such as limiting access rights, dividing work responsibilities or other aspects such as the importance of honesty and competence of employees, the perception of the nature of internal control also did not have major changes [165]. In fact, Lee's (1971) study on the development of internal control also shows that signs of internal control existed as early as 3600-3200 BC in the areas where people lived in Mesopotamia [134]. Accordingly, managers established a system of control activities where certain responsibilities were separated to prevent fraud and protect assets. According to the traditional view, the reason for effective control and management activities is closely related to responsibility and asset protection.

Jensen & Meckling (1976), Fama & Jensen (1983) studied the problems arising from the separation of ownership and control quite early [126]. Adam Smith (1776), the father of scientific economics, pointed out the dangers to those who are responsible for other people's money compared to the risks to those who own what they own. Similar problems tend to arise in the conditions of a large enterprise, including issues such as shareholders should exercise the best control activities in large companies in which they invest [1].

During the following 15 years, practice showed the urgent need for appropriate corporate governance associated with the operations of each company.

Corporate governance. Governance, organizational governance and corporate governance are terms that are increasingly used and emphasized. In fact, different definitions of the concept of governance exist although they have great similarities and are common. Corporate governance focuses on the relationship between the two parties, the shareholders and the managers of the company. The board of directors and the members of the board represent the shareholders. Traditional research perspectives on corporate governance according to the free market theory assume that corporate governance focuses specifically on maximizing profits for shareholders. Accordingly, the corporate governance relationship only includes directors and shareholders. According to Bhasa (2004), the free market perspective is supported by the stakeholder perspectives - the parties involved in the governance relationship. From there, the responsibility of the company is extended beyond the shareholders.

According to Schachler, Juleff, & Paton (2007), the UK Cadbury Act 1992 refers to corporate governance as “a system directed and controlled by a company” [172]. These authors also argue for the definition of corporate governance proposed by the Organization for Economic Co-operation and Development (OECD) in 1999, which states that corporate governance emphasizes the relationship between shareholders, agents and managers of the company, built on the perspective of those with interests. From there, researchers also put forward a broader perspective on corporate governance. In fact, the development of other perspectives on corporate governance is inevitable, but it follows a general trend of simpler and more progressive development. Lazarides and Drimpetas (2008) stated that “management is the operation of a business and governance is the supervision for the business to operate properly” [133]. That also means that when the environment changes, governance and management need to change to adapt and ensure the achievement of business goals.

According to the study of Hermanson and Rittenberg (2003), the need to improve corporate governance is divided into 3 groups of influencing factors including: Impact of consecutive disasters ; Changes in shareholder representation; Legal environment. According to the study of Power (1997) in the UK, some of the events

The failure of the early 1990s has regulated effective governance mechanisms that should be established to avoid similar incidents, including financial reporting and independent auditing mechanisms [160]. Studies in the US by Vinten (2003); Yakhou & Dorweiler (2004); Tackett, Wolf, & Claypool (2004) show that some governance failures such as the collapse of Enron along with the bankruptcy of one of the world's largest auditing firms (Arthur Andersen Auditing Company) have created a shock to investor confidence when investors' assets "disappeared" ([188], [191], [181]). The Sarbanes Oxley Act ‡ passed by the US Congress shortly thereafter regulates many issues related to corporate governance in general.

general and KSNB in particular. Therefore, this Act has a strong impact on corporate governance principles, especially for companies listed on the New York Stock Exchange.

According to the publications of OECD (2009a, b); Birkenshaw & Jenkins (2009); Senior Supervisors Group (2009), the recent failures of some financial institutions, especially the collapse, often create a clear negative effect, for example, the collapse of Lehman Brothers showed that the effectiveness of corporate governance and risk monitoring processes must be improved ([150], [151], [66], [173]). In addition, the change in shareholder representation is the result of investors asserting “rights” to the board of directors and management, and establishing requirements for the characteristics and organization of governance. According to William (1985), the board of directors should be considered as a basic governance structure that is a safe haven between the company and its owners [189]. Furthermore, executive management and their rights can be seen as a key factor for effective corporate governance and the risks of inappropriate managerial behavior are presented in the thematic practice guides - According to Apostolou, Hassell, & Webber (2001); Radin (2008) ([161], [53]).

An important point from the above findings is that operational management is mentioned as a vital element to ensure management and administration.

‡ The full name of this Act is “ An act to protect investors by improving the accuracy and reliability of corporate disclosures made pursuant to the securities laws, for other purposes ” enacted on July 30, 2002.

By using terms such as “ tone at the top ” and “control environment ” in auditing standards, it shows the importance of senior management in the appropriate approach to understanding risk and conducting business.

According to Hermanson & Rittenberg (2003), the remaining important factor for a good corporate governance process is the legal environment, especially in the context of the components of an integrated World, where legal risks appear leading to the need to improve governance practices [112].

The synthesis of the analysis of the above issues also shows that the need to improve corporate governance or a supervision of the company to ensure the proper operation of the unit has become a necessary need. Power's research (2007) affirms that the above issue has also attracted the attention of researchers over the past 15 years and has become an important basis for the promulgation of corporate regulations [160]. This is also the basis for the development of general control and internal control in the unit. Research by Maijooor (2000); Power (1997); Spira and Page (2003) agree that the development of corporate governance leads to the explosion of internal control, or a rediscovery of the superiority of internal control and the explosive development of auditing ([137], [160], [178]). Power (2007) argues that “internal control systems are now at the heart of management thinking and practice ; the principles of internal control design are now global” [160]. He also emphasizes that internal control has become a matter of concern for experts and a way of organizing and dealing with uncertainty [160]. COSO’s (2004) study suggests that internal control has become closely linked to risk management in relation to strategy formulation and implementation [83].

Thus, in any organizational activity, some form of control must exist to manage the above problems as they occur and ensure that individual behavior conforms to established organizational or group standards. Simons (1991) argues that a management control system will be used to maintain or replace organizational activities based on information received [176]. According to Tannenbaum (1968), an organization or a business always has control. A

Comment