Effect of internal controls on credit risk among listed Spanish banks

Purpose: The paper examines the effectiveness of internal control systems, explores the exposure of Spanish banks to the dangers of default as a result of internal control systems and establishes a relationship between internal controls and credit risk. Design/methodology/approach: Quantitative research approach is used to test hypotheses on the relationship between internal controls and credit risk among listed banks in Spain. Data from Bankscope and company websites from 2004-2013 were used. Generalized Least Squares (random effect) econometric estimation technique was used for the model. Findings: We find that internal control systems are in place but their effectiveness cannot be guaranteed. This exposes Spanish listed banks to serious default situations. There is significant effect of internal controls on credit risk especially the control environment, risk management, control activities and monitoring. The non-disclosure of material internal control weakness is a contributory factor to the ineffective internal control systems. There is however a perceived board ineffectiveness which does not augur well for effective internal control systems. Board characteristics for Spanish banks confirm the agency theory. Research limitations/implications: Data unavailability for certain years, variables and many inactive banks did not permit a larger sample size than expected. The use of quantitative variables lacks flexibility.


Introduction
In the wake several corporate scandals, market failures and loss of investments, there is clarion call to ensure market discipline especially on the part of industry players.As much as possible, losses should be unanticipated than purposely orchestrated as is seen in many corporate organizations.The possible adoption of soft-laws, self-regulation and high sense of ethical behaviour has gained much prominence in the world of business.Financial intermediation is the flow of funds from surplus to deficit units.The units also known as market participants are made up of individuals, households, institutions or firms, governments and foreigners (Casu, Giradone & Molyneux, 2006).One important issue bedevilling financial intermediation is information asymmetry.This menace has the tendency to lead to moral hazards and adverse selection.Most financial institutions have suffered from moral hazards on the part of clients expressed through default.
As most important financial intermediaries in developing and industrialized economies, banks have come under the microscopic eyes of regulators, central banks and direct and indirect stakeholders since their failure have damming consequences on the economy.Over the past decades, banks have suffered various forms of crises and the effects have descended down on firms of all categories causing total halt in such economies which make banks a major source of contagion especially during periods of crisis.Ensuring bank stability has taken both micro and macro dimensions.It sounds quite refreshing to hear of macro-prudential regulation of banks but bank self-regulation, internal discipline, compliance and building of stakeholder confidence through internal controls will be better embraced.
Developments in the financial services industry especially with financial intermediation have been so rapid in recent times.New product development and innovation, diversification of financial services products, excessive competition, crave for significant market share through excessive branching into new geographical areas and desires to benefit from economies scale and scope have unnecessarily exacerbated the risk exposure of financial institutions and for that matter banks.Shareholder value maximization-the prime objective of the firm requires that institutions minimize their risks as much as possible.In contrast to this, managerial risk aversion hypothesis which is traced from the agency argument holds that management will more often than not pursue actions to minimize their personal risks.Managers therefore engage in actions that may endanger the maximization of shareholder wealth.Irrespective of whether ensuring shareholder value maximization or managerial risk aversion, the issue of risk management must be addressed.This attempt to align the two divergent stances of shareholders and management is achieved through effective internal controls.Shareholders and other indirect stakeholders have confidence in an effective and efficient internal control system.It is also in the interest of management to see internal controls as a managerial tool rather than to antagonize the introduction of all forms of internal control measures.Olatunji (2009) studied the impact of internal control system in banking sector in Nigeria but limited the scope of internal controls to fraud which is found under operational risk.Lakis and Giriunas (2012) also described internal controls as a measure to deal with fraud.Our present study builds on already existing works to provide a wider view of internal controls covering all the elements globally accepted and used like COSO and Basel Committee on Banking Supervision.Bedard (2011) used the US Sox internal controls which focus on financial reporting.Ji, Lu and Qu (2015) focused on Chinese Sox internal controls which added among others organizational structure and human resource management.We use a broader scope of internal controls (COSO model) which covers five broad areas namely control environment, risk assessment, control activities, monitoring and information and communication systems.
In cases where other authors have used the COSO framework of internal controls, the main type of data has been primary sources collected through the use of questionnaires.We use purely secondary data to enable a more statistical analysis and a quantitative approach to model internal controls which the authors are yet to come across.Moreover, most risk management literature identified internal controls as operational risk issue but we extend the discourse to see if internal controls have any relation with credit risk.This approach provides another dimension of the relationships between internal controls and credit risk to add up to the already existing good works of the authors cited.Jin, Kanagaretnam, Lobo and Mathieu (2013) found that if banks comply with internal controls, they reduce their risk taking behaviour and are less likely to experience failure.The ramifications of credit risk for banks extend beyond the investors, to the industry, the nation and the international community.Credit risk issues have monetary implications and seriously jeopardize bank market discipline (Delis & Karavias, 2015).The aftermath of the global financial crisis has been very devastating for many nations including Spain.The banking industry has been hardest hit by Spain's economic downturn and the situation was described by Carballo-Cruz (2011) as the worst crisis the country has faced in the last fifty years.The volume of non-performing loans has been on the increase and many banks have collapsed bringing the number of savings banks from 45 in 2009 to 7 in 2014 (Chislett, 2014).Chislett reported that non-performing loans ratio moved from 0.6% in 2007 to more than 25% in 2014.The situation is a recipe for investigation hence the choice of the study area.
The purpose of this study is to examine the effectiveness of internal control mechanisms among Spanish banks, investigate exposure of Spanish listed banks to default risk as a result of poor internal control mechanisms and determine how internal controls affect credit risk.
The study will go a long way to make new revelations and confirm previous research on how internal controls affect not only operational risk as presented in most finance literature but also credit risk.The structure and effectiveness of internal controls is evident in the reporting of banks and this is explored to unveil its relationship with a core function of banks which is making loans.Thus the study reinforces prudence and cautiousness on the part of management even though the profit maximizing objective cannot be shirked in the process of discharging a critical function.This study opens a grey area in the use of quantitative variables to study an area which hitherto has been studied with the use of primary data.The rest of the paper covers literature review, hypotheses and variables, design/methodology/approach, findings and conclusion.

Literature Review
The supply of funds from surplus to deficit units and viceversa should be an ongoing activity to ensure effective resource allocation.The financial system does this job better and financial institutions of which banks constitute the largest have a crucial role in this financial intermediation process.Banks are asset and risk transformers, liquidity providers and tools for implementing government financial and economic policies (Casu et al., 2006;Mishkin, 2006).
The Spanish banking industry comprise mainly three types of banks; commercial banks, savings banks and credit unions (Alamá, Conesa, Forte & Tortosa-Ausina, 2015).Unfortunately, the industry has witnessed very unpleasant moments in recent times for which Carballo-Cruz (2011) had no better way of describing than to say the worst crisis the country has experienced in the last five decades.Tracing the evolution of the crisis, the writer thinks it is an extension of the international financial crisis but emphasizes that internal imbalances in the pre-crisis period prepared fertile grounds for the crisis to escalate.
In an earlier study, Lozano-Vivas (1998) described the Spanish banking industry as so competitive that commercial banks had to adjust their deposits and loan rates.Unjustifiable adjustment of cost of funds have serious implications for the kind of credit market products and the processes of initiating, negotiating, funding, servicing and monitoring loans.The immediate effect of the crisis became evident at the demise of 38 savings banks within five years when their number reduced from 45 in 2009 to 7 in 2014.Chislett (2014) r eported the abnormal rise in non-performing loans from 0.6% in 2007 to more than 25% in 2014 thus warranting a European Stability Mechanism for a bailout where about €100 billion was injected into the industry as a form of capitalization.The regionally based unlisted banks known as Cajas accounted for around half of the loans in the domestic banking system and are touted as orchestrators of the crisis.These Cajas exploited an existing weak and relaxed market coupled with political interference, incompetent board of directors, reckless banking practice through over branching and over-ambitious investments (Chislett, 2014).
Ironically, as these Cajas were collapsing, they dissipated into commercial banks in the form of mergers and acquisitions thus infesting the commercial banks with their canker.In some cases, seven Cajas had to merge to form a bank.However, analysis from recent figures shows improvement in the books of the banking sector thus providing some light at the end of the tunnel.Profits for largest six banks have increased more than four times higher than 2012 and sharp drops in provision for loan losses.Non-performing loans are still higher but the increase is at a decreasing rate in relative terms.There have been efforts to enforce market discipline through the tripartite effort of Banco de España (BdE), Fondo de Garantia de Depositos (FGD) and Fondo de Reestructuracion Ordenada Bancaria (FROB).The Ministerio de Economia y Competitividad is also providing cooperation and support to come out with a framework for regulation (IMF, 2012).The IMF country report affirms the need to come out with stricter laws on internal governance that conforms to international standards.The picture about the Spanish banking industry makes it appropriate for study especially on the issue of bank internal governance (controls) and the resultant huge non-performing loans (credit risk).The situation is purely a managerial failure which is not uncommon in banking literature especially where the internal control system is weak for possible exploitation.
From a behavioural compliance theory approach, managers should do all they can to profile the company in a manner that consolidates a positive reputation which are inclined to sound corporate governance pedestals.Given new names such as soft laws and soft regulations (Morth, 2004;Sahlin-Anderson, 2004) managers should learn by intuition, to oblige to principles and best practices.The behavioral compliance theory draws motivation from efforts to rally support from stakeholders by raising the reputation of the company through compliance to corporate governance principles.Attempts to avert any negative profiling of companies or engaging in acts to ruin the reputation of the company on the part of managers are enforced through sound and established internal controls.
From the agency theory, managers may engage in actions that perpetuate their personal aggrandizement.Hart (1995) contends that there is a trade-off between incentives and risk sharing.The cost associated with possible conflict of interest between agents and principals are known as agency costs.These according to Hart are traceable to auditing, budgeting, compensation and other forms of internal controls instituted to check management and employee misbehaviour.According to Letza, Kirkbride, Sun and Small (2008), the argument underlying the agency theory is that, managers will only act to maximize shareholder value if only it is not in conflict with his or her own personal self-interest.Managers or employees may carelessly initiate, originate and fund potentially unsuccessful loans if internal controls are not religiously adhered to.The many cases of credit risk expressed in non-performing loans, delinquencies and all forms of loan restructuring which makes the loan books dirty are traceable to poor adherence and non-compliance to established loan granting procedures.Some loan defaults are employee-caused, others are bank-caused and others are client-led.
Internal controls seek to address the employee and bank-led causes of default.The deliberations above support the fact misbehaviour on the part of management (which in this case carelessly contracted loans is being cited) could be controlled with proper internal controls.
Most corporate governance literature underscores the indispensable role of internal controls in strengthening the governance structure of organizations (Maijoor, 2000).The long-term confidence of stakeholders-government, suppliers, investors, customers in the areas of reporting, accountability and reliable information is fortified with effective internal control systems (Rittenberg & Schwieger, 2001).The Committee on Sponsoring Organizations (COSO) (1992) defines internal controls as the process affected by the entity's board of directors, management and other personnel designed to provide reasonable assurance regarding achievement of effectiveness and efficiency of operations, reliable financial reporting and compliance with applicable laws and regulations.Following numerous corporate scandals, the US Congress passed a law which gave birth to the Sarbenes-Oxley Act 2002 which was seen as an improvement upon the COSO framework thus giving emphasis to monitoring and reporting.
It is therefore not surprising to find most internal control research directed towards financial reporting.The SOX Act requires that management reports material internal control weakness to the board and external auditors.The adequacy of internal control systems and the attestation by independent auditors on the report by management is provided in the Act.
Basel Committee on Banking Supervision (2010) defined internal controls as ensuring that senior management establishes and maintains an adequate and effective internal control system and processes.The system and processes should be designed to provide assurance in areas including reporting (financial and operational), monitoring compliance with laws, regulations and internal policies, efficiency and effectiveness of operations and safeguarding of assets.After an extensive theoretical study of internal controls, Lakis and Giriunas (2012) defined internal controls as that part of enterprise management system ensuring the implementation of goals, effective economic-commercial performance of the enterprise, observation of accounting principles and effective control of work risks that enables the organization minimize the number of intentional and unintentional mistakes, to avoid frauds in the process of enterprise performance made by authority or employees.Their definition emphasizes effective risk management just as the Basel Committee on Banking Supervision definition.
In responding to changes in the business environment, the COSO framework has been revised in the year 2013 which pays attention to some of the SOX Act provisions.The new framework which was represented in a cubic shape covers the five elements (control environment, risk assessment, control activities, information and communication and monitoring), the objectives (operations, reporting and compliance) and level (entity, division, operating unit and function) (McNally, 2013).The revised framework identifies seventeen principles under the five broad elements.The control environment covers demonstration of commitment to integrity and ethical values, exercising oversight responsibilities, establishing structures, authority and responsibility, demonstrating commitment to competence and enforcing accountability.Under risk management, companies should specify suitable objectives, identify and analyse risks, assess fraud risk and identify and analyse significant change.The control activities comprise selecting and developing control activities in general and over technology and deploying policies and procedures.The next internal control element is information and communication and this covers the use of relevant information and communicating internally and externally.
The final element is on monitoring and this is about conducting on-going and/or separate evaluations and evaluating and communicating deficiencies (McNally, 2013).This new framework is a combination of the SOX provision of communicating material internal control weakness.
From the deliberations, we try to define internal controls as a managerial tool which covers all set of daily activities in all areas of the organization, at all levels towards safeguarding the assets, ensuring compliance and transparency, communicating material weakness, protecting stakeholder interest in order to achieve the long-term goals of the organizational.We see internal controls as such a comprehensive activity that it covers the entirety of all that goes on in an organization.Even though external controls could be seen as a separate discipline, effective internal control systems should ensure that everything including external controls are religiously adhered to.
The benefits of observing internal controls are unchallenged.Although Bhagat and Jeffers Jr. (2002) outline external governance and other factors as capable of aligning the interests of managers and owners, internal governance does this better and goes a long way to deepen ethical behaviour on the part of managers.Legislation provide a one-size-fits-all approach to curb misbehaviour, internal controls have proven very successful in the world of business as capable of minimizing the pursuit of opportunistic tendencies by management.Internal controls minimize the agency costs and therefore increase profits and sales of companies who invest in it (Alves & Mendes, 2004;Fernández-Rodríguez, Gómez-Ansón & Cuervo-García, 2004;Goncharov, Werner & Zimmermann, 2006).Internal controls enhance the reputation of listed companies which has the tendency to affect share price positively (Fombrun & Shanley, 1990).This was confirmed by Hart (1995) who contended that reducing agency costs increase firm value.
The essence of internal controls is to reduce information asymmetry, promote best practices in transparency and protect shareholders against the power of rulers (Salhi & Boujelbene, 2012).
A critical look at most bank financial statements reveal very alarming figures anticipated as loan losses.This has been identified by American Institute of Certified Public Accountants (AICPA) (2006) as the top on the list of bank deficiencies.The observation of sound and effective internal controls is a major driver to investor confidence and earns the institution significant amount of reputational capital.The carelessness with which credit are initiated, funded, serviced and monitored has the tendency to trigger default, crisis and bank failure.Jin et al. (2013) found that banks without proper internal controls could grow temporarily but they have higher likelihood of failing in the near future.This defeats the going concern concept of organizations of which banks are no exception.In tracing the path to bank failure, the first stop point is credit risk which experienced through borrower default before liquidity and insolvency sets in.There is no bad borrower but always a bad lender.The trajectory of bank failure follows that credit risk leads to liquidity risk then to insolvency, bankruptcy and then failure.When banks fail, there is a greater disincentive to depositors, investors and the externalities on other banks.
The effectiveness of internal controls have been studied along the dimensions of the efficiency and effectiveness of activities, reliability of information and compliance with laws and regulations (Jokipii, 2006).Internal control systems were developed by the Basel Committee on Banking Supervision to ensure prudence and stability in the financial system.Anecdotal evidence from numerous bank failures and even the quite recent financial crisis gives support to the fact that credit is a major contributory factor to these failures.Banks benefit from transforming their liabilities into assets thus an incentive for optimal risk benefit behaviour is pursued but bank managers owe their principals a duty of care (fiduciary relationship).Moral hazards and adverse selection emanates from the exploitation of informational economies by counter parties and can be best be minimized if management is extra careful in its asset creation function.There is much empirical support to the fact that loans constitute the greatest proportion of bank assets (Casu et al., 2006;Mishkin, 2006).Ellul and Yerramilli (2013) reported that financial institutions with strong internal risk controls are able to survive financial crises and refute the claim that the financial crisis did not affect all institutions the same way as speculated by some experts in finance.It is not uncommon to find bank managers overambitiously creating very risk assets (credit facilities) in the name of higher return expectation.
Although there are a myriad of factors that contribute to credit risk, the most avoidable ones could be dealt with if there are sound and religiously-adhered-to internal controls within the institutions.
The rate of credit defaults has been so alarming in all areas of the financial services industry.
General Accounting Office (GAO) (1994) expressed worries about a seemingly unjustifiable provision for loan losses which lack evidence.Although the work of Altamuro and Beatty (2010) addressed this conservative attitude, they did not study the exact relationship between internal controls and credit risk.It was reported in separate studies that weak internal controls affect loan loss provision (GAO, 1991;GAO, 1994).
The study has been presented in the conceptual framework that combines all the necessary elements of internal controls widely used by researchers in this field.The framework for the study comprehensively encompasses all the elements of internal controls which are control environment, risk assessment, control activities, monitoring and information and communication systems.The key objectives of internal controls are effectiveness and efficiency of operations, reliability of financial reporting and compliance with applicable laws.These cardinal objectives of internal controls and attributes which are preventive, detective and curative have all been covered in the study.

Credit Risk
It is gradually becoming alarming the amount of provision for loan losses.This has been identified by AICPA (2006) as the number one deficiency of banks.Al-Tamimi and Al-Mazrooei (2007) studied UAE banks and reported that among three most important risks facing the banks was credit risk.Credit risk is the likelihood of a borrower or counter party defaulting in the conditions of a loan agreement, contract or indenture either in part or in full (Sobehart, Keenan & Stein, 2001).Banks stand to enjoy benefits of enjoying reputation capital, attracting more investments and being more profitable if they take risk management very serious.There is evidence that banks which have paid particular attention to risk management have benefited from credit availability which led to the creation of better bank assets and profitability (Cebenoyan & Strahan, 2004).Banks in Japan have had souring figures in the amount of nonperforming loans and provision for loan losses which are normally used as proxies for credit risk (Fukuda, Kasuya & Akashi, 2009).The writers reported of the warning from the Japanese government on the need for banks to reduce non-performing loans since it has seriously affected the financial health of the banking industry.Jiménez, Lopez and Saurina (2013) cited Salas and Saurina (2002) who studied Spanish commercial and savings banks and found that credit risk measured by non-performing loans is by bank size and rapid credit expansion.
Further evidence is provided about Spanish banking industry that lenient credit terms among other factors determines non-performing loans (Saurina & Jimenez, 2006).The cases of rapid credit expansion and lenient credit terms are traceable to weak internal control structures.
Credit risk affect the bank reputation and translate to other risks especially in situations where internal governance mechanisms are very weak (Haq, Faff, Seth & Mohanty, 2014).This makes credit risk an important issue for banks to deal with and we therefore use it as the dependent (outcome) variable around which internal controls and other bank specific factors revolve.
From the discussions above, we conjecture a relationship between internal controls and credit risk and therefore hypothesize that: There is significant relation between internal controls and credit risk.

Board Size
The size of the board of directors have influences over deliberations and control over management (Aliyu, Jamil & Mohamed, 2014).There are different schools of thought as to whether large or small board sizes positively affect performance of firms.Small board size reduce the agency cost associated with large board size (Eldenburg, Hermalin, Weisbach & Wosinska, 2004).Uwuigbe and Fakile (2012) chastised large board size for ineffectiveness and possible lack of coordination as compared to smaller board size.On the other hand (Chen & Al-Najjar, 2012) confirmed that large board size contributes positively to the performance of firms.Although this study is not about board size and performance, the bottom-line is the board's ability to contribute to deliberations, provide reliable information and avoid manipulations in board decisions.We therefore hypothesize that: Board size significantly affects credit risk.

Board Expertise in Finance
The numerous corporate scandals that occurred at the blind side of the board of directors of affected companies have brought caution to board composition.Some authors refer to it as board experience.Most board members especially for banks require that at least a good number of them should have some form of expertise in Banking and Finance.This requirement is given emphasis in the Sarbanes-Oxley Act of 2002.Burak Güner, Malmendier and Tate (2008) reported that board members with finance background significantly affect capital budgeting and capital structure decisions and policies of non-banks.We abstract from this finding and expect that with their expertise, board members with finance background should be capable of taking good risk assessment decisions which is a major pillar of internal control systems.Interesting and varying results on board expertise in finance were discovered in the pre and peri crisis period on the stock performance of banks (Minton, Taillard & Williamson, 2010).We hypothesize from the above that: Board expertise in finance significantly affects credit risk.

Management Experience
Apart from the board being experienced in finance, management should also be on top of their jobs.The agency problem rests so much on managerial decisions.The experience of management will go a long way to determine the kind portfolios they construct as well as other critical investment decisions (Burak Güner et al., 2008).The risk management element of internal controls requires that management become very experienced to ensure effective risk management and internal control.Ikpefan and Ojeka (2013) cited Central Bank of Nigeria ( 2006) that management and board expertise were vital corporate governance requirement to ensure effective internal governance.We therefore hypothesize that: Management experience has significant relationship with credit risk.

Revenue Diversification
Bank managers in their quest to be more profitable diversify their investments to have revenues from non-loan sources.The nature of financial intermediation has changed and banks have diversified their revenues tremendously (Haq et al., 2014).The incentive for banks to diversify, stems from related factors like bank size, management and board expertise and competition within the industry.Within the internal control framework, the extent and nature of diversification is captured as an important element which could be bring about management misbehaviour (McNally, 2013).There are mixed reports about the effect of diversification on non-performing loans and in some cases no relation is reported at all (Hu, Li & Chiu, 2006).
We anticipate a significantly positive relationship between diversification and credit risk since the incentive to be more profitable increases the risk exposure of banks as they expand and diversify.We hypothesize that: Revenue diversification has significant positive effect on bank credit risk.

Board Independence
One of the internal control elements is monitoring which is mostly performed by the board of directors.This means that if the board is very independent, there is the tendency for a better monitoring function.The ability for an independent board to be more efficient in monitoring management is given support from literature (Eling & Marek, 2009;Pathan, 2009).Eling and Marek found that monitoring had significant effect on risk taking behaviour of insurance companies in the UK and Germany.An earlier report by Agrawal and Mandelker (1990) revealed that monitoring should be actively done and that board members can be large in numbers and independent but not active.We therefore hypothesize that: Board independence significantly affects bank credit risk.

Compliance, Prudence and Safety
Banks are the most heavily regulated institution because of the risky nature of their business (Mishkin, 2006).Not all deposits are allowed to be given out as loans hence some reserve requirements should be kept against liquidity problems.Such practices ensure prudent bank management and safe keeping of bank assets (Casu et al., 2006).Internal control systems ensure compliance with such regulatory requirements.We hypothesize that: Compliance, prudence and safety significantly affect credit risk.

Audit Quality
The whole discipline of internal control falls within the domain of auditing.The audit committee performs a monitoring function to ensure sound and acceptable financial reporting and corporate accountability.Audit committees perform internal governance function to protect the company from impairment suffered from reputational risks (Zhang, Zhou & Zhou, 2007).It is expected banks with good audit quality will enhance effective internal control systems and therefore reduce credit risk.We hypothesize that: Audit quality has significant relationship with credit risk.

Quality and reliability of financial information
Stakeholders would want to express confidence in the timeliness and reliability of financial information management present.Especially with regulators, compromises with this condition attract fines and sanctions.Reliable financial information is an audit function banks would want to engage first class auditors to earn the organization some reputational capital (Zhang et al., 2007).

The quality and reliability of financial information significantly affect credit risk.
Apart from the independent variables, there are some variables which can influence credit risk but are not directly captured as internal control variables.These variables are controlled in the study and can be seen below.

Bank Size
There is enough literature support for bank size to affect decisions of internal controls and bank operations (Laeven & Levine, 2009).There is the tendency for large banks to be more very mindful of internal controls than small size banks.Size can determine the variety of credit products available to a financial institution (Eling & Marek, 2009).Small firms are likely to have lesser incentive to improve internal controls (Ashbaugh-Skaife, Collins & Kinney, 2007; Doyle, Ge & McVay, 2007) whilst larger banks might be well-resourced to invest in internal controls.Bank size was found to have negative relation with credit risk measured by nonperforming loans (Hu et al., 2006).We therefore control for bank size and hypothesize that: Bank size significantly affects credit risk.

Bank Age
Age of business affect the kind of investment and financing decisions.So much experience is acquired and companies which have been in business for long have good links and access to a lot of opportunities than new and upcoming ones.It is reported firms that have existed for long have less material internal control weakness (Tang, Tian & Yan, 2015).We hypothesize that: Bank age significantly affect credit risk.

Profitability intent (Net Interest Margin)
Altman (1968) and Hillegeist, Keating, Cram and Lundstedt (2004) found that a company could probably fail if it is unprofitable and highly leveraged.In a bid to avoid failure, banks pursue efforts to be very profitable (Shumway, 2001).There are various measures of profitability but the nature of the study focuses so much on loan activities so the most appropriate measure of profitability is net interest margin.We argue that the tendency to maximize profits which is very common with management could affect the kind of assets created.We therefore hypothesize from these abstractions that:

Corporate restructuring
When companies are restructured through a merger or acquisition or by any kind, the rules of engagement may change including internal controls.Chen, Dong, Han and Zhou (2013) found evidence of relation between corporate restructuring and internal control practices.It is therefore likely that after a restructure, internal control systems might improve or deteriorate which can affect the loan decisions and credit risk.We therefore conjecture that: Corporate restructuring significantly affects credit risk.

Leverage
The composition of debt in a bank's capital structure exposes it to some consequences and especially when default rate is high, servicing these debts becomes a problem.Corporate failure could emanate from high leverage (Altman, 1968;Hillegeist et al., 2004).We therefore hypothesize that: Leverage significantly affects bank credit risk.

Design/Methodology/Approach
The study design is purely a quantitative approach to establish the relationship between internal controls and credit risk.The statement and statistical test of hypotheses makes our study a deductive approach.Secondary data was obtained from Bankscope for eight banks listed on the Spanish Stock Exchange which had data available on over fifteen variables from the period 2004-2013.The sample description can be found in Table 1.The table above shows the variables, the expected number of observations, actual observations available for analysis and the missing values.
We also obtained corporate information about board members and management from corporate governance annual reports and company websites.The banks involved in this study had been operative for at least seven years within the ten-year study period.Our sample period covers some pre-crisis period to post-crisis period to ensure some balance even though we did not use any baseline period.We used listed banks because these are the banks that report major internal control information for public use.There are basic requirements about corporate governance and board characteristics of listed companies which is very crucial in this study.The unavailability of data for certain years on certain variables makes the data unbalanced, however basic assumptions regarding the use of panel data were met thus justifying the study.

Empirical models
We propose a general equation for the study that credit risk is a function of internal controls.
This equation is further decomposed to arrive at the overall model that contains all the independent and control variables using their proxies.From Equation ( 1) Where CRit = Credit risk for bank i for the time period t

INTCONT = internal controls
The Equation (1) above covers the topic that credit risk is a function of internal controls which means that there is a linear relationship between internal controls and credit risk.We decompose Equation ( 1) to obtain the variables representing internal controls to obtain (2) The independent variables which are the elements of internal control and the control variables have been included in Equation ( 3) for the general model.
Although the data is not perfectly balanced panel due to data unavailability for some banks in some years for some variables, the data passed reliability tests thus making the results very reliable.We use Generalized Least Squares regression to estimate the econometric model.Two main estimation techniques are used for GLS which are random effect and fixed effect models.
Usually, for panel data (times series cross-sectional data) fixed effect models controls for all time-invariant differences between the individuals so the estimated coefficients cannot be biased hence fixed effect model estimation is not ideal for time-invariant causes of the dependent variables (Torres-Reyna, 2007).For random effect estimations, the assumption is that the entity's error term is not correlated with the predictors thus allowing for time-invariant variables in the explanatory variables.
Torres-Reyna reported that random effect allows for generalization of inferences beyond the sample used.Hausman's test was performed to ensure reliability of data sets and also help select the most appropriate between fixed and random effects.Hausman's test tests whether the unique errors are correlated with the regressors.The Hausman's test suggested the use of random effect results for the regression.The random effect technique is robust to first order autoregressive disturbances (if any) within unbalanced panels and cross-sectional correlation and or heteroskedasticity across panels (Pathan, 2009).A summary of the dependent, independent and control variables with their exact measures and expected signs have been provided in Table 2. Table 2 shows the definition of dependent variable, elements of internal controls, our main independent variables and control variables.In all cases, some proxy variables were used to suit the nature of the study.

Descriptive statistics
The descriptive statistics covers the dependent, independent and control variables used in the study over the ten year period.A critical look at the mean (3.79%) and standard deviation (4.07%) for the dependent variable NPL shows relatively lower mean for the sample compared to the national current average of about 13%, there is so much variability as can be seen from the standard deviation.It can also be seen that the dependent variable is positively skewed and peaked with reference to the skewness and kurtosis.The means for the board characteristics like board independence and board expertise in finance and management experience are very encouraging with the ratios very close to one.The mean board size of almost 15 is an indication of relatively higher board size.However, apart from management experience, the skewness and peakness of the board and management characteristics are normal.The mean loans to total asset of almost 70% indicate over-reliance of loans as the core of bank assets.The mean age and number of new branches of banks sampled is 80 years and 118 respectively.Mean bank profitability intent of approximately 2% and the minimum, maximum and median values are consistent with normal practice and acceptable.A detailed display of the descriptive statistics which covers the mean, maximum, minimum, standard deviation, skewness, kurtosis and median can be found in Table 3.The study reports strong positive correlation between the number of years a bank has existed and the control environment, risk management, control activities, profitability intent and bank size.The association between the other variables can be found in the correlation matrix which can be found in Appendix A. The explanations of the abbreviated forms of the variables which is a key to the Pearson's correlation matrix also found in Appendix B.

Findings
The study sought to examine the effectiveness of internal control systems, explore the exposure of Spanish listed banks to default problems and establish the relationship between internal controls and credit risk.The effectiveness of internal controls is seen from the descriptive statistics.The mean values for control environment, risk assessment, control activities and monitoring are indications of attempt to make provision for effective internal control systems.There is high board independence, large board size, experienced management and high quality auditors.The study reveals that there is excessive desire to expand through over branching.This has serious implications for cost of maintaining branches and controlling activities.There is the tendency for head office to lose control in monitoring effectively what goes on in all branches at all times.When there is proliferation of bank branches in specific geographical areas, credit pollution through multiple borrowing is likely to occur since the same clients will receive duplicated credit services from different branches (Steinwand, 2000).The loan to deposit ratio of more than one (1) indicates that all deposits are absorbed by loans a situation which could trigger liquidity problems should there be any delay in the servicing of the loan.There is over-reliance on loans as the major asset component.This does not commensurate with the long years of existence and experience and expertise of board and management.Bank profitability intent is maintained within normal practice there is the need to compliment it with good banking practices in order to keep credit risk in control.
Variables like loans to deposit ratio debt to total asset ratio cast doubts on risk assessment function of top management and board.The encouraging figures for the characteristics of the board, management and auditors do not reflect the figures for monitoring, control environment, risk management, control activities and information and communication.This confirms Agrawal and Mandelker (1990) who emphasized board effectiveness and not necessarily board characteristics.The conditions created exposes Spanish banks to so much credit risk conditions.Risk taking decisions should be done upon careful risk assessment, measurement, implementation and evaluation.There was no evidence of reporting material internal control weakness and this seriously increases the risk exposure of banks.
The study finds very encouraging positive results for the independent variables.The results show that internal controls explain credit risk very much.The R-squared value indicates that 72% of variations in credit risk is attributable to internal controls.This can be found in Table 4.
The result indicates that internal controls are capable of determining credit risk.The result confirms the works of Ashbaugh-Skaife et al. (2007) who found some association between internal controls and several risk measures like idiosyncratic risks and higher systematic risk.
We find an improvement in the works of (Kim, Song & Zhang, 2011) who reported no relation between internal control weakness and credit risk.It was reported by Chen et al. ( 2013) that effective internal control system ensures good financial reporting and increases the confidence of investors on the capital market.In the case of banks as found in this case, if effective internal control systems are enshrined, the already waning public confidence in the Spanish banking industry as a result the collapse of several savings banks and over-indebtedness could be repaired to some extent.The emphasis on effective internal controls was found by Ellul and Yerramilli (2013) who reported that financial institutions with strong internal risk controls survive financial crisis.This is confirmed in our study looking at the explanatory power of internal controls to credit risk.The result is again in tandem with the findings of Tang et al. (2015) who found that internal control material weakness increases credit risk of firms.The authors established some relationship between internal controls and credit risk as has been found in our study.Looking at the individual explanatory variables, seven of them significantly explain credit risk at least at 95% confidence interval.Board size falls under the purview of control environment in the internal control framework.It is found that board size significantly affect credit risk.This finding agrees with Aliyu et al. (2014) who reported that board size influences good decisions and control.An effective control environment created by the board as a result of their size ensures segregation of duties and good human resource capacity.The positive correlation between control environment and credit risk rather confirms that larger board sizes do not necessarily ensure sound control environment (Uwuigbe & Fakile, 2012) contrary to the claim by Chen & Al-Najjar (2012) that larger board sizes ensure effective monitoring.In the study of Tunisian banks, Salhi and Boujelbene (2012) found same positive relation between board size and bank risk taking.
It is found that loan-to-deposit ratio which is a proxy variable for compliance and prudence found under the control activities element of the internal control framework significantly explained variations in bank credit risk.Control activities include ensuring approval limits are observed, minimizing conflict of interest and ensuring segregation of duties (Basel Committee on Banking Supervision, 2010).Although the result shows very significant relation between control activities and credit risk, the correlation coefficient surprisingly shows a negative relationship.This is contrary to our expectation and might be an indication of improper enforcement of these internal control mechanisms as reported by Agrawal and Mandelker (1990).They attribute such weaknesses to inactive board of directors.
Board expertise in finance and non-earning assets to total assets were used as proxy variables for risk management component of the internal control framework.The results show significant effect of risk management decisions on credit risk but report a positive relationship which is contrary to our expectation.The risk management function of board and management members is a function of their expertise and experience.The expertise of top management and board goes a long way to minimize internal control weakness (Ikpefan & Ojeka, 2013).The study confirms the assertion by Ikpefan and Ojeka since all the two variables for risk management were significant on the dependent variable.The result converges with the findings of Burak Güner et al. ( 2008) that board members with finance background significantly influence investment (including credit) and financing decisions.It is however interesting to find that a strong positive correlation existed between the risk management function of board and management on one side and credit risk.It stand to suggest that, these provisions are made but the implementers are not being effective as reported by Agrawal and Mandelker (1990).The result seem to disagree with Minton et al. (2010) who did not find the influence of board finance expertise in his study.
Board independence which falls under the monitoring component of the internal control framework significantly affects credit risk.The ability of independent board members to significantly affect risk taking behaviour, corporate decisions and overall performance has been confirmed (Eling & Marek, 2009;Pathan, 2009) and the result adds up to those schools of thought.It was reported by Erkens, Hung and Matos (2012) that financial firms with large board independence increased their risk taking behaviour.This is not different from the positive relation our study has found between board independence and credit risk.
How long the bank has been in existence significantly affected credit risk and the correlation was a negative one which means that the longer the years in business, the better the bank can minimize credit risk and vice versa.This was an expected result and confirms the findings of who found that the longer the years in business, the better the internal control system and vice versa (Tang et al., 2015).The study found that the intention to be profitable (measured by net interest margin) significantly affected credit risk (Shumway, 2001).This could lead to overambitious credit facilities which might eventually go bad.However, our expected negative correlation between profit intention and credit risk was not sustained.
It was found that all the banks used the top four international auditing firms so audit quality was dropped for collinearity in the running of the results.Again, financial information was reported on timely basis and as required so there was no need including that in output.The result confirms earlier studies on the relationship between internal controls and risk.
Ashbaugh-Skaife, Collins, Kinney Jr and Lafond (2009) found that weak internal control systems significantly resulted in higher idiosyncratic and systematic risks of firms.

Conclusion
The formalities of ensuring that internal control mechanisms are in place is unquestionable about Spanish banks as it can be seen that at least four of the internal control elements were significant predictors of credit risk.However, their effectiveness cannot be guaranteed because their correlation coefficients do not depict that there are effective internal control systems.
Where there are effective controls, there should be inverse relationships between internal control variables and credit risk but the reverse was the case in our study.Large board size, very independent board and high expertise and experience of board and management could not ensure control of excessive branching thus resulting in increasing non-performing loans.
The situation does not guarantee for effective internal controls.It is possible that since independent board members have no investment to protect, they were caught by the usual agency problem.
The seemingly ineffective internal control systems and the absence of strict enforcement of disclosure of material internal control weakness exposes the listed Spanish banks to major risks.This is because credit risk is a starting point for potential liquidity risk, insolvency and possible failure as have been witnessed in Spain.It is not surprising to see quite some number of banks no longer in operation; a situation that impairs public confidence in the banking system.
There is significant effect of internal controls on credit risk.The control environment, risk management, control activities and monitoring significantly affect credit risk.Board independence, expertise, large size and management experience does not guarantee effective internal controls.The agency problem still exists with independent board members who are not motivated to protect shareholders' investments.Internal control is not only under the purview of operational risk but also credit risk.When internal governance is effective, credit risk could be minimized.It is therefore not out of place to say that there is no bad borrower but a bad lender.Given that internal control systems were effective, some of the catastrophes (collapse of banks) could have been avoided.The situation whereby Spanish banks do not report material internal control weakness is not in the best interest of stakeholders and a full adoption of the revised COSO internal control framework that emphasizes reporting material internal controls will improve upon the situation.

Limitations/implications
The absence of data in certain years did not make the data a balanced panel data set.
Inactiveness of some banks in recent times did not allow the involvement of a larger number of banks thereby limiting the sample size.In any case, the sample size satisfied basic assumptions of the linear regression model.Data was not available on certain planned variables although there were proxy variables used.The use of quantitative variables for such a study does not allow for much flexibility and in-depth scrutiny of internal control systems.
The study compliment research with primary sources of data therefore providing a systems approach to investigating internal controls.These limitations do not cast doubts about the results though.The study has implications for policy makers, the Spanish Central Bank, potential investors and the general public as a whole.There are various schools of thought on the need to enact laws on internal controls (especially on reporting material internal control weakness) as can be found in the US, Britain and China.The study provides insight for such steps in to be initiated in Spain and other parts of Europe which might find this call worthy.

Practical implications
Banks have existing internal control systems and observe some of the principles.The study found that financial reporting and involvement of high class auditors was the practice of all the banks.Some banks are no longer in business leading to the involvement of only eight banks which was not the situation in Spain some few years ago.Practically, the result provides much confirmation as to how effective internal control systems could help minimize credit risk.This brings on board a new dimension of establishing the relationship between credit risk and operational risk because most risk management research classifies internal controls under operational risk.Bank management should not only consider internal controls as an operational risk issue but also credit risk.Again, it is not enough just to have the control mechanisms in place but the full implementation thereof.Shareholders should be wary of independent board members for their lack of motivation to protect the interest of shareholders (agency problem).

Social implications
Banks through financial intermediation keep the economy running.Banks owe it a social responsibility to stay in business.The failure of banks affects depositors through the loss of investments which brings serious externalities on other banks.When one bank fails, the confidence of public in banks is seriously impaired.The study emphasizes the social capital banks gain through effective and reliable internal control systems especially when material internal control weaknesses are reported.BURAK GÜNER, A.; MALMENDIER, U.; TATE, G. (2008)

Figure 1 .
Figure 1.Effect of internal controls on credit risk (Author's construct)

Table 1 .
Description of sample and variables
We indicate that there are bank-specific and other variables which could affect the dependent variable in one way or the other and must be controlled.These variables are bank size (

Table 2 .
Definition of variables