1. Introduction

The role of internal risk governance in improving the performance of banks has garnered increasing attention in both academic and practical discussions. This interest arises from the evolving complexity of financial systems and the pivotal role that banks play in maintaining financial stability. Within this context, city commercial banks (CCBs) in China represent a crucial yet vulnerable segment of the banking industry. Originating as smaller, regionally focused institutions, these banks have expanded significantly over the past decade, contributing to local economic development by supporting small- and medium-sized enterprises. However, they face unique challenges compared to larger state-owned and joint-stock commercial banks, including greater dependence on local government policies and weaker internal governance frameworks. Existing studies highlight that deficiencies in internal risk governance mechanisms—such as inadequate risk assessment, poor communication channels, and weak supervision—exacerbate vulnerabilities in bank performance, particularly in smaller banks lacking sophisticated management systems [1,2]. Moreover, the theoretical discourse on internal risk governance frequently references Principal-Agent Theory to explain the misalignment of interests between shareholders and managers, which can lead to moral hazard and adverse selection in risk-taking behavior [3]. Risk Management Theory further underscores the necessity of robust governance structures to mitigate these issues, suggesting that enhanced internal risk governance can directly improve bank stability and profitability [4]. Nonetheless, empirical evidence on the specific mechanisms through which internal governance influences bank performance, particularly in the unique context of CCBs, remains sparse and fragmented.

Despite the critical importance of internal risk governance, research on its specific mechanisms and their implications for city commercial banks' performance is limited. While larger banks benefit from extensive studies and well-documented governance frameworks, CCBs have received comparatively little attention in both academic literature and policy discussions. This oversight is concerning, given the significant role of CCBs in China's financial system, accounting for over 13% of total banking assets as of 2022 [1]. Moreover, the operational inefficiencies and governance challenges faced by these banks are compounded by external pressures from regulatory reforms and competitive market dynamics, which have intensified in recent years [5]. Scholars have noted that the governance structures of CCBs are often characterized by concentrated ownership, limited board independence, and inadequate risk management practices, making them particularly vulnerable to financial instability and performance declines [6,7]. This vulnerability is further underscored by instances of governance failures, such as the bankruptcy of Baoshang Bank and restructuring challenges faced by other city commercial banks. These cases highlight the urgent need for targeted research and practical solutions. Furthermore, the lack of comprehensive quantitative studies integrating internal governance, risk management, and performance metrics hinders the development of effective strategies to address these challenges.

The primary objective of this study is to examine the influence of internal risk governance on the performance of city commercial banks, drawing on Principal-Agent Theory and Risk Management Theory to construct a theoretical framework. This research seeks to quantify the relationships among internal governance mechanisms, risk-taking behavior, and performance outcomes. Additionally, it aims to address the mediating role of risk-taking behavior, providing empirical evidence to support theoretical propositions about the effectiveness of governance structures in reducing risk exposure and enhancing profitability. The study also explores the heterogeneity of these relationships across different ownership structures, with particular attention to the distinctions between state-owned and non-state-owned CCBs [1,6]. By bridging gaps in the existing literature and offering practical insights, this study aspires to contribute to the broader discourse on risk governance, emphasizing its critical role in ensuring the stability and sustainability of city commercial banks in an increasingly volatile financial landscape.

2. Literature Review

Understanding the dynamics of bank performance necessitates a comprehensive exploration of theoretical frameworks that connect governance structures, risk management practices, and performance outcomes. This study emphasizes three interconnected aspects of governance mechanisms: the application of Principal-Agent Theory to address the challenges and opportunities in aligning management decisions with shareholder interests, the structural and functional components of internal risk governance systems, and the direct linkages between risk governance quality and bank performance. These aspects are not merely theoretical constructs but also practical tools to enhance the stability and profitability of banks, particularly city commercial banks (CCBs) operating under unique ownership and regulatory pressures. By synthesizing perspectives from existing literature, this review lays the foundation for understanding how governance mechanisms mediate relationships between risk, operational strategies, and financial outcomes.

2.1. The Relationship Between Principal-Agent Theory and Risk Governance

Principal-Agent Theory provides a critical lens through which the dynamics of bank governance can be analyzed. At its core, this theory addresses inherent conflicts between principals (owners or shareholders) and agents (managers) arising from information asymmetry and divergent interests. In banking, these issues are exacerbated by the high stakes of financial decision-making, which often involves substantial risk exposure. Shareholders, primarily focused on maximizing returns, delegate decision-making authority to managers, who may prioritize personal gains or adopt risk-averse strategies that diverge from shareholder expectations [8]. This misalignment often manifests as moral hazard, where managers engage in excessive risk-taking with the expectation that losses will be absorbed by the broader institution, or adverse selection, where banks undertake high-risk investments without adequate due diligence [2]. Risk governance frameworks aim to mitigate these issues by establishing clear accountability and robust monitoring mechanisms. For example, implementing a risk management committee and appointing a Chief Risk Officer (CRO) are key measures to ensure managerial actions align with shareholder interests. These governance structures enhance transparency and create an environment where risk-taking is carefully calibrated to balance profitability with long-term stability [4]. However, empirical evidence suggests the effectiveness of these mechanisms varies significantly across different types of banks. State-owned banks, for instance, often exhibit lower governance quality due to political interference, whereas joint-stock banks tend to have more robust governance systems that effectively curb excessive risk-taking [7].

Risk transfer mechanisms further complicate the Principal-Agent dynamic. Shareholders may encourage high-risk, high-reward investments, transferring potential losses to creditors through leverage and risky lending practices [3]. While potentially lucrative in the short term, this behavior poses significant long-term risks to institutional stability and performance. Effective risk governance must address these conflicts by incorporating checks and balances that limit the scope for risk transfer and align managers' risk appetite with the institution's overall objectives [1]. Moreover, governance structures that integrate risk management into decision-making processes have been shown to reduce agency conflicts, thereby enhancing operational efficiency and financial performance [4]. These findings underscore the importance of a nuanced understanding of Principal-Agent Theory in designing governance frameworks capable of navigating the complexities of risk in the banking sector.

2.2. Definition, Components, and Theoretical Mechanisms of Internal Risk Governance

Internal risk governance encompasses the systems, processes, and practices banks employ to identify, assess, and mitigate risks. It is a multidimensional concept integrating risk assessment, communication, environmental controls, activity controls, and supervision into a cohesive framework [9]. The Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies five core components of internal risk governance: control environment, risk assessment, control activities, information and communication, and monitoring activities. Collectively, these components ensure that risks are not only identified but also effectively managed to align with the institution's strategic objectives [10]. For city commercial banks, which often operate under constraints such as limited resources and regional economic dependencies, implementing these components is particularly critical. The control environment establishes a culture of accountability and ethical behavior, setting the tone for the institution, while risk assessment systematically identifies and prioritizes potential threats [8]. Control activities, including audits and compliance checks, provide the operational backbone for risk management, whereas communication mechanisms ensure that risk-related information flows seamlessly across the organization [9].

The theoretical mechanisms underlying internal risk governance draw heavily from Principal-Agent Theory and Risk Management Theory. Principal-Agent Theory emphasizes the role of governance structures in aligning managerial actions with shareholder interests, thereby reducing agency conflicts and promoting effective risk management [2]. In contrast, Risk Management Theory focuses on the systematic identification and mitigation of risks to ensure organizational stability and resilience [4]. Together, these theories provide a robust framework for understanding how internal risk governance can enhance both operational efficiency and financial performance. For instance, the establishment of a risk management committee, as mandated by regulatory frameworks such as Basel III, has been shown to significantly improve the quality of internal controls and reduce the likelihood of financial mismanagement [11]. Similarly, integrating advanced analytics and technology into risk assessment processes has enabled banks to better anticipate and mitigate potential threats, thereby enhancing their overall governance quality [9]. These theoretical insights underscore the critical role of internal risk governance in navigating the complexities of the modern financial landscape.

2.3. The Linkage Between Risk Governance Quality and Bank Performance

The quality of risk governance has a direct and profound impact on bank performance, influencing both profitability and stability. High-quality risk governance frameworks mitigate risk exposure by ensuring that potential threats are identified and addressed before they escalate into significant financial losses [1]. For city commercial banks, which often operate with tighter margins and higher exposure to local economic fluctuations, effective risk governance is especially crucial. Enhanced risk management practices not only improve operational efficiency but also contribute to higher profitability by reducing costs associated with financial mismanagement and regulatory penalties [4]. Moreover, robust governance frameworks foster a culture of accountability and ethical behavior, further strengthening stakeholder confidence and enhancing the institution's reputation [9]. Empirical studies consistently demonstrate a positive correlation between governance quality and financial performance. Banks that implement comprehensive risk management systems report higher returns on assets and equity compared to peers with weaker governance structures [12]. These findings highlight the importance of investing in governance mechanisms that address immediate risks and contribute to the institution's long-term sustainability and growth.

3. Impact of Internal Risk Governance on Bank Performance

Internal risk governance has emerged as a central factor influencing the performance of city commercial banks, particularly in an evolving financial landscape marked by increasing regulatory requirements and competitive pressures. This chapter explores the mechanisms and theoretical underpinnings that illustrate how internal risk governance directly and indirectly impacts bank performance. The analysis incorporates insights from the COSO Framework, which identifies critical dimensions of internal control, and examines how these components contribute to mitigating risks and enhancing operational efficiency. Furthermore, the discussion extends to explore the theoretical pathways through which governance frameworks foster improved financial outcomes and the unique characteristics of internal governance compared to alternative models. Through these perspectives, this chapter provides a comprehensive understanding of the integral role internal governance plays in addressing the challenges faced by city commercial banks and in supporting sustainable performance.

3.1. Analyzing the Five Components of Internal Control (COSO)

The COSO Framework offers a structured approach to internal control, underscoring its importance in ensuring effective governance and operational efficiency. Information and communication serve as the backbone of risk management, ensuring that all relevant stakeholders within the bank have access to accurate and timely information. This component fosters transparency and enables managers to make informed decisions aligned with the bank's strategic objectives. Environmental control establishes a culture of accountability and ethical behavior, creating a robust foundation for risk governance. It encompasses policies, practices, and attitudes that shape the bank's risk appetite and decision-making processes. Activity control involves implementing specific procedures to address identified risks. These activities are tailored to mitigate risks at various levels of the organization, ensuring that potential threats are effectively managed before they escalate [5]. Risk assessment focuses on identifying and evaluating potential risks that could impact the bank's operations and financial stability. By prioritizing these risks, banks can allocate resources more effectively, addressing the most critical threats first. Finally, supervision ensures that all risk management activities are monitored and evaluated to maintain their effectiveness over time. This includes the periodic review of internal controls to adapt to changes in the external environment and organizational dynamics [13]. Together, these components form an integrated framework that safeguards the bank's assets and enhances its ability to achieve strategic objectives.

3.2. How Internal Governance Mechanisms Reduce Risk-Taking Behavior

Effective internal governance mechanisms play a pivotal role in curbing excessive risk-taking behavior, a significant determinant of bank performance. City commercial banks, in particular, face challenges associated with concentrated ownership structures and limited board independence, which often lead to higher levels of risk-taking. Governance mechanisms, such as the establishment of risk committees, the appointment of independent directors, and the implementation of stringent risk management policies, address these challenges by creating checks and balances within the organization [3]. For instance, risk committees provide oversight and guidance on risk-related matters, ensuring decisions align with the bank's overall risk appetite. Independent directors bring diverse perspectives, reducing the likelihood of groupthink, which can lead to poor decision-making. Additionally, robust internal audit systems and regular compliance checks further strengthen the governance framework by identifying and addressing potential issues before they affect the bank's performance. Empirical studies show that banks with strong governance mechanisms tend to exhibit lower levels of non-performing loans and higher returns on equity, highlighting the effectiveness of these practices in reducing risk-taking behavior [4]. Moreover, integrating advanced risk management tools and analytics enables banks to better anticipate and mitigate potential threats, further enhancing their resilience in a volatile financial environment.

3.3. Theoretical Paths for Improving Bank Performance

Theoretical perspectives on the relationship between internal governance and bank performance underscore the critical role of risk management in driving financial outcomes. Principal-Agent Theory highlights the importance of aligning the interests of managers and shareholders to reduce agency conflicts and promote effective decision-making [2]. By implementing governance structures that ensure accountability and transparency, banks can minimize the impact of moral hazard and adverse selection on their operations. Risk Management Theory further emphasizes the need for a proactive approach to identifying and mitigating risks, suggesting that banks with robust governance frameworks are better positioned to navigate uncertainties and capitalize on opportunities [1]. These theoretical insights are supported by empirical evidence, which shows that banks with comprehensive governance mechanisms tend to achieve higher levels of profitability and stability. For instance, studies have found that integrating risk management practices into strategic planning enhances a bank's ability to adapt to changing market conditions, thereby improving its competitive position [3]. Additionally, adopting innovative technologies and analytics in risk management processes significantly enhances governance effectiveness, enabling banks to better anticipate and respond to emerging threats.

4. Comparing Traditional Corporate Governance with Internal Risk Governance

Understanding the distinctions between traditional corporate governance and internal risk governance is essential for comprehending how city commercial banks (CCBs) operate under unique conditions. While traditional governance models often focus on broad aspects of shareholder management, transparency, and accountability, internal risk governance emphasizes risk-specific mechanisms aimed at safeguarding financial stability and optimizing performance. This chapter integrates insights from corporate governance frameworks with the specific challenges faced by CCBs. By exploring the theoretical and practical differences between these governance paradigms, the discussion provides a foundation for examining how the uniqueness of CCBs shapes their risk governance strategies. It also highlights how these banks navigate external pressures, such as regulatory compliance and competitive market forces, while maintaining a focus on internal organizational dynamics and risk mitigation. By addressing these aspects, this chapter contributes to a nuanced understanding of how governance models adapt to the demands of increasingly complex financial environments.

4.1. Comparing Traditional Corporate Governance with Internal Risk Governance

Traditional corporate governance ensures accountability, fairness, and transparency in a company’s relationship with its stakeholders, particularly shareholders, through a well-defined framework of rules and practices. It aims to prevent managerial self-interest and align management decisions with stakeholder interests [7]. In contrast, internal risk governance adopts a more specialized approach, targeting the identification, assessment, and management of risks that directly impact a bank's operational and financial stability. While traditional governance relies on shareholder activism, board independence, and executive accountability, internal risk governance incorporates specific structures, such as risk committees, Chief Risk Officers (CROs), and compliance mechanisms tailored to address risk-specific challenges [14]. For example, the COSO framework emphasizes integrating risk management into operational processes, demonstrating how risk governance focuses not only on financial outcomes but also on systemic stability. Empirical studies suggest that traditional corporate governance mechanisms play an indirect role in mitigating risks by enhancing overall organizational discipline. In contrast, internal risk governance directly reduces risk exposure by embedding risk awareness into decision-making processes [9]. This distinction is particularly significant in the banking sector, where inherent risks in daily operations can lead to consequences extending beyond individual institutions to the broader financial system [3]. These differences underscore the need for banks, particularly CCBs, to adopt robust internal governance mechanisms that complement traditional corporate governance frameworks.

4.2. Examining the Uniqueness of City Commercial Banks and Its Implications for Risk Governance

City commercial banks operate under unique conditions that significantly influence their governance structures and risk management practices. Unlike larger state-owned or joint-stock commercial banks, CCBs often feature concentrated ownership structures, with local governments or dominant corporate shareholders holding significant stakes. This concentration creates both opportunities and challenges for risk governance. On the one hand, it allows for more direct oversight and decision-making efficiency. On the other hand, it increases the risk of related-party transactions, conflicts of interest, and governance failures [7]. The limited geographic scope and scale of CCBs also make them more susceptible to regional economic fluctuations, further emphasizing the need for tailored risk governance strategies [1]. Additionally, the historical evolution of CCBs from credit unions to full-fledged commercial banks has left many institutions with legacy governance structures ill-equipped to address the complexities of modern banking risks. These unique characteristics necessitate a governance model that integrates traditional corporate practices with risk-specific mechanisms, ensuring that CCBs can navigate their distinct challenges while maintaining stability and performance [5]. The regulatory environment for CCBs often imposes stringent compliance requirements, such as higher capital adequacy ratios and tighter controls on lending practices, further underscoring the importance of robust internal governance frameworks. Studies indicate that CCBs with well-developed risk governance systems exhibit greater resilience to financial shocks and better alignment with regulatory expectations [15]. These findings highlight the profound implications of CCBs' uniqueness for designing and implementing effective risk governance strategies.

4.3. Implications for Future Research and Governance Practices

The comparative analysis of traditional corporate governance and internal risk governance highlights several avenues for future research and practice. One critical area is the development of hybrid governance models that integrate the strengths of both approaches, creating comprehensive frameworks to address the multifaceted challenges faced by modern financial institutions. For CCBs, such integration could involve combining shareholder-centric practices with risk-focused mechanisms, ensuring governance systems are both inclusive and effective in mitigating risks. Another area of focus is the role of technology in enhancing governance practices. The adoption of advanced analytics, artificial intelligence, and blockchain technologies has the potential to revolutionize how banks monitor and manage risks, making governance systems more adaptive and responsive to emerging threats [3]. Additionally, the role of regulatory frameworks in shaping governance practices warrants further investigation. While current regulations establish a baseline for governance standards, more dynamic and flexible approaches may be needed to accommodate the unique challenges faced by institutions like CCBs. Finally, the impact of cultural and organizational factors on governance effectiveness remains underexplored. Understanding how organizational culture, leadership styles, and stakeholder expectations influence governance outcomes can provide valuable insights for designing more effective systems [7]. By addressing these research gaps, future studies can contribute to developing governance practices that not only enhance bank performance but also promote systemic stability in the financial sector.

5. Conclusion

This study highlights the critical role of internal risk governance in enhancing the performance and stability of city commercial banks (CCBs), particularly given their unique challenges such as concentrated ownership structures, regional economic dependencies, and limited resources. By integrating theoretical frameworks, including Principal-Agent Theory and Risk Management Theory, the research demonstrates how robust governance mechanisms reduce risk-taking behaviors and improve financial outcomes. Empirical findings underscore the effectiveness of comprehensive governance frameworks, such as those guided by the COSO Framework, in mitigating risks, aligning managerial decisions with shareholder interests, and enhancing profitability. The unique characteristics of CCBs necessitate tailored governance strategies that address their specific vulnerabilities, including regulatory requirements, ownership concentration, and regional economic fluctuations. Additionally, the study emphasizes the importance of adopting innovative technologies and analytics to strengthen governance systems and enhance their adaptability to emerging financial threats. Overall, the findings suggest that by prioritizing internal risk governance and aligning it with broader corporate governance frameworks, CCBs can achieve greater resilience, operational efficiency, and financial stability. This alignment ultimately contributes to the sustainable development of the banking sector as a whole. Future research should focus on refining governance practices, exploring the role of technology in enhancing governance effectiveness, and examining cultural and organizational factors that influence governance outcomes across diverse banking environments.