risk-related disclosures; annual reports; operational risk; capital structure; stakeholders; Portugal; commercial banks; legitimacy theory; resources-based perspectives