HSBC 2004 Annual Report Download - page 175

173
risks seeks to integrate the financial risks associated
with HSBC’ s insurance operations with similar risks
arising from other financial assets and liabilities not
directly associated with insurance and investment
liabilities.
Investment credit risk is the risk that financial
loss arises from the failure of an issuer of an
investment product or a counterparty to an
investment transaction to meet its obligations. Local
management of HSBC’ s operating insurance
companies are responsible for the quality and
performance of their respective investment
portfolios. Investment guidelines are set at a Group
level and refined by local ALCOs which review, on
a quarterly basis, investment management
performance and compliance with the guidelines.
Assessments of the creditworthiness of issuers and
counterparties are based primarily upon rating
agency and other publicly available information
together with investment concentrations. Investment
credit exposures are aggregated and reported to
HSBC’ s Group Credit and Risk function on a
quarterly basis.
Operational risk management
Operational risk is the risk of loss arising through
fraud, unauthorised activities, error, omission,
inefficiency, systems failure or from external events.
It is inherent to every business organisation and
covers a wide spectrum of issues.
HSBC manages this risk through a controls-
based environment in which processes are
documented, authorisation is independent and
transactions are reconciled and monitored. This is
supported by an independent programme of periodic
reviews undertaken by Internal Audit, and by
monitoring external operational risk events, which
ensure that HSBC stays in line with best practice and
takes account of lessons learned from publicised
operational failures within the financial services
industry.
HSBC has codified its operational risk
management process by issuing a high level
standard. This explains how HSBC manages
operational risk by identifying, assessing,
monitoring, controlling and mitigating the risk,
rectifying operational risk events, and implementing
any additional procedures required for compliance
with local regulatory requirements. The processes
undertaken to manage operational risk are
determined by reference to the scale and nature of
each HSBC operation. The HSBC standard covers
the following:
• Operational risk management responsibility is
assigned at senior management level within the
business operation.
• Information systems are used to record the
identification and assessment of operational
risks and generate appropriate, regular
management reporting.
• Operational risks are identified by risk
assessments covering operational risks facing
each business and risks inherent in processes,
activities and products. Risk assessment
incorporates a regular review of risks identified
to monitor significant changes.
• Operational risk loss data is collected and
reported to senior management. Aggregate
operational risk losses are recorded and details
of incidents above a materiality threshold are
reported to the Group Audit Committee and the
Risk Management Meeting.
• Risk mitigation, including insurance, is
considered where this is cost-effective.
In each of HSBC’s subsidiaries, local
management is responsible for implementation of the
HSBC standard on operational risk throughout their
operations and, where deficiencies are evident, these
are required to be rectified within a reasonable
timeframe. Subsidiaries acquired by HSBC since the
standard was issued are required to assess and plan
the implementation of the standard’ s requirements.
HSBC maintains and tests contingency facilities
to support operations in the event of disasters.
Additional reviews and tests were conducted
following the terrorist incidents of 11 September
2001 and, more recently, the two bomb blasts which
damaged two of HSBC’s buildings in Istanbul, to
incorporate lessons learned in the operational
recovery from those circumstances.
Reputational risk management
The reputation of HSBC is paramount to its success.
Reputational risks can arise from social, ethical or
environmental issues, or as a consequence of
operational risk events. As a banking group, HSBC’ s
good reputation depends upon the way in which it
conducts its business, but it can also be affected by
the way in which clients, to whom it provides
financial services, conduct themselves.
Reputational risks are considered and assessed
by the Board, the Group Management Board, the
Risk Management Meeting, subsidiary company
boards, board committees and/or senior management
during the formulation of policy and the
establishment of standards. Standards on all major