HSBC 2004 Annual Report Download - page 212

HSBC HOLDINGS PLC
Report of the Directors (continued)
210
HSBC’s key internal control procedures include
the following:
• Authority to operate the various subsidiaries is
delegated to their respective chief executive
officers within limits set by the Board of
Directors of HSBC Holdings or by the Group
Management Board under powers delegated by
the Board. Sub-delegation of authority from the
Group Management Board to individuals
requires these individuals, within their
respective delegation, to maintain a clear and
appropriate apportionment of significant
responsibilities and to oversee the establishment
and maintenance of systems of controls
appropriate to the business. The appointment of
executives to the most senior positions within
HSBC requires the approval of the Board of
Directors of HSBC Holdings.
• Functional, operating, financial reporting and
certain management reporting standards are
established by Group Head Office management
for application across the whole of HSBC.
These are supplemented by operating standards
set by functional and local management as
required for the type of business and
geographical location of each subsidiary.
• Systems and procedures are in place in HSBC to
identify, control and report on the major risks
including credit, changes in the market prices of
financial instruments, liquidity, operational
error, breaches of law or regulations,
unauthorised activities and fraud. Exposure to
these risks is monitored by asset and liability
committees and executive committees in
subsidiaries and by the Group Management
Board for HSBC as a whole.
• Customer groups, global product groups, key
support functions and certain discrete
geographies prepare strategic plans periodically
within the framework of the Group Strategic
Plan. Operating plans are required to be
prepared and adopted by all HSBC members
annually, setting out the key business initiatives
and the likely financial effects of those
initiatives.
• Centralised functional control is exercised over
all computer system developments and
operations. Common systems are employed
where possible for similar business processes.
Credit and market risks are measured and
reported on in subsidiaries and aggregated for
review of risk concentrations on a group-wide
basis.
• Responsibilities for financial performance
against plans and for capital expenditure, credit
exposures and market risk exposures are
delegated with limits to line management in the
subsidiaries. In addition, functional management
in Group Head Office has been given
responsibility to set policies, procedures and
standards in the areas of: finance; legal and
regulatory compliance; internal audit; human
resources; credit; market risk; operational risk;
computer systems and operations; property
management; and for certain global product
lines.
• Policies and procedures to guide subsidiary
companies and management at all levels in the
conduct of business to safeguard the Group’ s
reputation are established by the Board of
HSBC Holdings, the Group Management Board,
subsidiary company boards, board committees
or senior management. Reputational risks can
arise from social, ethical or environmental
issues, or as a consequence of operational risk
events. As a banking group, HSBC’s good
reputation depends upon the way in which it
conducts its business but it can also be affected
by the way in which clients, to which it provides
financial services, conduct their business.
• The internal audit function, which is centrally
controlled, monitors compliance with policies
and standards and the effectiveness of internal
control structures across the whole of HSBC.
The work of the internal audit function is
focused on areas of greatest risk to HSBC as
determined by a risk-based approach. The head
of this function reports to the Group Chairman
and the Group Audit Committee.
The Group Audit Committee has kept under
review the effectiveness of this system of internal
control and has reported regularly to the Board of
Directors. The key processes used by the Committee
in carrying out its reviews include: regular reports
from the heads of key risk functions; the production
annually of reviews of the internal control
framework applied at Group Head Office and major
operating subsidiary level measured against HSBC
benchmarks, which cover all internal controls, both
financial and non-financial; annual confirmations
from chief executives of principal subsidiary
companies that there have been no material losses,
contingencies or uncertainties caused by weaknesses
in internal controls; internal audit reports; external
audit reports; prudential reviews; and regulatory
reports.