HSBC 2009 Annual Report Download - page 317

315
unusual circumstances not fully captured by
quantitative models.
• Centralised functional control is exercised over
all IT developments and operations. Common
systems are employed for similar business
processes wherever practicable. Credit, market
and operational risks are measured and reported
on in subsidiaries and aggregated for review of
risk concentrations on a Group-wide basis.
• Functional management in Group Management
Office is responsible for setting policies,
procedures and standards in the following areas
of risk: credit; market; liquidity; operational;
IT; fraud; business continuity; security;
information; insurance; accounting; tax; legal
and regulatory compliance; fiduciary; human
resources; reputational; sustainability and
purchasing. Authorities to enter into credit and
market risk exposures are delegated with limits
to line management of Group companies. The
concurrence of Group Management Office is
required, however, to credit proposals with
specified higher risk characteristics.
• Policies to guide subsidiary companies and
management at all levels in the conduct of
business to safeguard the Group’s reputation are
established by the Board of HSBC Holdings and
the Group Management Board, subsidiary
company boards, board committees and senior
management. Reputational risks can arise from
environmental, social or governance issues, or
as a consequence of operational risk events. As
a banking group, HSBC’s good reputation
depends upon the way in which it conducts its
business but it can also be affected by the way in
which clients, to which it provides financial
services, conduct their business or use financial
products and services.
• The establishment and maintenance of
appropriate systems of internal control is
primarily the responsibility of business
management. The internal audit function,
which is centrally controlled, monitors the
effectiveness of internal control structures
across the whole of HSBC focusing on the areas
of greatest risk to HSBC as determined using a
risk-based grading approach. The head of this
function reports to the Group Chairman and the
Group Audit Committee.
• Executive management is responsible for
ensuring that recommendations made by the
internal audit function are implemented within
an appropriate and agreed timetable.
Confirmation to this effect must be provided to
internal audit. Executive management must also
confirm annually as part of the internal audit
process that offices under their control have
taken or are in the process of taking the
appropriate actions to deal with all significant
recommendations made by external auditors in
management letters or by regulators following
regulatory inspections.
The Group Audit Committee has kept under
review the effectiveness of this system of internal
control and has reported regularly to the Board of
Directors. The key processes used by the Committee
in carrying out its reviews include: regular business
and operational risk assessments; regular reports
from the heads of key risk functions including
Internal Audit and Compliance; the production
annually of reviews of the internal control
framework applied at Group Management Office
and major operating subsidiary level measured
against HSBC benchmarks, which cover all internal
controls, both financial and non-financial; semi-
annual confirmations from chief executives of
principal subsidiary companies as to whether there
have been any material losses, contingencies or
uncertainties caused by weaknesses in internal
controls; internal audit reports; external audit
reports; prudential reviews; and regulatory reports.
The Group Audit Committee keeps under review a
‘Risk Map’ of the status of key risk areas which
impact the Group and considers whether the
mitigating actions put in place are appropriate. In
addition, where unexpected losses have arisen or
where incidents have occurred which indicate gaps
in the control framework or in adherence to Group
policies, the Group Audit Committee has reviewed
special reports, prepared at the instigation of
management, which analyse the cause of the issue,
the lessons learned and the actions proposed by
management to address the issue.
The Directors, through the Group Audit
Committee, have conducted an annual review of the
effectiveness of HSBC’s system of internal control
covering all material controls, including financial,
operational and compliance controls and risk
management systems and the adequacy of resources,
qualifications and experience of staff of the issuer’s
accounting and financial reporting function, and
their training programmes and budget. The Group
Audit Committee has received confirmation that
executive management has taken or is taking the
necessary action to remedy any failings or
weaknesses identified through the operation of
HSBC’s framework of controls.