HSBC 2011 Annual Report Download - page 205

203
Overview Operating & Financial Review Corporate Governance Financial Statements Shareholder Information
A centralised database is used to record the results of the operational risk management process. Operational risk self-
assessments are input and maintained by business units. To ensure that operational risk losses are consistently
reported and monitored at Group level, all Group companies are required to report individual losses when the net loss
is expected to exceed US$10,000.
For further details, see the Capital and Risk Management Pillar 3 Disclosures as at 31 December 2011, page 43.
Legal risk
(Unaudited)
Each operating company is required to have processes and procedures in place to manage legal risk that conform to
Group standards.
Legal risk falls within the definition of operational risk and includes:
• contractual risk, which is the risk that the rights and/or obligations of an HSBC company within a contractual
relationship are defective;
• dispute risk, which is made up of the risks that an HSBC company is subject to when it is involved in or
managing a potential or actual dispute;
• legislative risk, which is the risk that an HSBC company fails to adhere to the laws of the jurisdictions in which
it operates; and
• non-contractual rights risk, which is the risk that an HSBC company’s assets are not properly owned or are
infringed by others, or an HSBC company infringes another party’s rights.
We have a global legal function to assist management in controlling legal risk. The function provides legal advice
and support. The Group Legal department oversees the global legal function and is headed by a Group General
Counsel. There are legal departments in 58 of the countries in which we operate. There are also regional legal
functions in each of Europe, North America, Latin America, the Middle East and North Africa and Asia-Pacific
headed by Regional General Counsels as well as General Counsel responsible for each of the global businesses.
Compliance risk
(Unaudited)
Compliance risk falls within the definition of operational risk. All Group companies are required to observe the
letter and spirit of all relevant laws, codes, rules, regulations and standards of good market practice. These rules,
regulations, other standards and Group policies include those relating to anti-money laundering, anti-bribery and
corruption, counter terrorist financing and sanctions compliance.
The Group Compliance function supports line management in ensuring that there are adequate policies and
procedures, and is responsible for maintaining adequate resources to mitigate compliance risk. The Group
Compliance department oversees the global compliance function and is headed by the Head of Group Compliance
who reports to the Group Chief Risk Officer. There are compliance teams in all of the countries where we operate and
in all global business lines. These compliance teams are principally overseen by Regional Compliance Officers
located in Europe, North America, Latin America, the Middle East and North Africa and Asia-Pacific and each
business line is supported by a Global Business Compliance Officer.
Group Compliance policies and procedures require the prompt identification and escalation to Group Compliance
of all actual or suspected breaches of any law, rule, regulation, Group policy or other relevant requirement. These
escalation procedures are supplemented by a requirement for the submission of compliance certificates at the half-
year and year-end by all Group companies detailing any known breaches as above. The contents of these escalation
and certification processes are used for reporting to the Risk Management Meeting, the Group Risk Committee and
the Board and disclosure in the Annual Report and Accounts and Interim Report, if appropriate.
Global security and fraud risk
(Unaudited)
Security and fraud risk issues are managed at Group level by Global Security and Fraud Risk. This unit, which
has responsibility for physical risk, fraud, information and contingency risk, and geopolitical risk and business
intelligence is fully integrated within the central Group Risk function. This enables management to identify and