HSBC 2012 Annual Report Download - page 274

HSBC HOLDINGS PLC
Report of the Directors: Operating and Financial Review (continued)
Risk > Appendix – Risk policies and practices > Operational risk / Risk management of insurance operations
272
of fraud (e.g. card fraud, non-card fraud and internal fraud, including investigations), is established within one
management structure and is part of the Global Risk function.
We use technology extensively to prevent and detect fraud. For example, customers’ credit and debit card spending is
monitored continuously and suspicious transactions are highlighted for verification, internet banking sessions are
reviewed and transactions monitored in a similar way and all new account applications are screened for fraud. We
have a fraud systems strategy which is designed to provide minimum standards and allow easier sharing of best
practices to detect fraud and minimise false alerts.
We have developed a holistic and effective anti-fraud strategy comprising fraud prevention policies and practices, the
implementation of strong internal controls, an investigations response team and liaison with law enforcement where
appropriate.
The Contingency Risk function is responsible for ensuring that in any circumstances where our employees,
customers or buildings are exposed to a disaster or other catastrophic event, normal business operations can be
restored promptly.
Within this wider risk, Business Continuity Management covers the pre-planning for the recovery, seeking to
minimise the adverse effects of major business disruption, either globally, regionally or within country, against a
range of actual or emerging risks. The pre-planning concentrates on the protection of customer services, our staff,
revenue generation and the integrity of data and documents.
Each business has its own recovery plan, which is developed following the completion of a Business Impact
Analysis. This determines how much time the business could sustain an outage before the level of losses becomes
unacceptable, i.e. its criticality. These plans are reviewed and tested every year. The planning is undertaken against
Group policy and standards and each business confirms in an annual compliance certificate that all have been met.
Should there be exceptions, these are raised and their short-term resolution is overseen by Group and regional
business continuity teams.
It is important that plans are dynamic and meet all risks, particularly those of an emerging nature such as possible
pandemics and the eurozone crisis. The operational risk framework is used to measure our resilience to these risks,
and is confirmed to Group and regional risk committees.
Resilience is managed through various risk mitigation measures. These include agreeing with IT acceptable recovery
times of systems, ensuring our critical buildings have the correct infrastructure to enable ongoing operations,
requiring critical vendors to have their own recovery plans and arranging with Group insurance appropriate cover
for business interruption costs.
Systems risk
(Unaudited)
Systems risk is the risk of failure or other deficiency in the automated platforms that support the Group’s daily
execution (application systems) and the systems infrastructure on which they reside (data centres, networks and
distributed computers).
The management of systems risk is overseen globally by the HSBC Technology and Services (‘HTS’) organisation.
Oversight is provided through monthly risk management committee meetings that provide a comprehensive overview
of existing and emerging top risks.
HTS line management manages the control environment over systems risks using Risk and Control Assessments and
Top Risk Analysis. Key risk indicators are used to assure a consistent basis of risk evaluation across geographic and
line of business boundaries.
Business critical services have been identified through a central, global oversight body. Quantitative scorecards,
called Risk Appetite Statements, have been established for each of these services.
Vendor risk management
(Unaudited)
Our vendor risk management (‘VRM’) is a global framework for managing risk with third party vendors, especially
where we are reliant on outsourced agreements to provide critical services to our customers. VRM contains a
rigorous process to identify material contracts and their key risks and ensure controls are in place to manage and
mitigate these risks.