HSBC 2015 Annual Report Download - page 220

Report of the Directors: Risk (continued)
Appendix to Risk – Policies and practices
HSBC HOLDINGS PLC
218
responsibilities and ensures that business activity and decisions are underpinned by a robust consideration and management
of associated risks supporting delivery of the required fair outcomes for customers and maintenance of market integrity. Our
focus on compliance and conduct issues is further reinforced by the Financial System Vulnerabilities Committee, which reports
to the Board on matters relating to financial crime and financial system abuse and provides a forward-looking perspective on
financial crime risk. In addition, the Conduct & Values Committee reports to the Board on matters relating to delivery of the
required global conduct outcomes for customers and the orderly and transparent operation of financial markets, together with
adherence to HSBC’s Values.
Legal risk
Each legal department is required to have processes and procedures in place to manage legal risk that conform to Group
standards.
Legal risk falls within the definition of operational risk and includes:
• contractual risk, which is the risk of a member of HSBC suffering financial loss, legal or regulatory action or reputational
damage because its rights and/or obligations under a contract to which it is a party are technically defective;
• dispute adjudication risk, which is the risk of a member of HSBC suffering financial loss or reputational damage due to
an adverse dispute environment or a failure to take appropriate steps to defend, prosecute and/or resolve actual or
threatened legal claims brought against or by a Group member, including for the avoidance of doubt, regulatory matters;
• legislative risk, which is the risk that a Group member fails to or is unable to identify, analyse, track, assess or correctly
interpret applicable legislation, case law or regulation, or new regulatory, legislative or doctrinal interpretations of existing
laws or regulations, or decisions in the Courts or regulatory bodies; and
• non-contractual rights risk, which is the risk that a Group member’s assets are not properly owned or protected or are
infringed by others, or a Group member infringes another party’s rights.
There are legal departments in 47 of the countries in which we operate. In addition to the Group Legal function, there are
regional legal sub-functions in each of Europe, North America, Latin America, the Middle East and North Africa and Asia
headed by Regional General Counsels, and a Global General Counsel responsible for each of the global businesses.
Global security and fraud risk
Security and fraud risk issues are managed at Group level by Global Security and Fraud Risk. This unit, which has responsibility
for information, fraud, contingency, financial intelligence, physical and geopolitical risks is fully integrated within the central
Global Risk function. This enables management to identify and mitigate the permutations of these and other non-financial risks
to its business lines across the jurisdictions in which we operate.
• The Information Security Risk sub-function is responsible for defining the strategy and policy by which the organisation
protects its information assets and services from compromise, corruption or loss, whether caused deliberately or
inadvertently by internal or external parties. It provides independent advice, guidance and oversight to the business about
the effectiveness of information security controls and practices in place or being proposed.
• The Fraud Risk sub-function is responsible for ensuring that effective prevention, detection and investigation measures are
in place against all forms of fraudulent activity, whether initiated internally or externally, and is available to support any
part of the business. To achieve that and to attain the level of integration needed to face the threat, the management of all
types of fraud (e.g. card fraud, non-card fraud and internal fraud, including investigations) is established within one
management structure and is part of the Global Risk function. We use technology extensively to prevent and detect fraud.
For example, customers’ credit and debit card spending is monitored continuously and suspicious transactions are
highlighted for verification, internet banking sessions are reviewed and transactions monitored in a similar way and all new
account applications are screened for fraud. We have a fraud systems strategy which is designed to provide minimum
standards and allow easier sharing of best practices to detect fraud and minimise false alerts. We have developed a holistic
and effective anti-fraud strategy which, in addition to the use of advanced technology, includes fraud prevention policies
and practices, the implementation of strong internal controls, investigations response teams and liaison with law
enforcement where appropriate.
• The Contingency Risk sub-function is responsible for ensuring that the group’s critical systems, processes and functions
have the resilience to maintain continuity in the face of major disruptive events. Within this wider risk, business continuity
management covers the pre-planning for recovery, seeking to minimise the adverse effects of major business disruption,
either globally, regionally or within country, against a range of actual or emerging risks. The pre-planning concentrates on
the protection of customer services, our staff, revenue generation, the integrity of data and documents and meeting
regulatory requirements. Each business has its own recovery plan, which is developed following the completion of a
business impact analysis. This determines how much time the business could sustain an outage before the level of losses
becomes unacceptable, i.e. its criticality. These plans are reviewed and tested every year. The planning is undertaken
against Group policy and standards and each business confirms in an annual compliance certificate that all have been met.
Should there be exceptions, these are raised and their short-term resolution is overseen by Group and regional business