HSBC 2015 Annual Report Download - page 221

HSBC HOLDINGS PLC
219
Strategic Report Financial Review Corporate Governance Financial Statements Shareholder Information
continuity teams. It is important that plans are dynamic and meet all risks, particularly those of an emerging nature such as
possible pandemics and cyber attacks. The ORMF is used to measure our resilience to these risks, and is confirmed to Group
and regional risk committees. Resilience is managed through various risk mitigation measures. These include agreeing with
IT acceptable recovery times of systems, ensuring our critical buildings have the correct infrastructure to enable ongoing
operations, requiring critical vendors to have their own recovery plans and arranging with Group Insurance appropriate
cover for business interruption costs.
• The Financial Intelligence Unit is jointly administered by Security and Fraud Risk and Financial Crime Compliance. It uses
advanced analytics and subject matter expertise to detect indicators of financial crime in the Group’s clients and counter-
parties.
• The Physical Security sub-function develops practical physical, electronic and operational counter-measures to ensure that
the people, property and assets managed by the Group are protected from crime, theft, attack and groups hostile to HSBC’s
interests.
• The Geopolitical Risk Unit provides both regular and ad hoc reporting to business executives and senior security and fraud
risk management on geopolitical risk profiles and evolving threats in countries in which the Group operates. This both
enhances strategic business planning and provides an early view into developing security risks. Security travel controls and
guidance are also maintained.
Systems risk
Systems risk is the risk of failure or malfunction in the automated platforms that support the Group’s daily execution
(application systems) and the systems infrastructure on which they reside (data centres, networks and distributed computers).
The management of systems risk is overseen globally by the HSBC Operations, Services and Technology (‘HOST’) organisation.
Oversight is provided through monthly risk management committee meetings that provide a comprehensive overview of
existing and emerging top risks.
HOST manages the control environment over systems risks using risk and control assessments and scenario analysis. Material
risks are monitored through the periodic testing of associated key controls.
Business-critical services have been identified. Quantitative scorecards called risk appetite statements are used for monitoring
performance, and have been established for each of these services.
Global availability monitoring (24x7) is in place to assist in determining systems health. Our incident management processes
are linked to business and geographical major incident groups for recovery decision-making and communication to customers
and regulators.
Vendor risk management
Our vendor risk management (‘VRM’) programme is a global framework for managing risk with third party vendors, especially
where we are reliant on outsourced agreements to provide critical services to our customers. VRM contains a rigorous process
to identify material contracts and their key risks and ensure controls are in place to manage and mitigate these risks. Global
and regional governance structures have been implemented to oversee vendor third party service providers.
Risk management of insurance operations
Overview of insurance products
(Audited)
HSBC manufactures the following main classes of contract:
• life insurance contracts with discretionary participation features (‘DPF’);
• credit life insurance business;
• annuities;
• term assurance and critical illness policies;
• linked life insurance;
• investment contracts with DPF;
• unit-linked investment contracts; and
• other investment contracts (including pension contracts written in Hong Kong).
We additionally write a small amount of non-life insurance business primarily covering personal and commercial property.
Nature and extent of risks
(Audited)
The majority of the risks in our Insurance business derive from manufacturing activities and can be categorised between
financial risks and insurance risk; financial risks include market risk, credit risk and liquidity risk. Operational and sustainability
risks are also present and are covered by the Group’s respective overall risk management processes.
The following sections describe how financial risks and insurance risk are managed.