HSBC 2012 Annual Report Download - page 230

HSBC HOLDINGS PLC
Report of the Directors: Operating and Financial Review (continued)
Risk > Market risk > Operational risk > In 2012
228
Operational risk management framework
Operational risks
•
Operations
• Accounting
• Compliance
• Fiduciary
• Internal fraud
• External fraud
• Physical
• Business continuity
• Information
• Legal
• Tax
• Technology
• People
• Project
• Political
Governance Identify Set risk
appetite Assess Control Report
Action
Risk and Control Assessment (‘RCA’)
Key indicators (‘KI’s)
Internal incidents
External events
Capital Modelling
Top Risk
Analysis
(‘TRA’)
1
2
3
4
• RCAs are used to inform the evaluation of the effectiveness of controls over top risks.
• KIs are linked to TRAs to help monitor the risks and controls in the operational risk system.
• Internal incidents are used to forecast typical losses.
• External sources (e.g. Fitch and ORX databases) are used to inform the assessment of extreme TRAs.
Operational risk in 2012
During 2012, our top and emerging risk profile was
dominated by compliance and legal risks as referred
to in the ‘Top and emerging risks’ section and Note
43 on the Financial Statements. A number of other
material losses were realised in 2012, which related
largely to events that occurred in previous years.
These events included the possible historical mis-
selling of PPI and interest rate protection products in
the UK (see Note 32 on the Financial Statements). A
number of mitigating actions continue to be taken to
prevent future mis-selling incidents including
enhanced new product approval processes.
The incidence of regulatory proceedings and
other adversarial proceedings against financial
service firms is increasing. Proposed changes
relating to capital and liquidity requirements,
remuneration and/or taxes could increase our cost of
doing business, reducing future profitability. Various
regulators and competition authorities around the
world are also investigating and reviewing certain
past submissions made by panel banks and the
process for making submissions in connection with
the setting of Libor, Euribor and other benchmark
interest and foreign exchange rates. In response, we
have undertaken a number of initiatives which seek
to address the issues identified, including creating a
new global management structure, enhancing our
governance and oversight, increasing our compliance
function resource, emphasising HSBC Values and
designing and implementing new global standards as
described on page 6. For further information,
see Note 43 on the Financial Statements.
Other significant operational risks included:
• challenges to achieving our strategy in a
downturn: businesses and geographical regions
have prioritised strategy and annual operating
plans to reflect current economic conditions.
Performance against plan is monitored through a
number of means including the use of balanced
scorecards and performance reporting at all
relevant management committees;
• internet crime and fraud: the threat of external
fraud, especially in retail and commercial
banking, may increase during adverse economic
conditions. We have increased our defences
through enhanced monitoring and have
implemented additional controls, such as two-
factor authentication, to mitigate the possibility
of losses from fraud risks. We continually assess
these threats as they evolve and adapt our
controls to mitigate these risks;
• level of change creating operational complexity:
the Risk function is engaged with business
management in business transformation
initiatives to ensure robust internal controls are
maintained, including through participation in
all relevant management committees. For
example, we undertake rigorous testing and
review of all planned updates to our systems
environment. All changes are risk assessed and