HSBC 2015 Annual Report Download - page 279

HSBC HOLDINGS PLC
277
Strategic Report Financial Review Corporate Governance Financial Statements Shareholder Information
• external audit reports;
• prudential reviews; and
• regulatory reports.
The GRC and GAC have separately established governance
frameworks for their respective oversight and interaction
with the audit and risk committees of key entities within the
Group. These provide for regular reporting, issues escalation
and processes for the nomination and endorsement of
subsidiary committee appointments. These principles and
processes have in turn been cascaded by these key entities to
their respective subsidiaries to provide clear vertical channels
of governance.
The internal control responsibilities of the GAC and GRC
are complemented by the activities of the Conduct & Values
Committee (‘CVC’) and the Financial System Vulnerabilities
Committee (‘FSVC’) which, respectively, oversee internal
controls over conduct-related matters and financial crime
compliance. The GRC receives regular reports at each of its
meetings on the activities of both the CVC and the FSVC. The
GRC monitors the status of top and emerging risks and
considers whether the mitigating actions put in place are
appropriate. In addition, when unexpected losses have arisen
or when incidents have occurred which indicate gaps in the
control framework or in adherence to Group policies,
the GRC and the GAC review special reports, prepared at
the instigation of management, which analyse the cause
of the issue, the lessons learned and the actions proposed by
management to address the issue.
Effectiveness of internal controls
The Directors, through the GRC and the GAC, have conducted
an annual review of the effectiveness of our system of risk
management and internal control covering all material
controls, including financial, operational and compliance
controls, risk management systems, the adequacy of
resources, qualifications and experience of staff of the
accounting and financial reporting teams and the Global Risk
function, and their training programmes and budget. The
annual review of effectiveness of our system of risk
management and internal control over financial reporting
was conducted with reference to the COSO framework. The
annual review of other controls was undertaken using the
risk management framework on pages 102 to 103.
The GRC and the GAC have received confirmation that
executive management has taken or is taking the necessary
actions to remedy any failings or weaknesses identified
through the operation of our framework of controls. In
particular, during the year it was determined that the control
environment associated with IT privileged access required
significant improvement. Deficiencies were noted in the
design and operation of controls for the granting, release and
monitoring of privileged access in a number of systems. For
the identified deficiencies management responded by
implementing a programme to determine the scale and
nature of the deficiencies, remediate identified control
deficiencies and determine if privileged access had been
misused during 2015. Management also identified and
assessed the effectiveness of relevant IT, business,
monitoring and period-end mitigating controls.
Going concern and viability
The financial statements are prepared on a going concern
basis, as the Directors are satisfied that the Group and
Parent Company have the resources to continue in business
for the foreseeable future.
In addition to the requirement to consider whether the going
concern basis is appropriate, the Directors now have an
obligation under the UK Corporate Governance Code to state
in a Viability Statement whether they believe the Group and
parent company will be able to continue in operation and
meet their liabilities, taking account of their current position
and principal risks, our top and emerging risks, and specify
the period covered by and the appropriateness of this
statement.
It is expected that the period assessed under the Viability
Statement will be significantly longer than 12 months, which
is the period over which going concern is assessed. For HSBC,
the Directors have a reasonable expectation that the Group
and parent company will be able to continue in operation
and meet liabilities as they fall due over the next three years.
In making the going concern and viability assessments,
the Directors have considered a wide range of information
relating to present and future conditions, including future
projections of profitability, cash flows, capital requirements
and capital resources.
The assessment has been made over a period of three years
as this is within the period covered by the Group’s future
projections of profitability, the period over which regulatory
and internal stress testing is carried out, and the period over
which key capital and leverage ratios are forecast. Therefore
detailed management information exists for three years,
enabling Directors to assess the viability of the Group.
The Directors are satisfied that the period is sufficient to
enable a reasonable assessment of viability to be made. In
doing so, the Directors have assessed the principal risks
(which for the Group are set out in our top and emerging
risks on page 43), including the status of the DPA, as more
fully described on page 116, that could threaten the Group’s
future prospects and business model. They considered the
effect that those risks could have on the Group’s risk profile
relative to the risk appetite approved by the Board (see
pages 101 and 102). The Directors view all of the identified
top and emerging risks as relevant to the assessment of
viability. In doing so, the Directors considered the range of
information concerning each principal risk, including but not
limited to the Annual Operating Plan, the programme of
regulatory and internal stress tests, risk appetite and legal
reports. The Directors also considered the information from
the two reverse stress tests which the Group runs, one based
on extreme macroeconomic dislocation in Europe and Asia,
the other linked to the DPA. The Directors considered the
principal risks in forming the strategic actions set out on page
18, ensuring that the forward-looking risk profile of the
Group remained within our risk appetite.