HSBC 2007 Annual Report Download - page 263

261
in each subsidiary is subject to an independent
programme of periodic reviews undertaken by
Internal Audit. This is supported by the monitoring
of external operational risk events, which ensures
that HSBC stays in line with industry best practice
and takes account of lessons learned from publicised
operational failures within the financial services
industry.
HSBC has codified its operational risk
management framework by issuing a high level
standard, supplemented by more detailed formal
policies. The detailed policies explain HSBC’s
approach to identifying, assessing, monitoring and
controlling operational risk, give guidance on
remedial action to be taken when rectifying
operational risk events and set out responsibilities
for meeting local regulatory requirements. Processes
undertaken to manage operational risk are
determined by reference to the scale and nature of
each HSBC operation. The HSBC standard covers
the following:
• operational risk management responsibility is
assigned to senior management within each
business operation;
• information systems are used to record the
identification and assessment of operational
risks and to generate appropriate, regular
operational risk reporting;
• assessments are undertaken of the operational
risks facing each business and the risks inherent
in its processes, activities and products. Risk
assessments incorporate an evaluation of the
effectiveness of controls and are regularly
reviewed to identify significant changes;
• operational risk loss data is collected and
reported to senior management at the business
unit level. Aggregate operational risk losses are
recorded and details of incidents above a
materiality threshold are reported to Group
Head Office. A regular report on operational
losses is made to Group Audit Committee and
the Risk Management Meeting; and
• risk mitigation, including insurance, is
considered where this is cost-effective.
In each of HSBC’s subsidiaries, local
management is responsible for implementing HSBC
standards on operational risk throughout their
operations and, where deficiencies are evident,
rectifying them within a reasonable timeframe.
Subsidiaries acquired by HSBC are required to
assess, plan and implement the standard’s
requirements within an agreed timescale.
HSBC maintains and tests contingency facilities
to support operations in the event of disasters.
Additional reviews and tests are conducted in the
event that any HSBC office is affected by a business
disruption event to incorporate lessons learned in the
operational recovery from those circumstances. As
part of HSBC’s contingency planning, all country
managers have prepared plans for the operation of
their businesses with reduced staffing levels, should
a flu pandemic occur. Country managers are required
to update these plans as circumstances change.
Legal risk
(Unaudited)
Each operating company is required to implement
policies, procedures and guidelines in respect of the
management and control of legal risk which conform
to HSBC standards. Legal risk falls within the
definition of operational risk and includes
contractual risk, legislative risk, intellectual property
risk and litigation risk. Legal risk is the risk of:
• failing to act appropriately or diligently in
response to a claim made against any HSBC
company;
• failing to take the proper action to preserve
recourse to insurers in respect of any claim
against an HSBC company;
• being unable to successfully defend a claim
brought against any HSBC company;
• HSBC being unable to take action to enforce its
rights through the courts; or
• failing to take steps to mitigate the likelihood
that a claim will be made against an HSBC
company.
HSBC has a dedicated global legal function
which is responsible for managing legal risk. This
comprises the provision of legal advice and support
in resisting claims and legal proceedings against
HSBC companies, including analysis of legal issues
and the management of any litigation, as well as in
respect of non-routine debt recoveries or other
litigation against third parties.
The Head Office legal department oversees the
global legal function and is headed by a Group
General Manager who reports to the Group
Chairman. There are legal departments in 56 of the
countries in which HSBC operates which have
primary responsibility for identifying and assessing
legal risk and advising local management in their
respective jurisdictions on these matters. There is
also a regional-level legal function in each of
Europe, North America, Latin America, the Middle
East, and Asia-Pacific.