HSBC 2008 Annual Report Download - page 302

HSBC HOLDINGS PLC
Report of the Directors: Governance (continued)
Board of Directors > Internal control / Directors’ interests
300
• Periodic strategic plans are prepared for key
customer groups, global product groups, support
functions and certain geographies within the
framework of the Group Strategic Roadmap.
Rolling operating plans, informed by detailed
analysis of risk appetite, are prepared and
adopted by all major HSBC operating
companies and set out the key business
initiatives and the likely financial effects of
those initiatives.
• Governance and oversight arrangements are in
place to ensure that risk analytical models are fit
for purpose, used accordingly and
complemented by a variety of model-specific
and enterprise-wide stress tests that evaluate the
impact of severe yet plausible events and other
unusual circumstances not fully captured by
quantitative models.
• Centralised functional control is exercised over
all computer system developments and
operations. Common systems are employed for
similar business processes wherever practicable.
Credit and market risks are measured and
reported on in subsidiaries and aggregated for
review of risk concentrations on a Group-wide
basis.
• Functional management in Group Management
Office is responsible for setting policies,
procedures and standards in the following areas
of risk: credit; market; liquidity; operational;
IT; fraud; business continuity; security;
information; insurance; accounting; tax; legal
and regulatory compliance; fiduciary; human
resources; reputational; sustainability and
purchasing. Authorities to enter into credit and
market risk exposures are delegated with limits
to line management of Group companies. The
concurrence of Group Management Office is
required, however, to credit proposals with
specified high risk characteristics.
• Policies to guide subsidiary companies and
management at all levels in the conduct of
business to safeguard the Group’s reputation are
established by the Board of HSBC Holdings and
the Group Management Board, subsidiary
company boards, board committees or senior
management. Reputational risks can arise from
environmental, social or governance issues, or
as a consequence of operational risk events. As a
banking group, HSBC’s good reputation
depends upon the way in which it conducts its
business but it can also be affected by the way in
which clients, to which it provides financial
services, conduct their business.
• The establishment and maintenance of
appropriate systems of internal control is
primarily the responsibility of business
management. The internal audit function, which
is centrally controlled, monitors the
effectiveness of internal control structures
across the whole of HSBC focussing on the
areas of greatest risk to HSBC as determined
using a risk-based approach. The head of this
function reports to the Group Chairman and the
Group Audit Committee.
• Management is responsible for ensuring that
recommendations made by the internal audit
function are implemented within an appropriate
and agreed timetable. Confirmation to this effect
must be provided to internal audit. Management
must also confirm annually to internal audit that
offices under their control have taken or are in
the process of taking the appropriate actions to
deal with all significant recommendations made
by external auditors in management letters or by
regulators following regulatory inspections.
The Group Audit Committee has kept under
review the effectiveness of this system of internal
control and has reported regularly to the Board of
Directors. The key processes used by the Committee
in carrying out its reviews include: regular business
and operational risk assessments; regular reports
from the heads of key risk functions including
Internal Audit and Compliance; the production
annually of reviews of the internal control
framework applied at Group Management Office
and major operating subsidiary level measured
against HSBC benchmarks, which cover all internal
controls, both financial and non-financial; semi-
annual confirmations from chief executives of
principal subsidiary companies as to whether there
have been any material losses, contingencies or
uncertainties caused by weaknesses in internal
controls; internal audit reports; external audit
reports; prudential reviews; and regulatory reports.
The Group Audit Committee has reviewed a ‘Risk
Map’ of the status of key risk areas which impact the
Group and has considered the mitigating actions put
in place. In addition, where unexpected losses have
arisen or where incidents have occurred which
indicate gaps in the control framework or in
adherence to Group policies, the Group Audit
Committee has reviewed special reports, prepared at
the instigation of management, which analyse the
cause of the issue, the lessons learned and the actions
proposed by management to address the issue.
The Directors, through the Group Audit
Committee, have conducted an annual review of the
effectiveness of HSBC’s system of internal control