HSBC 2014 Annual Report Download - page 32

HSBC BANK PLC
Strategic Report: Principal Risks and Uncertainties (continued)
30
Internet crime and fraud
HSBC is increasingly exposed to fraudulent and criminal
activities as a result of increased usage of internet and
mobile services by customers. We also face the risk of
breakdowns in processes or procedures and systems
failure or unavailability, and our business is subject to
disruption from events that are wholly or partially
beyond our control, such as internet crime and acts
of terrorism.
Potential impact on the group
• Internet crime could result in financial loss and/or
customer data and sensitive information being
compromised. They may also give rise to losses in
service to customers. The same threats apply equally
when the group relies on external suppliers or
vendors for services provided to us and our
customers.
Mitigating actions
• We continually assess these threats as they evolve
and adapt controls to mitigate them.
• We have increased its defences through enhanced
monitoring and have implemented additional
controls, such as two-factor authentication, to reduce
the possibility of losses from fraud.
Information security risk
The security of our information and technology
infrastructure is crucial for maintaining our banking
applications and processes while protecting our
customers and the HSBC brand. HSBC and other
multinational organisations continue to be the targets of
cyber-attacks, which may disrupt services including the
availability of our external facing websites, compromise
organisational and customer information or expose
security weaknesses.
Potential impact on the group
• Information security risk gives rise to potential
financial loss and reputational damage which could
adversely affect customer and investor confidence.
Loss of customer data would also trigger regulatory
breaches which could result in fines and penalties
being incurred.
Mitigating actions
• We have invested significantly in addressing this risk
through increased training to raise staff awareness of
the requirements, enhanced multi-layered controls
protecting our information and technical
infrastructure, and heightened monitoring and
management of potential cyber-attacks and
continued vulnerability assessment.
Data management
HSBC must have a clear data strategy to meet the
volume, granularity, frequency and scale of regulatory
and other reporting requirements. As a G-SIB, HSBC is
also required to comply with the principles for effective
risk data aggregation and risk reporting as set out by the
Basel Committee on Banking Supervision (‘the Basel
Committee’) in its paper.
Potential impact on the group
• Ineffective data management could adversely
affect our ability to aggregate and report complete,
accurate and consistent data to regulators, investors
and senior management on a timely basis; and
• Financial institutions that fail to meet their Basel
Committee data obligations by the required deadline
may face supervisory measures.
Mitigating actions
• Since the Data Strategy Board was established in
2012, HSBC has set a data strategy for the Group and
defined Group-level principles, standards and policies
to enable consistent data aggregation, reporting and
management; and
• Key initiatives and projects to deliver our data
strategy and work towards meeting our Basel
Committee data obligations are in progress.
Model risk
HSBC uses models for a range of purposes in managing
its business, including regulatory and economic capital
calculations, stress testing, granting credit, pricing
and financial reporting. Model risk is the potential for
adverse consequences as a result of decisions based on
incorrect model outputs and reports or the use of such
information for purposes for which it was not designed.
Model risk could arise from models that are poorly
developed, implemented or used, or from the modelled
outcome being misunderstood and acted upon
inappropriately by management. The regulatory
environment and supervisory concerns over banks’ use
of internal models to determine regulatory capital
further contribute to model risk.
Potential impact on the group
• The group may be required to hold additional capital
as a result of model limitations or failure; and
• Supervisory concerns over the internal models and
assumptions used by banks in the calculation of
regulatory capital have led to the imposition of risk
weight and loss given default floors. Such changes
have the potential to increase our capital
requirement and/or make it more volatile.
Mitigating actions
• We mitigate model risk through appropriate
governance over model development, usage and
validation, together with independent review,
monitoring and feedback.
On behalf of the Board
A P S Simoes, Director 23 February 2015
Registered number 14259