HSBC 2015 Annual Report Download - page 116

Report of the Directors: Risk (continued)
Top and emerging risks
HSBC HOLDINGS PLC
114
Cyber threat and unauthorised access to systems
Like other public and private organisations, we continue to
be a target of cyber attacks which, in some cases, disrupt
services including the availability of our external facing
websites, compromise organisational and customer
information or expose security weaknesses. Management of
cyber risks is coming under increased regulatory scrutiny.
Potential impact on HSBC
• A major cyber attack, which could result from
unauthorised access to our systems, may result in
financial loss as well as significant reputational damage
which could adversely affect customer and investor
confidence in HSBC. Any loss of customer data would also
trigger regulatory breaches which could result in fines and
penalties being incurred.
Mitigating actions
• The security of our information and technology
infrastructure is crucial for maintaining our banking
applications and processes and protecting our customers
and the HSBC brand. We continue to strengthen our
ability to prevent, detect and respond to the ever-
increasing and sophisticated threat of cyber attacks by
enhancing our governance and controls framework and
technology infrastructure, processes and controls.
• We took part in the PRA‘s Cyber Vulnerability Testing
exercise during 2015 and are making further
enhancements to improve our resilience to, and
ability to recover from, cyber attacks.
• We have realigned the responsibilities and
accountabilities for cyber and information risk
management to align with the operational risk lines of
defence operational model and instigated a number of
security improvement programmes within IT.
Internally driven
• People risk
• Execution risk
• Third-party risk management
• Model risk
• Data management
People risk
Significant demands continue to be placed on our staff. The
cumulative workload arising from regulatory reform and
remediation programmes together with those related to the
delivery of our strategy is hugely consumptive of human
resources, placing increasingly complex and conflicting
demands on a workforce in a world where expertise is
often in short supply and globally mobile.
Potential impact on HSBC
• Changes in remuneration policy and practice resulting
from CRD IV regulations, European Banking Authority
(‘EBA’) Guidelines and PRA remuneration rules apply on a
Group-wide basis for any material risk takers. This
presents significant challenges for HSBC because a
significant number of our material risk takers are based
outside the EU.
• The Senior Managers and Certification regimes and the
related Rules of Conduct, which come into force in 2017
for other employees, set clear expectations of the
accountabilities and behaviour of both senior and more
junior employees.
• Organisational changes to support the Group’s strategy
and/or implement regulatory reform programmes have
the potential to lead to increased staff turnover.
Mitigating actions
• The changes in remuneration under the CRD IV
regulations, EBA guidelines and PRA remuneration rules
have necessitated a review of our remuneration policy,
especially the balance between fixed and variable pay, to
ensure we can remain globally competitive on a total
compensation basis and retain our key talent.
• We continue to increase the level of specialist resource in
key areas, and to engage with our regulators as they
finalise new regulations.
• Risks related to organisational change and disposals are
subject to close management oversight, especially in
those countries where staff turnover is particularly high.
Execution risk
Execution risk heightened during 2015 due to a number of
factors. Significant programmes are under way to deliver
nine business actions to capture value from our global
presence, announced at the Investor Update in June 2015.
These, along with the regulatory reform agenda and our
commitments under the US DPA require the management
of complex projects that are resource demanding and time
sensitive. In addition, the risks arising from the disposal of
our business in Brazil require careful management.
Potential impact on HSBC
• Risks arising from the number, magnitude and complexity
of projects underway to meet these demands may
include financial losses, reputational damage or
regulatory censure.
• The potential risks of disposals include regulatory
breaches, industrial action, loss of key personnel
and interruption to systems and processes during
business transformation. They can have both financial
and reputational implications.
Mitigating actions
• We have strengthened our prioritisation and governance
processes for significant projects, which are monitored by
the GMB.
• We have invested in our project implementation and
IT capabilities and increased our focus on resource
management.
• Risks relating to disposals are carefully assessed and
monitored and are subject to close management
oversight.