HSBC 2015 Annual Report Download - page 179

HSBC HOLDINGS PLC
177
Strategic Report Financial Review Corporate Governance Financial Statements Shareholder Information
Three lines of defence
HSBC has implemented an activity-based ‘three lines of
defence’ model (an industry best practice approach) to
underpin our approach to managing operational risk using
the ORMF. It makes clear who does what within HSBC to
manage operational risks on a daily basis.
• The first line of defence owns the risks and is responsible
for identifying, recording, reporting and managing them
and ensuring that the right controls and assessments
are in pace to mitigate these risks.
• The second line of defence sets the policy and guidelines
for managing the risks and provides advice, guidance
and challenge to the first line of defence on effective
risk management.
• The third line of defence is Internal Audit which helps
the Board and Executive Management to protect the
assets, reputation and sustainability of the Group.
Operational risk in 2015
During 2015, our operational risk profile continued to be
dominated by compliance risk (mainly conduct-related)
and we continued to incur losses relating to events
from previous years. Conduct-related costs included
in significant items are outlined on page 97. A range
of mitigating actions are being taken to prevent future
conduct-related incidents.
For further information see 'Compliance risk' on page 178 and for
details of the investigations and legal proceedings see Note 40 on
the Financial Statements.
Other operational risks included:
• compliance with regulatory agreements and orders:
failure to implement our obligations under the US DPA
could have a material adverse effect on our results and
operations. The work of the Monitor is discussed on
page 116, with compliance risk described below;
• level of change creating operational complexity:
the Global Risk function is engaged with business
management in business transformation initiatives to
ensure robust internal controls are maintained as we
execute our change agenda;
• fraud risks: our loss prevention performance remains
strong in most markets, but the introduction of new
technologies and ways of banking mean that we
continue to be subject to fraud attacks as new attack
vectors are developed. We continue to increase
monitoring and enhance detective controls to mitigate
these risks in accordance with our risk appetite;
• information security: the security of our information and
technology infrastructure is crucial for maintaining our
banking services and protecting our customers and the
HSBC brand. As with other financial institutions and
multinational organisations, we continue to be exposed
to cyber threats, and the focus of attacks such as
‘distribution of denial of service’ which can affect the
availability of customer-facing websites. Programmes
of work are ongoing to strengthen internal security
controls to prevent unauthorised access to our systems
and network, as well as improvements to the controls
and security applied to protect our customers utilising
digital channels. Strong engagement and support within
the industry, government agencies and intelligence
providers helps to ensure we keep abreast of the
current developments; and
• third-party risk management: we are strengthening our
core third-party risk management capability particularly
related to the management of vendor risks. A supplier
performance management programme has been
implemented with our most material suppliers and
screening of suppliers is in place to help enable us to
identify if any are on a sanctions list and if we should
therefore exit the relationship.
Other operational risks are also monitored and managed
through the use of the ORMF.
Further information on the nature of these risks is provided in
‘Top and emerging risks’ on page 110.
Frequency and amount of operational risk losses
The profile of operational risk incidents and associated
losses is summarised below, showing the distribution
of operational incidents in terms of their frequency of
occurrence and total loss amount in US dollars.
Operational losses were lower in 2015 than in 2014,
reflecting a reduction in losses incurred relating to large
legacy conduct-related events. Our total loss was driven
primarily by provisions raised in respect of the mis-selling
of the PPI policies, foreign exchange rate investigations
and litigation.
As in previous years, the operational risk incident profile in
2015 comprised high frequency low impact events and high
impact events that occurred much less frequently.
Losses due to external fraud, such as card fraud, occurred
more often than other types of incident, but the amounts
involved were often small in value. The value of fraud
incidents in 2015 was lower than in 2014, due to the
strengthened control environment.