HSBC 2015 Annual Report Download - page 219

HSBC HOLDINGS PLC
217
Strategic Report Financial Review Corporate Governance Financial Statements Shareholder Information
equity shareholders and interest payments to providers of debt capital; and maintaining a supply of short-term capital
resources for deployment under extraordinary circumstances. It does not take proprietary trading positions.
The main market risks to which HSBC Holdings is exposed are non-trading interest rate risk and foreign currency risk. Exposure
to these risks arises from short-term cash balances, funding positions held, loans to subsidiaries, investments in long-term
financial assets and financial liabilities including debt capital issued. The objective of HSBC Holdings’ market risk management
strategy is to reduce exposure to these risks and minimise volatility in capital resources, cash flows and distributable reserves.
Market risk for HSBC Holdings is monitored by HSBC Holdings ALCO in accordance with its risk appetite statement.
HSBC Holdings uses interest rate swaps and cross currency interest rate swaps to manage the interest rate risk and foreign
currency risk arising from its long-term debt issues.
Operational risk
The objective of our operational risk management is to manage and control operational risk in a cost effective manner within
targeted levels of operational risk consistent with our risk appetite, as defined by the GMB.
Operational risk is organised as a specific risk discipline within Global Risk, and a formal governance structure provides
oversight over its management. The Global Operational Risk sub-function supports the Group Chief Risk Officer and the Global
Operational Risk Committee. It is responsible for establishing and maintaining the Operational Risk Management Framework
(‘ORMF’) and monitoring the level of operational losses and the effectiveness of the control environment. It is also responsible
for operational risk reporting at Group level, including the preparation of reports for consideration by the RMM and the Group
Risk Committee. The Global Operational Risk Committee meets at least quarterly to discuss key risk issues and review the
effective implementation of the ORMF.
The ORMF defines minimum standards and processes and the governance structure for the management of operational risk
and internal control in our geographical regions, global businesses and global functions. The ORMF has been codified in a high
level standards manual supplemented with detailed policies which describes our approach to identifying, assessing, monitoring
and controlling operational risk and gives guidance on mitigating action to be taken when weaknesses are identified.
Business managers throughout the Group are responsible for maintaining an acceptable level of internal control commensurate
with the scale and nature of operations, and for identifying and assessing risks, designing controls and monitoring the
effectiveness of these controls. The ORMF helps managers to fulfil these responsibilities by defining a standard risk assessment
methodology and providing a tool for the systematic reporting of operational loss data.
A centralised database is used to record the results of the operational risk management process. Operational risk and control
self-assessments are input and maintained by business units. Business and functional management and business risk and
control managers monitor the progress of documented action plans to address shortcomings. To ensure that operational risk
losses are consistently reported and monitored at Group level, all Group companies are required to report individual losses
when the net loss is expected to exceed $10,000, and to aggregate all other operational risk losses under $10,000. Losses are
entered into the Group Operational Risk database and are reported to the RMM on a monthly basis.
For further details, see the Pillar 3 Disclosures 2015 report.
Compliance risk
Compliance risk falls within the definition of operational risk. All Group companies are required to observe the letter and spirit
of all relevant laws, codes, rules, regulations and standards of good market practice. These rules, regulations, Group policies
and formal standards include those relating to AML, counter-terrorist and proliferation financing, sanctions compliance, anti-
bribery and corruption, conduct of business and other regulations.
The two Compliance sub-functions: Financial Crime Compliance (‘FCC’) and Regulatory Compliance (‘RC’), are appropriately
supported by a shared Compliance Operating Office and Reputational Risk Management teams. The Global Head of Financial
Crime Compliance and the Global Head of Regulatory Compliance both report to the Group Chief Risk Officer.
There are compliance teams in each of the countries where we operate and in all global businesses. These compliance teams
are principally overseen by Heads of Financial Crime Compliance and Regulatory Compliance located in Europe, the US,
Canada, Latin America, Asia and the Middle East and North Africa. The effectiveness of the regional and global business
compliance teams are reviewed by the respective FCC and RC Assurance teams.
Global policies and procedures require the prompt identification and escalation to Financial Crime Compliance or Regulatory
Compliance of all actual or suspected breaches of any law, rule, regulation, policy or other relevant requirement. Reportable
events are reported to the relevant Risk Management Committees and those of Group significance are escalated to the RMM,
the Group Risk Committee and the Board, as appropriate. They are disclosed in the Annual Report and Accounts and Interim
Report, as appropriate.
We published a new Global Conduct Policy in 2015 (following the approval and implementation of the global conduct approach
and framework in 2014) for the management of conduct designed to ensure that we meet our strategic commitment to deliver
fair outcomes for our customers, and not to disrupt the orderly and transparent operation of financial markets. It defines