HSBC 2005 Annual Report Download - page 211

209
policy following the publication of the Corrigan
report in July 2005 and responding to new
public policy initiatives governing sales
practices.
• Periodic strategic plans are prepared for
customer groups, global product groups, key
support functions and certain geographies within
the framework of the Group Strategic Plan.
Operating plans are prepared and adopted by all
HSBC companies annually, setting out the key
business initiatives and the likely financial
effects of those initiatives.
• Centralised functional control is exercised over
all computer system developments and
operations. Common systems are employed for
similar business processes where practicable.
Credit and market risks are measured and
reported on in subsidiaries and aggregated for
review of risk concentrations on a Group-wide
basis.
• Responsibilities for financial performance
against plans and for capital expenditure, credit
exposures and market risk exposures are
delegated with limits to line management in the
subsidiaries. In addition, functional management
in Group Head Office is responsible for setting
policies, procedures and standards in the
following areas of risk: credit risk; market risk;
liquidity risk; operational risk; IT risk; insurance
risk; accounting risk; tax risk; legal and
regulatory compliance risk; human resources
risk; reputational risk and purchasing risk; and
for certain global product lines.
• Policies to guide subsidiary companies and
management at all levels in the conduct of
business to safeguard the Group’s reputation are
established by the Board of HSBC Holdings and
the Group Management Board, subsidiary
company boards, board committees or senior
management. Reputational risks can arise from
social, ethical or environmental issues, or as a
consequence of operational risk events. As a
banking group, HSBC’s good reputation
depends upon the way in which it conducts its
business but it can also be affected by the way in
which clients, to which it provides financial
services, conduct their business.
• The internal audit function, which is centrally
controlled, monitors the effectiveness of internal
control structures across the whole of HSBC.
The work of the internal audit function is
focused on areas of greatest risk to HSBC as
determined by a risk-based approach. The head
of this function reports to the Group Chairman
and the Group Audit Committee.
• Management is responsible for ensuring that
recommendations made by the internal audit
function are implemented within an appropriate
and agreed timetable. Confirmation to this effect
must be provided to internal audit. Management
must also confirm annually to internal audit that
offices under their control have taken or are in
the process of taking the appropriate actions to
deal with all significant recommendations made
by external auditors in management letters or by
regulators following regulatory inspections.
The Group Audit Committee has kept under
review the effectiveness of this system of internal
control and has reported regularly to the Board of
Directors. The key processes used by the Committee
in carrying out its reviews include: regular reports
from the heads of key risk functions; the production
annually of reviews of the internal control
framework applied at Group Head Office and major
operating subsidiary level measured against HSBC
benchmarks, which cover all internal controls, both
financial and non-financial; semi-annual
confirmations from chief executives of principal
subsidiary companies that there have been no
material losses, contingencies or uncertainties caused
by weaknesses in internal controls; internal audit
reports; external audit reports; prudential reviews;
and regulatory reports.
The Directors, through the Group Audit
Committee, have conducted an annual review of the
effectiveness of HSBC’s system of internal control
covering all material controls, including financial,
operational and compliance controls and risk
management systems. The Group Audit Committee
has received confirmation that management has
taken or is taking the necessary action to remedy any
failings or weaknesses identified through the
operation of HSBC’s framework of controls.
Reputational and operational risks
HSBC regularly updates its policies and procedures
for safeguarding against reputational and operational
risks. This is an evolutionary process which takes
account of The Association of British Insurers’
guidance on best practice when responding to social,
ethical and environmental (‘SEE’) risks.
The safeguarding of HSBC’s reputation is of
paramount importance to its continued prosperity
and is the responsibility of every member of staff.
HSBC has always aspired to the highest standards of
conduct and, as a matter of routine, takes account of
reputational risks to its business. The training of