HSBC 2009 Annual Report Download - page 264

HSBC HOLDINGS PLC
Report of the Directors: Risk (continued)
Operational risk > Legal risk / Group security // Pension risk / Reputational risk
262
Residual values
(Unaudited)
2009 2008
US$m US$m
Within 1 year ........................... 21 108
Between 1-2 years .................... 233 59
Between 2-5 years .................... 1,347 530
More than 5 years .................... 792 1,549
Total exposure ......................... 2,393 2,246
Operational risk
(Unaudited)
Operational risk is relevant to every aspect of the
Group’s business and covers a wide spectrum of
issues. Losses arising through fraud, unauthorised
activities, errors, omission, inefficiency, systems
failure or from external events all fall within the
definition of operational risk.
The objective of HSBC’s operational risk
management is to manage and control
operational risk in a cost effective manner
within targeted levels of operational risk
consistent with the Group’s risk appetite, as
defined by GMB.
A formal governance structure provides
oversight over the management of operational risk.
A Global Operational Risk and Control Committee,
which reports to the Risk Management Meeting,
meets at least quarterly to discuss key risk issues and
review the effective implementation of the Group’s
operational risk management framework.
In each of HSBC’s subsidiaries, business
managers are responsible for maintaining an
acceptable level of internal control, commensurate
with the scale and nature of operations. They are
responsible for identifying and assessing risks,
designing controls and monitoring the effectiveness
of these controls. The operational risk management
framework helps managers to fulfil these
responsibilities by defining a standard risk
assessment methodology and providing a tool for
the systematic reporting of operational loss data.
A centralised database is used to record the
results of the operational risk management process.
Operational risk self-assessments are input and
maintained by the business unit. To ensure that
operational risk losses are consistently reported and
monitored at Group level, all Group companies are
required to report individual losses when the net loss
is expected to exceed US$10,000.
Further details of the HSBC approach to
Operational Risk Management can be found in the
Group pillar 3 disclosures.
Legal risk
(Unaudited)
Each operating company is required to implement
procedures to manage legal risk that conform to
HSBC standards. Legal risk falls within the
definition of operational risk and includes
contractual risk, dispute risk, legislative risk and
non-contractual rights risk.
• Contractual risk is the risk that the rights and/or
obligations of an HSBC company within a
contractual relationship are defective.
• Dispute risk is made up of the risks that an
HSBC company is subject to when it is involved
in or managing a potential or actual dispute.
• Legislative risk is the risk that an HSBC
company fails to adhere to the laws of the
jurisdictions in which it operates.
• Non-contractual rights risk is the risk that an
HSBC company’s assets are not properly owned
or are infringed by others, or an HSBC company
infringes another party’s rights.
HSBC has a global legal function to assist
management in controlling legal risk. The function
provides legal advice and support in managing
claims against HSBC companies, as well as in
respect of non-routine debt recoveries or other
litigation against third parties.
The GMO Legal department oversees the global
legal function and is headed by a Group General
Manager. There are legal departments in 58 of the
countries in which HSBC operates. There are also
regional legal functions in each of Europe, North
America, Latin America, the Middle East, and
Asia-Pacific.
Operating companies must notify the
appropriate legal department immediately any
litigation is either threatened or commenced against
HSBC or an employee. The appropriate regional
legal department must be immediately advised (and
must in turn immediately advise the GMO Legal
department) of any action by a regulatory authority,
where the proceedings are criminal, or where the
claim might materially affect the Group’s reputation.
Further, any claims which exceed US$1.5 million or
equivalent must also be advised to the appropriate
regional legal department and the regional legal
department must immediately advise the GMO Legal
department if any such claim exceeds US$5 million.
All such matters are then reported to the Risk
Management Meeting of the GMB in a monthly
paper.