HSBC 2011 Annual Report Download - page 172

HSBC HOLDINGS PLC
Report of the Directors: Operating and Financial Review (continued)
Risk > Operational risk > In 2011 // Insurance > HSBC’s bancassurance model / In 2011
170
Operational risk
(Unaudited)
Operational risk is relevant to every aspect
of our business, and covers a wide spectrum
of issues, in particular legal, compliance,
security and fraud. Losses arising from
unauthorised activities, error, omission,
inefficiency, fraud, systems failure or
external events all fall within the definition
of operational risk.
HSBC has continued to enhance its operational risk
management framework including the use of the risk
and control assessment process that provides
business areas and functions with a forward-looking
view of operational risks and an assessment of the
effectiveness of controls, and a tracking mechanism
for action plans so that they can proactively manage
operational risks within acceptable levels.
There were no material changes to our policies
and procedures for the management of operational
risk in 2011.
A summary of our current policies and practices
regarding operational risk is provided in the
Appendix to Risk on page 188.
Operational risk in 2011
During 2011, our top and emerging risk analysis
included a number of risks which were of an
operational nature:
• challenges to achieving our strategy in a
downturn: businesses and geographical regions
have prioritised strategy and annual operating
plans to reflect current economic conditions.
Performance against plan is monitored through a
number of means including the use of balanced
scorecards and by performance reporting at all
relevant management committees;
• internet crime and fraud: increased monitoring
and additional controls including internet
banking controls have been implemented to
enhance our defences against external attack
and to reduce the level of losses in these areas;
• social media risk: compensating controls have
been implemented by several Group companies
to attempt to reduce our exposure to these risks,
including:
− an HSBC presence has been created in
several of the larger social media networks
in order to provide an official point of
contact for HSBC customers and
stakeholders; and
− monitoring has been implemented in some
entities to protect our brand identity and
pro-active communication has been
implemented in some geographies targeted
at broadcasting to customers and media
organisations;
• level of change creating operational complexity:
Risk functions are engaged with business
management in business transformation
initiatives to ensure robust internal controls are
maintained, including through participation in
all relevant management committees; and
• information security: significant investment has
already been made in enhancing controls
including increased training to raise staff
awareness of the requirements, enhanced
controls around data access and heightened
monitoring of information flows. This area will
continue to be a focus of ongoing initiatives to
strengthen the control environment.
Other operational risks are also monitored and
managed through use of the operational risk
management framework including investments made
to further improve the resilience of our payments
infrastructure.
There were no material losses relating to fraud
and security during the year.
Further information on the nature of these risks
is provided in ‘Top and emerging risks’ on page 99.