HSBC 2012 Annual Report Download - page 138

HSBC HOLDINGS PLC
Report of the Directors: Operating and Financial Review (continued)
Risk > Top and emerging risks // Credit risk
136
• We pro-actively review relevant external events
and assess the impact they may have on our
systems. Within HSBC, we have a strong focus
on industry best practices. We rigorously test
and review all planned updates to our systems
environment. All changes are risk-assessed, and
appropriate mitigating controls are required for
any planned changes classified as high risk.
During periods of heightened risk, comprehensive
change embargoes are imposed to minimise the
risk of customers being affected. Following the
systems outage at a major UK bank in 2012, we
assessed our own exposure to similar risks and
implemented appropriate steps in mitigation.
We also assessed the systems scheduling tools
used in the Group. There are controls in place to
manage inter-dependencies, report exceptions
and alert file data corruption. These additional
controls are intended to ensure that the effect of
any similar product failure at HSBC would be
limited. In addition, a continuity test of a similar
problem within our major datacentres in the UK
and Hong Kong was conducted in the second
half of 2012.
• The potential effects of disposal risks include
regulatory breaches, industrial action, loss of
key personnel and interruption to systems and
processes during business transformation, and
they can have both financial and reputational
implications. Steps taken to manage these risks
proactively include maintaining a close dialogue
with regulators and customers and involving
HR, legal, compliance and other functional
experts. Some disposals also involve
Transitional Service Agreements where there
are ongoing risks, which are subject to close
management oversight.
Information security risk
The security of our information and technology
infrastructure is crucial for maintaining our banking
applications and processes while protecting our
customers and the HSBC brand.
Potential impact on HSBC
• These risks give rise to potential financial loss
and reputational damage which could adversely
affect customer and investor confidence. Loss
of customer data would also trigger regulatory
breaches which could result in fines and
penalties being incurred.
• We have invested significantly in addressing
this risk through increased training to raise staff
awareness of the requirements and enhanced
multi-layered controls protecting our
information and technical infrastructure.
Model risk
More stringent regulatory requirements governing
the development of parameters applied to and
controls around models used for measuring risk can
give rise to changes, including increases in capital
requirements. Furthermore, the changing external
economic and legislative environment and changes
in customer behaviour can lead to the assumptions
we have made in our models becoming invalid.
Potential impact on HSBC
• These model risks can result in a potentially
increased and volatile capital requirement.
• We continue to address these risks through
enhanced model development, independent
review and model oversight to ensure our
models remain fit for purpose.