HSBC 2012 Annual Report Download - page 231

229
Overview Operating & Financial Review Corporate Governance Financial Statements Shareholder Information
appropriate mitigating controls are required for
any planned high risk changes;
• information security: the security of our
information and technology infrastructure is
crucial for maintaining our banking applications
and processes while protecting our customers
and the HSBC brand. In common with other
banks and multinational organisations, we face a
growing threat of cyber attacks. A failure of our
defences against such attacks could result in
financial loss, loss of customer data and other
sensitive information which could undermine
both our reputation and our ability to retain
the trust of our customers. We experienced a
number of cyber attacks in 2012, none of which
resulted in financial loss or the loss of customer
data. Significant investment has already been
made in enhancing controls, including increased
training to raise staff awareness of the
requirements, improved controls around
data access and heightened monitoring of
information flows. The threat from cyber attacks
is a concern for our organisation and failure to
protect our operations from internet crime or
cyber attacks may result in financial loss, loss
of customer data or other sensitive information
which could undermine our reputation and our
ability to attract and keep customers. This area
will continue to be a focus of ongoing initiatives
to strengthen the control environment;
• vendor risk management: this continues to
evolve, with a project underway to accelerate
the review of existing contracts, including those
that support key economic functions, and a
global project to manage the performance of
critical outsourced vendors; and
• compliance with regulatory agreements and
orders: in relation to the Deferred Prosecution
Agreements (‘DPA’s), the Group has committed
to take or continue to adhere to a number of
remedial measures. Breach of the DPAs at any
time during its term may allow the DoJ or the
New York County District Attorney’s Office to
prosecute HSBC in relation to the matters which
are the subject of the DPAs. For further detail
please see ‘Top and emerging risks’.
Other operational risks are also monitored and
managed through the use of the ORMF, including
investments made to further improve the resilience
of our payments infrastructure.
Further information on the nature of these
risks is provided in ‘Top and emerging risks’ on
page 130.
Frequency and amount of operational risk
losses
The profile of operational risk incidents and
associated losses is summarised below, showing the
distribution of operational risk incidents in terms of
their frequency of occurrence and total loss amount
in US dollars.
The operational risk incident profile in 2012
comprised both high frequency, low impact events
and high impact events that occurred much less
frequently. For example, losses due to external fraud
incidents such a credit card fraud occurred more
often than other types of event, but the amounts
involved were often small in value. Fraud incidents
continued to account for over 50% of the total
number of incidents but only 4% of operational
risk losses.
By contrast, operational risk incidents in the
compliance category remained relatively low
frequency events, but the total cost was significant.
Compliance-related losses increased in 2012 to 79%
of total operational risk losses due to significant
historical events including the possible mis-selling
of PPI and interest rate protection products in the
UK and the incidence of regulatory matters
described in Note 43 on the Financial Statements.
Frequency of operational risk incidents by
risk category
4%
54%
8%
28%
3%
3%
5%
55%
8%
25%
6%
1%
Compliance
Fraud
Legal
Operations
and Systems
People
Other
2011
2012