HSBC 2012 Annual Report Download - page 336

HSBC HOLDINGS PLC
Report of the Directors: Corporate Governance (continued)
Internal control > Going concern basis / Employees
334
monitored by the Operational Risk and Internal
Control (‘ORIC’) teams for the relevant
regions/global businesses and reports on
progress are presented to their ORIC
committees and quarterly to Global Operational
Risk. An annual report and updates on identified
issues and remediation plans are presented to the
GRC and the GAC.
• Internal Audit. The establishment and
maintenance of appropriate systems of internal
control is primarily the responsibility of
business management. The Global Internal
Audit function, which is centrally controlled,
provides independent assurance in respect of the
design and operating effectiveness of the risk
management and control frameworks across the
Group, focusing on the areas of greatest risk to
HSBC using a risk-based approach. The head of
this function reports to the Group Chairman, the
Group Chief Executive Officer, the GAC and
the GRC on risk-related matters.
• Internal Audit recommendations. Executive
management is responsible for ensuring that
recommendations made by the Internal Audit
function are implemented within an appropriate
and agreed timetable. Confirmation to this effect
must be provided to Internal Audit.
• Reputational risk. Policies to guide subsidiary
companies and management at all levels in the
conduct of business to safeguard the Group’s
reputation are established by the Board and its
committees, subsidiary company boards and
their committees and senior management.
Reputational risks can arise from a variety of
causes including environmental, social and
governance issues, as a consequence of
operational risk events and as a result of
employees acting in a manner inconsistent with
HSBC’s Values. As a banking group, HSBC’s
good reputation depends upon the way in
which it conducts its business but it can also be
affected by the way in which clients, to which
it provides financial services, conduct their
business or use financial products and services.
The GAC has non-executive responsibility for
oversight of internal controls over financial reporting
and the GRC has non-executive responsibility for
internal controls other than over financial reporting.
The GRC and the GAC have kept under review
the effectiveness of this system of internal control
and have reported regularly to the Board of
Directors. In carrying out their reviews the GRC and
the GAC receive regular business and operational
risk assessments; regular reports from the Group
Chief Risk Officer and the Head of Global Internal
Audit; reports on the annual reviews of the internal
control framework of HSBC Holdings which
cover all internal controls, both financial and
non-financial; annual confirmations from chief
executives of principal subsidiary companies as
to whether there have been any material losses,
contingencies or uncertainties caused by weaknesses
in internal controls; internal audit reports; external
audit reports; prudential reviews; and regulatory
reports. The GRC monitors the status of top and
emerging risks which impact or may impact the
Group and considers whether the mitigating actions
put in place are appropriate. In addition, when
unexpected losses have arisen or when incidents
have occurred which indicate gaps in the control
framework or in adherence to Group policies, the
GRC and the GAC review special reports, prepared
at the instigation of management, which analyse the
cause of the issue, the lessons learned and the actions
proposed by management to address the issue.
The Directors, through the GRC and the GAC,
have conducted an annual review of the effectiveness
of our system of internal control covering all
material controls, including financial, operational
and compliance controls, risk management systems,
the adequacy of resources, qualifications and
experience of staff of the accounting and financial
reporting function and the risk function, and their
training programmes and budget. The review does
not extend to joint ventures or associates. The
GRC and the GAC have received confirmation that
executive management has taken or is taking the
necessary actions to remedy any failings or
weaknesses identified through the operation of
our framework of controls.
Going concern basis
The financial statements are prepared on a going
concern basis, as the Directors are satisfied that the
Group and parent company have the resources to
continue in business for the foreseeable future.
In making this assessment, the Directors have
considered a wide range of information relating
to present and future conditions, including future
projections of profitability, cash flows and capital
resources. Further information relevant to the
assessment is provided elsewhere in this report.
In particular, HSBC’s principal activities, business
and operating models, strategic direction and top
and emerging risks are described in the ‘Overview’
section; a financial summary, including a review of
the consolidated income statement and consolidated
balance sheet, is provided in the ‘Operating and
Financial Review’ section; HSBC’s objectives,