HSBC 2015 Annual Report Download - page 117

HSBC HOLDINGS PLC
115
Strategic Report Financial Review Corporate Governance Financial Statements Shareholder Information
Third-party risk management
HSBC, in common with peers in the financial services
industry, utilises third parties for the provision of a range of
goods and services. Global regulators have raised concerns
regarding the dependency on third parties, and expect firms
to be able to demonstrate adequate control over the
selection, governance and oversight of their third parties
(including affiliates). Risks arising from the use of third-party
service providers may be less transparent and therefore
more challenging to manage or influence.
Potential impact on HSBC
• Any deficiency in the management of third-party risk
could affect our ability to meet strategic, regulatory
and client expectations. This may lead to a range of
consequences including regulatory censure, civil
penalties or reputational damage.
Mitigating actions
• HSBC is undertaking a multi-year strategic plan to
enhance its third-party risk management capability. We
are implementing a programme that will provide a holistic
view of third-party risks. This will enable the consistent
risk assessment of any third-party service against key
criteria, along with the associated control monitoring,
testing and assurance throughout the third-party
lifecycle.
• The Group’s most critical third parties were identified and
subjected to enhanced risk assessment, with remediation
plans agreed where necessary. Plans are in place to
extend the assessment to a broader group of third
parties.
• In addition, the highest priority third-party vendors in the
US went through enhanced risk assessment with findings
remediated in 2015. A risk monitoring solution was
implemented for all vendors and a due diligence solution
is in the process of being implemented.
Model risk
We use models for a range of purposes in managing our
business, including regulatory and economic capital
calculations, stress testing, credit approvals, pricing, financial
crime and fraud risk management and financial reporting.
Model risk is the potential for adverse consequences as a
result of decisions based on incorrect model outputs and
reports or the use of such information for purposes for which
it was not designed. This risk can arise from models that
are poorly developed, implemented or used, or from the
modelled outcome being misunderstood and acted upon
inappropriately by management. The regulatory
environment and supervisory concerns over banks’ use
of internal models to determine regulatory capital is also
considerable, and further contributes to model risk.
Potential impact on HSBC
• HSBC could incur losses, be required to hold additional
capital, fail to meet regulatory standards or incur higher
operating expenses due to the use of inappropriate
models or poor model risk management.
• Supervisory concerns over the internal models and
assumptions used by banks in the calculation of
regulatory capital have led to the imposition of floors in
risk weight and model parameters such as the loss given
default. Such changes have the potential to increase our
capital requirement and/or make it more volatile.
• Our reputation may be questioned due to our inability
to comply with specific modelling and model risk
management requirements.
Mitigating actions
• We have strengthened our model risk governance
framework by establishing global model oversight
committees and implementing policies and standards in
accordance with key regulatory requirements.
• We have strengthened our governance over the
development, usage and validation of models including
the creation of centralised global analytical functions with
necessary subject-matter expertise.
• We have hired additional subject matter experts as
part of our independent model review function and
empowered the function to ensure appropriate challenge
and feedback are given to models prior to and as part of
their ongoing use.
Data management
Regulators require more frequent and granular data
submissions, which must be produced on a consistent,
accurate and timely basis. As a G-SIB, HSBC must comply
with the principles for effective risk data aggregation and risk
reporting set out by the Basel Committee.
Potential impact on HSBC
• Ineffective data management capabilities could impact
our ability to aggregate and report complete, accurate
and consistent data to regulators, investors and senior
management on a timely basis.
• Financial institutions that fail to meet their Basel
Committee data obligations by the required deadline may
face supervisory measures.
Mitigating actions
• We have set a data strategy for the Group and defined
Group-level principles, standards and policies to enable
consistent data aggregation, reporting and management.
We continue to focus on enhancing data governance,
quality and architecture to support our objectives of
ensuring reliability of information used in support of
internal controls and external financial reporting.
• A number of key initiatives and projects to implement
our data strategy and work towards meeting our Basel
Committee data obligations are in progress.