HSBC 2015 Annual Report Download - page 278

Report of the Directors: Corporate Governance (continued)
Internal control / Going concern and viability
HSBC HOLDINGS PLC
276
– regulatory focus on conduct of business and financial
crime;
– dispute risk;
– people risk;
– execution risk;
– third-party risk management;
– model risk;
– cyber threat and unauthorised access to systems;
and
– data management.
• Strategic plans. Strategic plans are prepared for global
businesses, global functions and geographical regions
within the framework of the Group’s overall strategy.
Annual Operating Plans, informed by detailed analysis of
risk appetite describing the types and quantum of risk
that the Group is prepared to take in executing its
strategy, are prepared and adopted by all major HSBC
operating companies and set out the key business
initiatives and the likely financial effects of those
initiatives.
• Disclosure Committee. The Disclosure Committee
reviews material public disclosures made by HSBC
Holdings for any material errors, misstatements
or omissions. The membership of the Disclosure
Committee, which is chaired by the Group Company
Secretary, includes the heads of Finance, Legal, Risk,
Communications and Investor Relations. The integrity of
disclosures is underpinned by structures and processes
within the Global Finance and Global Risk functions that
support expert and rigorous analytical review of
financial reporting complemented by certified reviews
by heads of global businesses, global functions and
certain legal entities.
• Financial reporting. The Group’s financial reporting
process for preparing the consolidated Annual Report
and Accounts 2015 is controlled using documented
accounting policies and reporting formats, supported
by a chart of accounts with detailed instructions and
guidance on reporting requirements, issued by Group
Finance to all reporting entities within HSBC in advance
of each reporting period end. The submission of
financial information from each reporting entity
to Group Finance is subject to certification by the
responsible financial officer, and analytical review
procedures at reporting entity and Group levels.
• Responsibility for risk management. Management are
primarily accountable for measuring, monitoring,
mitigating and managing the risks and controls in their
areas of responsibility. Processes are in place to ensure
weaknesses are escalated to senior management and
addressed, supported by the three lines of defence
model.
• IT operations. Centralised control is exercised over all
IT developments and operations. Common systems are
employed for similar business processes wherever
practicable.
• Global function management. Management of the
global functions are responsible for setting policies,
procedures and standards to control the principal risks
detailed under ‘Risk identification and monitoring’
above.
Authorities to enter into credit and market risk
exposures are delegated with limits to line management
of Group companies. The concurrence of the appropriate
global function is required, however, to credit proposals
with specified higher risk characteristics. Credit
and market risks are measured and reported at
subsidiary company level and aggregated for risk
concentration analysis on a Group-wide basis.
• Internal Audit. The establishment and maintenance of
appropriate systems of risk management and internal
control is the responsibility of business management.
The Global Internal Audit function, which is centrally
controlled, provides independent and objective
assurance in respect of the adequacy of the design and
operating effectiveness of the Group’s framework of risk
management, control and governance processes across
the Group, focusing on the areas of greatest risk to
HSBC using a risk-based approach. The Group Head of
Internal Audit reports to the Chairman of the GAC and
administratively to the Group Chief Executive. Executive
management is responsible for ensuring that issues
raised by the Global Internal Audit function are
addressed within an appropriate and agreed timetable.
Confirmation to this effect must be provided to Global
Internal Audit.
Role of Board Committees
On behalf of the Board, the GAC has responsibility for
overseeing risk management and internal controls over
financial reporting and the GRC has responsibility for
overseeing risk management and internal controls,
other than over financial reporting.
During the year, the GRC and the GAC have kept under
review the effectiveness of this system of internal control
and have reported regularly to the Board. In carrying
out their reviews, the GRC and the GAC received:
• regular business and operational risk assessments;
• regular reports from the Group Chief Risk Officer and
the Group Head of Internal Audit;
• reports on the annual reviews of the risk control
framework of HSBC Holdings which cover all internal
controls, both financial and non-financial;
• half yearly confirmations to the GAC and GRC from audit
and risk committees of principal subsidiary companies
regarding, in relation to audit committees, whether their
financial statements have been prepared in accordance
with Group policies, present fairly the state of affairs of
the relevant principal subsidiary and are prepared on a
going concern basis;
• reports confirming if there have been any material
losses, contingencies or uncertainties caused by
weaknesses in internal controls;
• internal audit reports;