HSBC 2015 Annual Report Download - page 330

Report of the independent auditors to the members of HSBC Holdings plc
Appendix
HSBC HOLDINGS PLC
328
IT access management
Nature of the area of focus Matters discussed with the GAC
Access rights to technology are provided to individuals in order to
support their specific roles. These rights are important because they
ensure that changes to applications and data are authorised and
made in an appropriate manner. Ensuring staff only have
appropriate access, and that the access is monitored, are key
controls to mitigate the potential for fraud or error as a result of a
change to an application or underlying data.
During the year, it was identified that controls over access rights to
operating systems, applications, and data used in the financial
reporting process required improvement to ensure that access was
sufficiently monitored, restricted or segregated.
All banks are highly dependent on technology due to the significant
number of transactions that are processed daily. The audit approach
relies extensively on automated controls and therefore procedures
are designed to test access and control over IT systems. As a
consequence of the control findings, the assessed risk of a material
misstatement arising from access to technology was changed to
significant. The audit approach was modified, with the extent of
testing increased substantially to obtain the necessary evidence
that a material error or fraud remained undetected.
A specific pre-year end GAC meeting was held to discuss the control
issues identified, and to agree a response.
A revised audit approach and plan was presented along with examples
of how the application and database findings impacted specific
products transacted by HSBC.
At the GAC meeting held prior to approving the Annual Report and
Accounts 2015, a summary of the findings of the audit work was
discussed, together with a consideration of the additional work
performed by management to address the issues identified. This
included the work undertaken to evidence that access was not used
inappropriately, and also detective controls which operated at many
levels within HSBC to prevent a material error or fraud remaining
undetected.
Procedures performed to support our discussions and conclusions
Access rights were tested over the various aspects of technology relied upon for financial reporting. Specifically, the audit tested that:
• new access requests for joiners were properly reviewed and authorised;
• application user access rights were removed on a timely basis when an individual left or moved role; and
• access rights to applications were periodically monitored for appropriateness.
Other areas that were independently assessed included password policies, security configurations, controls over changes to applications and
databases and that business users, developers and production support did not have access to change applications, the operating system or
databases in the production environment.
As a consequence of the findings that were identified a range of other procedures were performed;
• Where possible, the extent of inappropriate access was identified and the changes made with this access assessed to determine that they
were appropriate.
• Automated controls in applications impacted were considered as manual, and therefore tested on multiple occasions rather than once.
• Additional substantive testing was performed on the year-end balance sheet and income statement where this was deemed to be
effective.
• Where possible, testing was performed on other compensating controls or processes not impacted by systems.
• A list of users with access to systems was obtained and manually compared to other access lists where segregation of duties was deemed
to be of higher risk, for example within GB&M.
Relevant references in the Annual Report and Accounts 2015
GAC Report, page 262.
Effectiveness of internal controls, page 277.