Operational Risk Management at HSBC

1
Operational Risk Management at HSBC

• David Breden
• HSBC Operational Risk Consultancy

2
Context - the HSBC Group

• We operate in 76 countries
• Not all are EU or G-10 members
• We have diverse portfolios and operations

3
The HSBC Approach

• Harness the intellectual expertise dispersed in
  Group
• Avoid pointless bureaucracy
• Constructive partnership with colleagues around
  the world

4
Components of the OpR framework

• Risk identification and assessment
• Actions/controls
• loss data collection
• KRIs (being developed)

5
Risk self-assessment

• Brainstorming sessions
• What risks keep you awake at night?
• Distinguish between inherent risk and controls in
  place
• Express in common risk language

6
HSBC Operational Risk Matrix

• Impact x Likelihood Inherent level of Risk
• Exposure effect of controls/mitigation

7
Action plans and controls

• Assigned to high inherent risks
• Tracked by line management
• May be no action - accept risk
• Record of the risk reward profile judgement

8
Operational Risk Loss Reporting

• Integral part of Operational Risk Management
  process
• Benefits are
• Improved risk management
• Improved efficiencies
• Improved business decision making

9
Individual incident loss reporting

• Many issues about quantification of individual
  losses
• Boundary issues between credit and OpRisk
• Near misses and potential losses
• Validation (not reconciliation) against the
  financial records
• We provide individual guidance, then standardise

10
How do we record our Operational Risk framework?

• Group Operational Risk Database Online Network
  (GORDON)
• Web-based browser
• Risks input and approved by business line

11
(No Transcript)
12
(No Transcript)
13
Governance

• Group manuals structure used
• Approved by Board
• Reporting to committees of Board
• Locally, challenge process by the ORMG

14
ORMG

• Oversees Operational Risk framework in
  site/business
• Challenges business Operational Risk assessments
  and loss data
• Reviews exposures and mitigation
• Escalates issues to executive management

15
Management - Training

• Local sites implemented training to meet business
  needs e.g. case studies, workshops.
• Material live on Group Intranet

People
External
Systems
Process
16
Operational Risk Umbrella
People
Process
System
External
IT Security
Money Laundering
Legal
Business Recovery
Compliance
ORMG
E-Risk
Fraud Risk
Regulatory
17
Role of measurement - HSBC philosophy (1)

• We plan to adopt the Standardised Approach for
  the Group
• But we comply where the local regulator requires
  AMA, e.g. in the USA

18
The role of measurement - HSBC philosophy (2)

• Measurement adds value only if it contributes to
  management
• We have an AMA which directly harnesses our risk
  assessments
• The development is being closely monitored

19
Any Questions?