The world's local bank - HSBC

HSBC FRANCE
Chairman’s report on corporate governance and internal control procedures (continued)
chairmen of subsidiaries now depend on the
counterparty’s Basel II rating.
All excesses over authorised limits must be
referred upwards to the relevant level of authority.
All credit facilities are subject to periodic review on
at least an annual basis, in accordance with French
regulations and HSBC Group standards.
Market risk
The system for monitoring market risks is described
in a circular that sets out mechanisms for risk limits,
authorisations and control methods.
Risk limits are set for all business activities by
ALCO Balance Sheet Management and Markets,
which meets monthly and is headed by the Chairman
and Chief Executive Officer or Deputy CEO.
Committee members include the heads of business
units involved in market activities and heads of
support services in charge of risk management.
On 1 March 2005, HSBC France reorganised its risk
management structure to bring it more into line with
that of the HSBC Group. A new Product Control Unit
brings together the teams responsible for control over
trading results and those responsible for control over
market risk. The Credit Service Unit combines the
teams responsible for measuring and controlling
counterparty risk with those responsible for setting limits
and reviewing credit applications made by Corporate
and Institutional Banking. The two new units report to
the Chief Operating Officer of Corporate and
Institutional Banking, who in turn reports to the Senior
Corporate Vice President in charge of support
functions. In addition, a Market Risk Manager (MRM)
has been appointed for the dealing rooms. The MRM
has a functional reporting line to the Market Risk
Manager for Europe, based in London.
Market risks are governed by a risk policy set by
the Executive Management Committee, and must
comply with global mandates attributed by the HSBC
Group to HSBC France. These global mandates are
divided by business line within ALCO Balance Sheet
Management and Markets, then translated into
operational limits within each entity. These limits
are expressed in terms of Value at Risk, sensitivity,
maximum loss and lists of authorised instruments
and maturities. They are revised at least once a year
by ALCO Balance Sheet Management and Markets
and may be amended on an ad hoc basis.
Product Control teams ensure compliance with
limits on a day-to-day basis. Product Control is
also in charge of informing ALCO Balance Sheet
Management and Markets or its secretary of limit
breaches and of decisions or actions made by the
front office. The MRM is in charge of carrying
out all actions to resolve breaches and to request
temporary limits if necessary.
HSBC France has developed its own internal
models for managing, assessing and valuing certain
derivative products. These models are validated by a
specialist team, the Derivative Models Review Group
(DMRG), which reports to the Head of Risks and
Product Control.
Procedures for ensuring reliability of data
processing
Governance of IT processes and internal control
in the Information Systems Department (ISD)
The Information Systems Department’s compliance
committee assesses the efficiency of internal controls
on IT processes, intended to combat material IT risks,
every two months. This committee comprises the
head of the ISD, the deputy head of the ISD,
the head of infrastructure and production and the
ISD’s head of quality.
Acquisition and development of information systems
(applications or infrastructure)
Project management methods are used to acquire
or develop information systems, in line with HSBC
recommendations. These methods include a number
of control points throughout the project cycle, from
initial business unit request to go-live. These control
points ensure that each stage of the cycle is complete
and approved by all stakeholders.
In addition, Information Systems has created
an Architecture Committee and an IT Validation
Committee to ensure that projects comply with
HSBC Group architecture rules, but most importantly
with rules for security and regulatory compliance.
Testing
Testing is conducted throughout the project management
process. There are several types of tests
concerning different project resources. They are carried
out in sequence and each within its own environment.
Each stage of testing must be validated. Validation
takes the form of a report on each phase, signed by the
tester, the tester’s manager and the person in charge of
the subsequent testing phase. For production testing,
the validation of the Change Control Committee is
required. A signed implementation certificate is
required before development can go ahead.
System go-live control
HSBC France has a change control system which
has been reinforced by the establishment of a Change
Control Committee responsible for examining and
34