The world's local bank Annual Report and Accounts CCF - HSBC

CCF
Chairman’s report on corporate governance and internal control procedures (continued)
b
c
Audits performed during 2003 revealed a big
improvement in the application of HSBC’s GSM,
FIM and BIM in many business segments, and
particularly the central support functions of the
regional banks. Audit conclusions were therefore
broadly more favourable than before.
Significant progress has also been made in
implementing HSBC standards in information technology.
CCF must continue its efforts to improve
information systems security.
Audit Committee
The Audit Committee is key to the CCF group’s
internal control system. Its duties and composition
are set out in the section of this report on corporate
governance.
Supervisory authorities and external auditors
The supervisory authorities and external auditors
may make recommendations on CCF’s internal control
procedures. In this case, the divisions concerned
are responsible for drawing up action plans for their
implementation.
Description of internal control procedures
Control environment and oversight
Management is responsible for creating a sound overarching
control environment. This involves establishing,
implementing and ensuring the effectiveness of
first line controls. Oversight of the control environment
is also a key means of verifying whether internal
controls are appropriate and have been adapted to take
account of changing circumstances.
GEA checks and tests the quality of the overall
internal control system. It performed almost 160 audit
assignments in 2003, covering all business activities.
Implementation of its recommendations is monitored
closely.
CCF is required to draw up an annual report on its
internal control systems under the provisions of the
CRBF’s regulation no. 97-02, supplemented and
amended by regulation no. 2001-01. The report is
meant to take a critical look at internal control procedures,
including a description of any significant
improvements made, the results of and follow up to
surveys carried out and specific control measures for
foreign branches. CCF therefore undertakes a regular
detailed review of its internal control systems.
CCF, like all HSBC Group subsidiaries, is also
required to complete an annual Internal Control
Questionnaire (ICQ), also known as the Cadbury questionnaire.
This information is reported to the Financial
Services Authority (FSA) in London.
Procedures for controlling compliance with laws
and regulations
As indicated on page 26, CCF established a Group
Compliance Department in 2001, which is responsible
for ensuring compliance with laws and
regulations (certain more specialised laws remain the
responsibilities of other departments, such as Human
Resources, Legal and Tax Affairs, etc.).
A chart of compliance risks by type of business,
based on the HSBC Group model, has been established
and distributed to assist LCOs in performing their advisory
and control tasks. The LCOs have a functional
reporting line to CCF Group Compliance, which gives
them the independence they require to carry out their
duties effectively. Their operational reporting line is
to the local business head.
The LCOs submit a quarterly report on compliance
with laws and regulations to the head of CCF Group
Compliance. The business head concerned is required
to co-sign these reports on a half-yearly basis. They
also describe the measures taken (procedures, training,
etc.) to ensure compliance with laws and regulations.
In addition, a quarterly consolidated report for the
CCF group is prepared based on the information contained
in the LCOs’ quarterly reports and the comments
of the head of CCF Group Compliance. The
report is co-signed half-yearly by the head of CCF
Group Compliance and the Chairman and Chief
Executive Officer.
The head of CCF Group Compliance reports quarterly
to the Audit Committee on any issues raised in
these reports and any other material matters. An
annual report, validated by the Audit Committee is
sent to the Autorité des Marchés Financiers (AMF).
Control procedures to limit risk of financial loss
and fraud
CCF has established comprehensive procedures for
limiting the risk of financial loss and fraud. These
include segregation of key duties in branches and the
processing/payment departments. Strict rules are in
place for the protection, receipt, storage and archiving
of documents, and for the storage of cash, assets, safe
keys, etc.
With regard to the prevention of money laundering
and other fraud/security related issues,
28