The world's local bank Annual Report and Accounts CCF - HSBC

CCF
Chairman’s report on corporate governance and internal control procedures (continued)
HSBC Group Standards. These methodologies are
used for new development projects, not for maintenance
of existing systems. They are completed by a
set of documents known as “Quasar”. Quasar comprises
a set of checklists to be used for each project
throughout the development process and which must
be completed before the system can go live.
Testing
Testing is conducted throughout the development life
cycle. There are three different types of test:
– unit testing at the programming level;
– integration testing at functional level; once these
tests are completed, approval is required from the
business manager before the process can continue;
– production testing, designed to ensure that the new
application operates properly in a live environment.
System implementation control
All releases of applications are controlled by a “configuration
control tool”, either on mainframe or on
distributed environment. These tools ensure the completeness
of programs upon installation and serve as
a back-up in case of system failure.
In addition to these back-up plans, CCF is currently
working on a high-level Business Recovery Plan to
ensure that the bank’s key functions can become reoperational
without delay, principally through the use
of independent back-up sites in different geographical
locations.
System access control
Password controls are set for any person accessing
mainframe applications. Program libraries and system
libraries are also protected by appropriate user lists.
Access rights are centrally controlled by a special
team forming part of the Security department of CCF
Group Information Systems.
Change control
CCF has a change control system which has been
reinforced by the establishment of a Change Control
Committee responsible for examining and approving
all material changes and monitoring progress on a
monthly basis.
Operations control
Computer equipment is installed in a secured
computer centre, with round-the-clock security. All
mainframe operations are recorded in a log file. Most
transactions executed by CCF branches are recorded
in log files, depending on the application.
Control procedures for producing and processing financial
and accounting information
Production of financial and accounting information
a
b
Persons involved
– Decentralised accounting departments, which
are responsible for controlling and monitoring
one or more accounting centres and foreign
CCF branches. They produce monthly reports
which are sent to the General Accounting
department of CCF Group Finance and the
business line’s Financial Control analysts.
– CCF Group Finance – General Accounting.
The General Accounting department centralises
all CCF parent company accounting data in GL
Expert. It produces parent company financial
statements on a monthly basis and completes
the consolidation package. It also produces
most regulatory ratios.
– CCF Group Finance – Consolidation. On a
monthly basis, the Consolidation team collects
the reporting package from all companies in the
group (approximately 70), produces the financial
statements using French GAAP and makes
the restatements required to convert to UK
GAAP before sending the package to HSBC in
London.
Method of producing financial data
– Frequency and content:
There are three types of monthly financial
reporting both on a parent company and consolidated
basis:
• Regulatory reporting:
BAFI (Base des Agents Financiers), ECB
(European Central Bank) and EMI
(European Monetary Institute) reports,
liquidity and solvency ratios, balance of
payments, Bank of France central risk and
major exposures reports.
• CCF senior management reporting:
A table is produced showing the Group’s
consolidated results by business line
together with activity indicators.
30