Compliance with regulatory requirements

The Board has confirmed that each member of the Committee is independent according to the criteria from the US Securities and Exchange Commission, and the Committee continues to have competence relevant to the sector in which the Group operates. The Board has determined that David Nish and Jackson Tai are 'financial experts' for the purposes of section 407 of the Sarbanes-Oxley Act and have recent and relevant financial experience for the purposes of the UK and Hong Kong Corporate Governance Codes.

The GAC Chair had regular meetings with the regulators, including the UK's PRA and the Financial Conduct Authority ('FCA'). These included trilateral meetings involving the Group's external auditor PwC.

The Committee assessed the adequacy of resources of the accounting and financial reporting function. It also monitored the legal and regulatory environment relevant to its responsibilities.

How the Committee discharged its responsibilities

Connectivity with principal subsidiary audit committees

The Committee maintains a close working relationship with the principal subsidiary audit committees through formal and informal channels.

On a half-year basis, principal subsidiary audit committees provide certifications to the GAC regarding the preparation of their financial statements, adherence to Group policies and escalation of any issues that require the attention of the GAC. Recognising the additional focus on prudential regulatory reporting, the GAC sought additional information via these certifications regarding the governance, review and assurance activities undertaken by the principal subsidiary audit committees in relation to prudential regulatory reporting.

The GAC Chair regularly met with the chairs of the principal subsidiary audit committees, and attended meetings to enable close links and deeper understanding on judgements around key issues. Certain chairs and audit committee members from the principal subsidiary audit committees were also invited to attend meetings of the GAC on relevant topics.

At the Non-Executive Director Summit, the GAC Chair engaged with a number of subsidiary non-executive Directors in a breakout session to discuss key focus areas, including regulatory reporting, ESG and climate reporting and whistleblowing arrangements.

Regular post-meeting communications to principal subsidiary audit chairs were supplemented with informal quarterly catch-ups with a group of the audit committee chairs. These provided opportunities for the discussion of key matters impacting subsidiaries and the Group in between formal meetings.

Internal controls

In 2021, the GAC devoted significant time in overseeing management's approach to enabling a sustainable transformation of the control environment that supports financial, prudential regulatory and other regulatory reporting to meet the evolving expectations of regulators and other stakeholders. The programme will drive end-to-end organisational alignment so that principles and control standards can be designed to deliver a more integrated, standardised and automated control environment. The Committee received regular updates on the mobilisation of the programme workstreams, resourcing and engagement throughout the Group and with regulators. The oversight and implementation of the programme and its component parts will be a key focus for the Committee in 2022.

The Committee received regular updates and confirmations that management had taken, or was taking, the necessary actions to remediate any failings or weaknesses identified through the operation of the Group's framework of controls. For further details on how the Board reviewed the effectiveness of key aspects of internal control, see page 291.

As required by the Sarbanes-Oxley Act, the GAC received updates on the Group's work on section 404 compliance and the Group's broader financial control environment during the year. This was to assess the effectiveness of the internal control system for financial reporting and any developments affecting it. Based on this work, the GAC recommended that the Board support the assessment of the internal controls over financial reporting. 

Financial reporting

The Committee is responsible for reviewing the Group's financial reporting during the year, including the Annual Report and Accounts, Interim Report, quarterly earnings releases, analyst presentations and, where material, Pillar 3 disclosures and other items arising from the review of the Group Disclosure Committee. As part of its review, the GAC:

•    evaluated management's application of critical accounting policies and material areas in which significant accounting judgements were applied;

•    focused on compliance with disclosure requirements to ensure these were consistent, appropriate and acceptable under the relevant financial and governance reporting requirements;

•    provided advice to the Board on the form and basis underlying the long-term viability statement; and

•    gave careful consideration to the key performance metrics related to strategic priorities and ensured that the performance and outlook statements were fair, balanced and reflected the risks and uncertainties appropriately.

In conjunction with the Group Risk Committee ('GRC'), the GAC considered the current position of the Group, along with the emerging and principal risks, and carried out a robust assessment of the Group's prospects, before making a recommendation to the Board on the Group's long-term viability statement. The GAC also undertook a detailed review before recommending to the Board that the Group continues to adopt the going concern basis in preparing the annual and interim financial statements. Further details can be found on page 41.

Fair, balanced and understandable

Following review and challenge of the disclosures, the Committee recommended to the Board that the financial statements, taken as a whole, were fair, balanced and understandable. The financial statements provided the shareholders with the necessary information to assess the Group's position and performance, business model, strategy and risks facing the business, including in relation to the increasingly important ESG considerations.

The Committee reviewed the draft Annual Report and Accounts 2021 and results announcements to enable input and comment. It was supported by the work of the Group Disclosure Committee, which also reviewed and assessed the Annual Report and Accounts 2021 and investor communications.

This work enabled the GAC to provide positive assurance to the Board to assist them in making the statement required in compliance with the 2018 UK Corporate Governance Code.

ESG and climate reporting

During the year, the GAC reviewed the strategy, scope and status of ESG and climate reporting, including the climate change resolution and scenario analysis disclosure. Management updates were also informed by an HSBC-specific stakeholder feedback survey, which highlighted the appetite for more detailed ESG disclosures on climate metrics, emissions targets and plans on how these would be achieved. The Committee considered the operational, disclosure and litigation risks, which could arise from making further external commitments related to ESG and climate reporting. 

The development of methodologies, tools and data to support our ESG strategy remained a key challenge. The GAC discussed management plans to enhance and assure internal and external ESG data sourcing across the Group to develop a common ESG data inventory. The Committee considered the approach to subsidiary reporting, in particular the availability of granular data to support the Group subsidiaries in fulfilling their mandatory disclosure requirements.

Management updated the Committee on the verification and assurance framework to ensure that ESG and climate disclosures were materially accurate, consistent, fair and balanced. The GAC discussed the roles and work of the three lines of defence as part of this framework, as well as proposals for PwC to perform further limited assurance over specific ESG-related metrics.

The Committee oversaw and challenged management on the proposals to further expand the ESG review section of the Annual Report and Accounts to incorporate additional disclosures. These include the integration of TCFD disclosures, which were previously published in a stand-alone supplement, and net zero disclosures in relation to the special shareholder resolution on climate change. 

The GAC and the GRC held a joint meeting to review the progress made to deliver on the commitment - under the climate change special resolution - to publish a policy to phase out the financing of coal-fired power and thermal coal mining. The committees discussed the positions taken, and the risks associated with the policy, as well as the methodology for capturing and reporting the emissions data across the financing portfolio.

Regulatory reporting

The GAC focused on what improvements were required to regulatory reporting processes and controls, which were operating outside the Board's risk tolerance. The Committee continued to focus heavily on the quality and reliability of regulatory reporting to strengthen the end-to-end processes to meet regulatory expectations. It also challenged management on the scope of the regulatory reporting enhancement programmes. This was in response to findings from HSBC-specific external reviews and other regulatory pronouncements including the PRA's 'Dear CEO' letter on thematic findings on the reliability of regulatory reporting across the industry. The Committee Chair invited certain principal subsidiary audit committee members to GAC meetings to participate in discussions to ensure alignment and understanding of key issues and ongoing regulatory engagement.

Management discussed root cause themes, remediation of known issues and areas of increased risk identified from the risk-based read-across exercise. The Committee considered the near-term actions being taken by management, as well as the strategic remediation plan, including the costs, resources and time for implementation. It also challenged management on the delivery risks and the dependency on other ongoing programmes.

Management also highlighted potential impacts on some of the Group's regulatory ratios, such as CET1 and LCR, and adjustments required to external disclosures.

UK audit reform

The Committee spent significant time in reviewing a UK Government consultation paper - from the Department of Business,  Energy and Industrial Strategy - on 'Restoring Trust in Audit and Corporate Governance'. The GAC oversaw the development of the direct HSBC response to the consultation, as well as management's engagement across a number of industry bodies to understand wider views.

In addition, the Committee discussed the management activities being undertaken in preparation for future stages of the consultation. The GAC took steps to review its audit and assurance policy and expand assurance in certain areas, particularly regulatory reporting and ESG. The Committee also considered the impact on the future audit tender strategy, and will be looking to tender in advance of the 10-year rotation point. The Committee has proactively started engagement with the Big Four and challenger audit firms, as part of its preparations.

The Committee will continue to monitor outcomes and next steps arising from the UK Government's consultation.

External auditor

The GAC has the primary responsibility for overseeing the relationship with the Group's external auditor, PwC.

PwC completed its seventh audit, providing robust challenge to management and sound independent advice to the Committee on specific financial reporting judgements and the control environment. The senior audit partner is Scott Berryman who has been in the role since 2019. The Committee reviewed the external auditor's approach and strategy for the annual audit and also received regular updates on the audit, including observations on the control environment. Key audit matters discussed with PwC are set out in its report on page 298.

External audit plan

The GAC reviewed the PwC external audit approach, including the materiality, risk assessment and scope of the audit. The Committee invited a number of the principal subsidiary audit partners to discuss their priorities as part of the review of the external audit plan.

PwC highlighted the changes being made to their approach to enhance the quality and effectiveness of the audit. Changes for the 2022 audit included more auditing being performed centrally across legal entities and the increased use of technology solutions, some of which are aligned to technology change and transformation activities across HSBC.

Effectiveness of external audit process

The GAC assessed the effectiveness of PwC as the Group's external auditor, using a questionnaire that focused on the overall audit process, its effectiveness and the quality of output. PwC highlighted the actions being taken in response to the HSBC effectiveness review, including the development of audit quality indicators, which would provide a balanced scorecard and transparent reporting to the GAC. These focused on the following areas:

•    findings from inspections across the Group on PwC as a firm;

•    the hours of audit work delivered by senior PwC audit team members, the extent of specialist and expert involvement, delivery against agreed timetable and milestones and the use of technology;

•    any new control deficiencies in Sarbanes-Oxley locations, proportion of management identified deficiencies and delivery of audit deliverables to agreed timelines; and

•    outcomes and scores from annual audit surveys, independent senior partner reviews and prior period errors.

The GAC will continue to receive regular updates from PwC and management on the progress of the external audit plan and PwC performance across the audit quality indicators.

The GAC monitored the policy on hiring employees or former employees of the external auditor, and there were no breaches of the policy highlighted during the year. The external auditor attended all Committee meetings and the GAC Chair maintains regular contact with the senior audit partner and his team throughout the year.

Independence and objectivity

The Committee assessed any potential threats to independence that were self-identified or reported by PwC. The GAC considered PwC to be independent and PwC, in accordance with professional ethical standards and applicable rules and regulations, provided the GAC with written confirmation of its independence for the duration of 2021.

The Committee confirms it has complied with the provisions of the The Statutory Audit Services for Large Companies Market Investigation (Mandatory Use of Competitive Tender Processes and Audit Committee Responsibilities) Order 2014 for the financial statements. The Committee acknowledges the provisions contained in the 2018 UK Corporate Governance Code in respect of audit tendering. In conformance with these requirements, HSBC will be required to tender for the audit for the 2025 financial year end and beyond, having appointed PwC from 1 January 2015.

The Committee believed it would not be appropriate to re-tender in 2021 as a change in auditor would have a significant impact on the organisation, including on the Global Finance function and would increase operational risk. In 2021, the Committee's priority was to monitor closely the ongoing industry developments and proposals on reform of the UK external audit market and the impact this may have on any tender process. As a result, the Committee has commenced planning for the next tender process in advance of the 10-year re-tender period, likely to take place no later than early 2023.

The Committee has recommended to the Board that PwC should be reappointed as auditor. Resolutions concerning the reappointment of PwC and its audit fee for 2022 will be proposed to shareholders at the 2022 AGM.

Non-audit services

The Committee is responsible for setting, reviewing and monitoring the appropriateness of the provision of non-audit services by the external auditor. It also applies the Group's policy on the award of non-audit services to the external auditor. The non-audit services are carried out in accordance with the external auditor independence policy to ensure that services do not create a conflict of interest. All non-audit services are either approved by the GAC, or by Group Finance when acting within delegated limits and criteria set by the GAC.

During the period, it was identified that PwC provided an impermissible training service via a publicly available seminar in respect of the implementation of a new Indonesian IT security regulation. The attendees at this seminar included six members of staff from HSBC Indonesia. The HSBC staff who attended the course were not from the Finance function and were not in roles relevant to the audit. In addition, HSBC Indonesia is not within the scope of the Group audit. In light of the nature and scope of the original service and the mitigating factors mentioned above, we do not believe that the provision of the service has affected PwC's professional judgement or integrity in respect of the audit of the Group. Mitigating actions have been implemented by both PwC and HSBC to reinforce the controls around the provision of non-audit services by PwC, including additional independence training and improved communication between relevant parties.

The non-audit services carried out by PwC included 69 engagements approved during the year where the fees were over $100,000 but less than $1m. Global Finance, as a delegate of GAC, considered that it was in the best interests of the Group to use PwC for these services because they were:

•    audit-related engagements that were largely carried out by members of the audit engagement team, with the work closely related to the work performed in the audit;

•    engagements covered under other assurance services that require obtaining appropriate audit evidence to express a conclusion designed to enhance the degree of confidence of the intended users other than the responsible party about the subject matter information; or

•    other permitted services to advisory attestation reports on internal controls of a service organisation primarily prepared for and used by third-party end users.

Ten engagements during the year were approved where the fees exceeded $1m. These were mainly engagements required by the regulator and incremental fees related to previously approved engagements, including the provision of services by PwC relating to the Section 166 Financial Services and Markets Act 2000 Skilled Person report. The PRA instructed a Section 166 review of HSBC's credit risk RWAs as reported at 31 December 2020 and agreed for PwC to provide a reasonable assurance opinion on the accuracy of the regulatory reporting at that date. One new engagement outside the scope of the pre-approved services related to preliminary advanced audit procedures for the adoption of IFRS 17 in 2023.

Global Internal Audit

The primary role of the Global Internal Audit function is to help the Board and management protect the assets, reputation and sustainability of the Group. Global Internal Audit does this by providing independent and objective assurance on the design and operating effectiveness of the Group's governance, risk management and control framework and processes, prioritising the greatest areas of risk.

The independence of Global Internal Audit from day-to-day line management responsibility is critical to its ability to deliver objective audit coverage by maintaining an independent and objective stance. Global Internal Audit is free from interference by any element in the organisation, including on matters of audit selection, scope, procedures, frequency, timing, or internal audit report content. Global Internal Audit adheres to The Institute of Internal Auditors' mandatory guidance.

The Group Head of Internal Audit reports to the Chair of the GAC and there are frequent and regular meetings held between them. Results of audit work, together with an assessment of the Group's overall governance, risk management and control framework and processes are reported regularly to the GAC, GRC and local audit and risk committees, as appropriate. This reporting highlights key themes identified through audit activity, and the output from continuous monitoring. This includes business and regulatory developments and an independent view of emerging and horizon risk, together with details of audit coverage and any required changes to the annual audit plan.

Audit coverage is achieved using a combination of business and functional audits of processes and controls, risk management frameworks and major change initiatives, as well as regulatory audits, investigations and special reviews. In addition to the ongoing importance of regulatory-focused work, key risk theme categories for 2021 audit coverage were strategy, governance and culture, financial crime, conduct and compliance, financial resilience and operational resilience. In 2021, Global Internal Audit increased coverage on the Group's transformation programme and performed project audit activity for selected complex and high-priority business cases. Global Internal Audit also continued its 'real-time audit' approach, notably to cover areas of strategic importance. 'Real-time audits' provide real-time, independent ongoing observations to management, with issues being raised for significant observations that are not addressed in a timely manner. In addition, in 2021, Global Internal Audit implemented its revised 'culture audit' approach which assesses the impact of culture in supporting or inhibiting sustainable performance against strategic aspirations and managing risk within risk appetite. The approach combines internal audit and behavioural science principles, which align to regulator culture assessments and industry best practice.

Executive management is responsible for ensuring that issues raised by the Global Internal Audit function are addressed within an appropriate and agreed timetable. Confirmation to this effect must be provided to Global Internal Audit, which validates closure on a risk basis.

Consistent with previous years, the 2022 audit planning process includes assessing the inherent risks and strength of the control environment across the audit entities representing the Group. Results of this assessment are combined with a top-down analysis of risk themes by risk category to ensure that themes identified are addressed in the annual plan. Risk theme categories for the 2022 audit work continue to be strategy, governance and culture, financial crime, conduct and compliance, financial resilience and operational resilience. In 2022, a quarterly assessment of key risk themes will form the basis of thematic reporting and plan updates and will ultimately drive the 2023 planning process. The annual audit plan and material plan updates made in response to changes in the Group's structure and risk profile are approved by the GAC.

Based on regular internal audit reporting to the GAC, private sessions with the Group Head of Internal Audit, the Global Professional Practices annual assessment and quarterly quality assurance updates, the GAC is satisfied with the effectiveness of the Global Internal Audit function and the appropriateness of its resources. 

Global Internal Audit maintains a close working relationship with HSBC's external auditor, PwC. The external auditor is kept informed of Global Internal Audit's activities and results, and is afforded free access to all internal audit reports and supporting records.

Principal activities and significant issues considered during 2021

Collaborative oversight by GAC and GRC

The GAC and GRC worked closely to ensure there were procedures to manage risk and oversee the internal control framework. They also worked together to ensure any common areas of responsibility were addressed appropriately with inter-committee communication or joint discussions with the Chairs.

The Chairs are members of both committees and engage on the agendas of each other's committees to further enhance connectivity, coordination and flow of information.

Areas of joint focus for the GAC and GRC during 2021 were:

Sustainable control environment

As discussed in the 'Internal controls' section of this report, the GAC oversaw management's approach to create a sustainable transformation of the control environment. The programme, and its impact on the internal control environment as a whole, was also discussed by the GRC.

In conjunction with the GRC, the GAC monitored the remediation of significant deficiencies and weaknesses in controls raised by management and the external auditor. The GAC will continue to monitor the progress of remediation as well as efforts to integrate requirements of the Sarbanes-Oxley Act with the operational risk framework as part of the sustainable control environment programme. The committees will also continue to monitor the regulatory reporting enhancements programmes to bring regulatory reporting processes within the risk appetite.

In 2021, the GAC and GRC Chairs worked closely with the Group Chief Risk and Compliance Officer and the Group Head of Internal Audit to:

•    ensure that risks and issues highlighted at the GAC from audit reports were appropriately captured and reported as part of the wider internal controls discussion at the GRC; and

•    coordinate the approach and oversight required for the remediation of very high risk and high risk issues identified by Global Internal Audit, as well as the establishment of a single repository of issues across HSBC.

The GAC and the GRC also held a joint meeting to consider data strategy and data management. Further details can be found in the GRC report on page 250.

Financial reporting

In addition to the GRC's overall review of the Group's risk appetite and risk management framework, the GAC gave particular focus to risk measures impacting financial reporting. This included the review of the financial reporting, tax and pension risk appetite statements. The GAC and the GRC also considered how the approach to financial reporting risk appetite could be evolved to drive a reduction in the exposure to this risk over the medium term and provide better visibility to financial and prudential regulatory reporting separately.

The committees worked collaboratively in reviewing ESG and climate risks, as well as the financial and regulatory reporting impacts. For further details, see the 'ESG and climate reporting' section of this report on page 80.

Given the continued impact from the Covid-19 pandemic, the GAC and the GRC reviewed the risks arising from models used for the estimation of expected credit losses under IFRS 9. The committees challenged the underlying economic scenarios, additional scenarios added by management and the reasonableness of the weightings applied to each scenario in order to understand the impact on the financial statements.

Whistleblowing and speak-up culture

An important part of HSBC's values is ensuring that colleagues have the confidence to speak up when they observe unlawful or unethical behaviour. HSBC provides a variety of channels for colleagues to raise concerns, including through the Group's whistleblowing channel, HSBC Confidential (see page 87 for further information). The GAC is responsible for the oversight of the effectiveness of the Group's whistleblowing arrangements. The Group Head of Compliance provides periodic reporting to the GAC on the efficacy of the whistleblowing arrangements, providing an assessment of controls and detailing the results of internal audit assessments. The Committee is also briefed on culture and conduct risks and associated management actions arising from whistleblowing cases. The Chair of the GAC acts as the Group's whistleblowers' champion, with responsibility for ensuring and overseeing the integrity, independence and effectiveness of HSBC's policies and procedures on whistleblowing and the protection of whistleblowers. The Chair met with the Group Head of Conduct, Policy and Whistleblowing throughout the year for briefings on material whistleblowing cases and assessments of the whistleblowing arrangements.

The Committee has requested updates on a number of key areas during 2021, including: enhancements made to the Group's whistleblowing arrangements following an external benchmarking assessment in December 2020; completion of actions arising from Global Internal Audit reviews; and details of key emerging conduct themes across the arrangements. During 2022, the Committee will be provided with updates on how whistleblowing arrangements are actively supporting our purpose and values, and conduct approach.