HSBC Holdings plc - Pillar 3 at 31 Dec 2019 Part 1

We use an enterprise-wide risk management framework across the organisation and across all risk types. It is underpinned by our risk culture.

The framework fosters continuous monitoring of the risk environment, and promotes risk awareness and sound operational and strategic decision making. It also ensures we have a consistent approach to monitoring, managing and mitigating the risks we accept and incur in our activities.

Further information on our risk management framework is set out on page 74 of the Annual Report and Accounts 2019. The management and mitigation of principal risks facing the Group is described in our top and emerging risks on page 76 of the Annual Report and Accounts 2019.

Commentary on hedging strategies and associated processes can be found in the Market risk and Securitisation sections of this document.

Culture

HSBC has long recognised the importance of a strong culture. Our  culture is reinforced by our values. It is instrumental in aligning the behaviours of individuals with our attitude to assuming and managing risk, which helps to ensure that our risk profile remains in line with our risk appetite. The fostering of a strong culture is a key responsibility of our senior executives.

Our culture is also reinforced by our approach to remuneration. Individual awards, including those for senior executives, are based on compliance with our values and the achievement of financial and non-financial objectives, which are aligned to our risk appetite and global strategy.

Further information on risk and remuneration is set out on page 207 of the Annual Report and Accounts 2019.

Risk governance

The Board has ultimate responsibility for the effective management of risk and approves our risk appetite. It is advised on risk-related matters by the Group Risk Committee ('GRC') and  the Financial System Vulnerabilities Committee ('FSVC'). The final meeting of the FSVC was held on 15 January 2020, with responsibility for oversight of financial crime risk transferred to the GRC, which will continue to advise the Board on risk-related matters.

The activities of the GRC and the FSVC are set out on pages 178 to 182 of the Annual Report and Accounts 2019.

Executive accountability for the ongoing monitoring, assessment and management of the risk environment, and the effectiveness of the risk management framework resides with the Group Chief Risk Officer ('CRO'). The CRO is supported by the Risk Management Meeting ('RMM') of the Group Management Board.

The management of financial crime risk resides with the Group Chief Compliance Officer ('COO'). The COO is supported by the Financial Crime Risk Management Meeting.

Further information is available on page 145 of the Annual Report and Accounts 2019.

Day-to-day responsibility for risk management is delegated to senior managers with individual accountability for decision making. These senior managers are supported by global functions. All our people have a role to play in risk management. These roles are defined using the three lines of defence model, which takes into account our business and functional structures.

We use a defined executive risk governance structure to ensure appropriate oversight and accountability for risk, which facilitates the reporting and escalation to the RMM.

Further information about the Group's three lines of defence model and executive risk governance structures is available on page 75 of the Annual Report and Accounts 2019.

Risk appetite

Risk appetite is a key component of our management of risk. It describes the type and quantum of risk that the Group is willing to accept in achieving its medium- and long-term strategic goals. At HSBC, risk appetite is managed through a global risk appetite framework and articulated in a risk appetite statement ('RAS'), which is approved biannually by the Board on the advice of the GRC.

Our risk appetite informs our strategic and financial planning process, defining the desired forward-looking risk profile of the Group. It is also integrated within other risk management tools, such as the top and emerging risks report and stress testing, to ensure consistency in risk management.

Information about our risk management tools is set out from page 73 of the Annual Report and Accounts 2019. Details of the Group's overarching risk appetite are set out on page 73 of the Annual Report and Accounts 2019.

HSBC operates a wide-ranging stress testing programme that supports our risk management and capital planning. It includes execution of stress tests mandated by our regulators. Our stress testing is supported by dedicated teams and infrastructure.

Our testing programme assesses our capital strength and enhances our resilience to external shocks. It also helps us understand and mitigate risks, and informs our decision about capital levels. As well as taking part in regulatory driven stress tests, we conduct our own internal stress tests.

The Group stress testing programme is overseen by the GRC, and results are reported, where appropriate, to the RMM and GRC.

Further information about stress testing and details of the Group's regulatory stress test results are set out on page 75 of the Annual Report and Accounts 2019.

We have a dedicated Global Risk function, headed by the Group Chief Risk Officer, which is responsible for the Group's risk management framework. This includes establishing global policy, monitoring risk profiles, and forward-looking risk identification and management. Global Risk is made up of sub-functions covering all risks to our operations. It is independent from the global businesses in order to provide challenge, appropriate oversight and balance in risk/return decisions. The Global Risk function operates in line with the three lines of defence model.

For further information see page 75 of the Annual Report and Accounts 2019.

The Directors are responsible for maintaining and reviewing the effectiveness of risk management and internal control systems, and for determining the aggregate level and risk types they are willing to accept in achieving the Group's business objectives. On behalf of the Board, the GAC has responsibility for oversight of risk management and internal controls over financial reporting, and the GRC has responsibility for oversight of risk management and internal controls other than for financial reporting.

The Directors, through the GRC and the GAC received regular updates and confirmation that management has taken, or was taking, the necessary actions to remediate any failings or weaknesses identified through the operation of our framework of controls.

HSBC's key risk management and internal control procedures are described on page 173 of the Annual Report and Accounts 2019, where the Report of the Directors on the effectiveness of internal controls can also be found.

Our risk measurement and reporting systems are designed to help ensure that risks are comprehensively captured with all the attributes necessary to support well-founded decisions, that those attributes are accurately assessed, and that information is delivered in a timely manner for those risks to be successfully managed and mitigated.

Risk measurement and reporting systems are also subject to a governance framework designed to ensure that their build and implementation are fit for purpose and functioning appropriately. Risk information systems development is a key responsibility of the Global Risk function, while the development and operation of risk rating and management systems and processes are ultimately subject to the oversight of the Board.

We continue to invest significant resources in IT systems and processes in order to maintain and improve our risk management capabilities. Group standards govern the procurement and operation of systems used in our subsidiaries to process risk information within business lines and risk functions.

Risk measurement and reporting structures deployed at Group level are applied throughout global businesses and major operating subsidiaries through a common operating model for integrated risk management and control. This model sets out the respective responsibilities of Group, global business, region and country level risk functions in respect of risk governance and oversight, compliance risks, approval authorities and lending guidelines, global and local scorecards, management information and reporting, and relations with third parties such as regulators, rating agencies and auditors.