Annual Financial Report - 6 of 9

Committee governance

The Committee is responsible for communicating and advising the Board on matters concerning the Group's financial reporting requirements to ensure that the Board has exercised oversight of the work carried out by management, Global Internal Audit and the external auditor.

The Group Chief Financial Officer, Head of Finance, Group Chief Accounting Officer, Group Head of Internal Audit and other members of senior management routinely attended meetings of the GAC. The external auditor attended all meetings.

The Chair held regular meetings with management to discuss agenda planning and specific issues as they arose during the year. Most meetings included in camera sessions with the Chief Legal Officer and the internal and external auditors.

The Committee, led by the Chair, who is also the Deputy Group Chairman and Senior Independent Director, oversaw the succession process and selection of the Group Head of Internal Audit.

The Committee Secretary regularly met with the Chair to consider input from stakeholders, including senior management, internal auditors and external auditors to finalise meeting agendas and to track progress on actions and Committee priorities.

To ensure that the Committee reports its findings and recommendations to the Board in a timely and orderly manner, it usually meets a couple of days before Board meetings.

Compliance with regulatory requirements

The Board has confirmed that each member of the Committee is independent according to the criteria from the US Securities and Exchange Commission and may be regarded as audit committee financial experts for the purposes of section 407 of the Sarbanes-Oxley Act. All Committee members have recent and relevant financial experience for the purposes of the UK and Hong Kong corporate governance codes.

The Committee assessed the adequacy of resources of the accounting and financial reporting function. It also monitored the legal and regulatory environment relevant to its responsibilities.

The GAC Chair had regular meetings with the regulators, including the UK's PRA, the FCA and the US Federal Reserve Board. These included trilateral meetings involving the Group's external auditor PwC.

Committee evaluation and effectiveness

During the year, the Committee carried out an internal review of its own effectiveness and was also subject to an externally facilitated Board effectiveness review. Further details of this can be found on page 170.

Both reviews concluded that the Committee continued to operate effectively and in line with regulatory requirements. During 2019, recommendations from the external review, including joint recommendations with the Group Risk Committee ('GRC'), were tracked and implemented.

How the Committee discharged its responsibilities

Connectivity with principal subsidiary audit committees

During the year, GAC members had regular formal and informal communication with the members of the audit committees of the Group's principal subsidiaries. Appointments to the audit committees of the principal subsidiaries were reviewed by the GAC. The GAC Chair met with the proposed new chairs of the principal subsidiaries' audit committees, as appropriate.

On a half-yearly basis, principal subsidiary audit committees provided certifications to the GAC regarding the preparation of their financial statements, adherence to Group policies and escalation of any issues that required the attention of the GAC. Where necessary, the GAC Chair attended meetings of the principal subsidiaries' audit committees to enable closer links and deeper understanding on judgements around key issues.

Financial reporting

The Committee's review of financial reporting during the year included the Annual Report and Accounts, Interim Report, quarterly earnings releases, ESG Update, analyst presentations and Pillar 3 disclosures.

As part of its review, the GAC evaluated management's application of key accounting policies, significant accounting judgements and compliance with disclosure requirements to ensure these were consistent, appropriate and acceptable under the relevant financial reporting requirements. In particular, the Committee gave careful consideration to the key performance metrics relating to the strategic priorities to ensure transparency and consistency throughout the financial reporting disclosures.

In conjunction with the GRC, the GAC considered the current position of the Group, along with the emerging and principal risks, and carried out a robust assessment of the Group's prospects, before making a recommendation to the Board on the Group's long-term viability statement. The GAC also undertook a detailed review before recommending to the Board that the Group continue to adopt the going concern basis in preparing the annual and interim financial statements.

Following challenge of the disclosures, the Committee recommended to the Board that the financial statements, taken as a whole, were fair, balanced and understandable. The financial statements provided the shareholders with the necessary information to assess the Group's position and performance, business model, strategy and risks facing the business.

Internal controls

The GAC assessed the effectiveness of the internal control system for financial reporting and any developments affecting it. This was in support of the Board's assessment of internal control over financial reporting, in accordance with section 404 of the Sarbanes-Oxley Act.

The Committee received regular updates and confirmations that management had taken, or was taking, the necessary actions to remediate any failings or weaknesses identified through the operation of the Group's framework of controls. Further details of how the Board reviewed the effectiveness of key aspects of internal control can be found on page 214.

External auditor

The Group's external auditor is PwC, which has held the role for five years. The senior audit partner was rotated to Scott Berryman in 2019 and the GAC oversaw the transition. The Committee reviewed the external auditor's approach, strategy for the annual audit and its findings. In 2019, the Committee reviewed auditor independence and audit quality, and GAC members routinely met audit partners in various locations of the business. Principal matters discussed with PwC are set out in its report on page 220.

The GAC is involved in audit partner rotation and succession for the Group and its principal subsidiaries. The GAC monitors the policy on hiring employees or former employees of the external auditor, including in relation to any breaches of the policy. The external auditor attended all Committee meetings and the GAC Chair maintains regular contact with the audit partner throughout the year. The GAC Chair and the senior audit partner also met jointly with the regulators during the year.

During the year, the GAC assessed the effectiveness of PwC as the Group's external auditor, using a questionnaire that focused on the overall audit process, its effectiveness and the quality of output.

The Committee also assessed any potential threats to independence that were self-identified or reported by PwC. The GAC considered PwC to be independent and PwC, in accordance with professional ethical standards, provided the GAC with written confirmation of its independence for the duration of 2019.

The Committee confirms it has complied with the provisions of the Competition and Markets Authority Order for the financial statements. The Committee acknowledges the provisions contained in the UK Corporate Governance Code in respect of audit tendering, along with European rules on mandatory audit rotation and audit tendering. In conformance with these requirements, HSBC will be required to tender for the audit for the 2025 financial year end and beyond, having appointed PwC from 1 January 2015.

The Committee believed it would not be appropriate to re-tender for the external audit after PwC has finished its first five-year rotation. As one of the largest international financial services companies in the world, it would take time for any new external auditor to develop an understanding of the business. HSBC is undergoing a period of significant strategic change and the Committee currently believes that frequent changes of auditor would be inefficient and lead to increased risk. A change in auditor has a significant impact on the organisation, including on the Finance function, and any change in auditor should be scheduled to limit operational disruption.

The Committee will consider its strategy on audit tendering in preparation for the 2025 financial year end in due course.

Therefore, the Committee has recommended to the Board that PwC should be reappointed as auditor. Resolutions concerning the reappointment of PwC and its audit fee for 2020 will be proposed to shareholders at the 2020 AGM.

Non-audit services

The Committee is responsible for setting, reviewing and monitoring the appropriateness of the provision of non-audit services to the external auditor. It also applies the Group's policy on the award of non-audit services to the external auditor. The non-audit services are carried out in accordance with the external auditor independence policy to ensure that services do not create a conflict of interest. All non-audit services are approved by the GAC.

The non-audit services carried out by PwC included 34 engagements approved during the year where the fees were over $100,000 but less than $1m. Group Finance, as a delegate of GAC, considered that it was in the best interests of the Group to use PwC for these services because they were:

•     audit-related engagements that were largely carried out by members of the audit engagement team, with the work closely related to the work performed in the audit;

•     engagements covered under other assurance services that require obtaining appropriate audit evidence to express a conclusion designed to enhance the degree of confidence of the intended users other than the responsible party about the subject matter information;

•     tax compliance services; or

•     other permitted services to advisory attestation reports on internal controls of a service organisation primarily prepared for and used by third-party end users.

Similar non-audit services to the ones outlined above included three engagements that were approved by the Committee where the fee exceeded $1m, and a further three engagements outside the scope of the pre-approved services list were approved during the year. They were extensions of work started in the previous year and consistency of methodology of these reviews was critical for the success of these engagements.

Internal audit

The primary role of the Global Internal Audit function is to help the Board and management protect the assets, reputation and sustainability of the Group. Global Internal Audit does this by providing independent and objective assurance on the design and operating effectiveness of the Group's governance, risk management and control framework and processes, prioritising the greatest areas of risk.

The independence of Global Internal Audit from day-to-day line management responsibility is critical to its ability to deliver objective audit coverage by maintaining an independent and objective stance. Global Internal Audit is free from interference by any element in the organisation, including on matters of audit selection, scope, procedures, frequency, timing, or internal audit report content. Global Internal Audit adheres to The Institute of Internal Auditors' mandatory guidance.

The Group Head of Internal Audit reports to the Chair of the GAC and there are frequent meetings held between them. Results of audit work, together with an assessment of the Group's overall governance, risk management and control framework and processes are reported regularly to the GAC, GRC and local audit and risk committees, as appropriate. This reporting highlights key themes identified through audit activity, business and regulatory developments, and provides an independent view of emerging and horizon risk, together with details of audit coverage.

Audit coverage is achieved using a combination of business and functional audits of processes and controls, risk management frameworks and major change initiatives as well as regulatory audits, investigations and special reviews. Key areas of focus for 2019 audit coverage were prudential soundness, operational resilience, conduct and culture, financial crime and regulatory compliance, and data management and governance. Executive management is responsible for ensuring that issues raised by the Global Internal Audit function are addressed within an appropriate and agreed timetable. Confirmation to this effect must be provided to Global Internal Audit, which validates closure on a risk basis.

Consistent with previous years, the 2020 audit planning process will include assessing the inherent risks and strength of the control environment across the audit entities representing the Group. Results of this assessment are combined with a top-down analysis of risk themes by risk category to ensure that themes identified are addressed in the plan. Risk theme categories for 2020 audit work include strategy, governance and culture; financial crime, conduct and compliance; financial resilience; and operational resilience. During 2020, a quarterly assessment of key risk themes will form the basis of thematic reporting and plan updates and will ultimately drive the 2021 planning process. The annual audit plan and material plan updates are approved by the GAC. The GAC is satisfied with the effectiveness of the Global Internal Audit function. On the appointment of Jonathan Calvert-Davies as Head of Group Internal Audit, the GAC considered and approved him joining the Group, and his independence with him being a former partner of PwC.

Global Internal Audit maintains a close working relationship with HSBC's external auditor, PwC. The external auditor is kept informed of Global Internal Audit's activities and results, and is afforded free access to all internal audit reports and supporting records.

Principal activities and significant issues considered during 2019

Collaborative oversight by GAC and GRC

The GAC and GRC worked closely to ensure there were procedures to manage risk and oversee the internal control framework. They also worked together to ensure any areas of significant overlap were appropriately addressed with inter-committee communication or joint meetings.

The Chairs are members of both committees and engage on the agendas of each other's committees to further enhance connectivity, coordination and flow of information.

In 2019, three Audit and Risk Committee Chair Forums were held in Hong Kong, New York and London with the chairs of principal and regional subsidiaries' audit and risk committees, together with senior management from these subsidiaries. The purpose of these Audit and Risk Committee Chair Forums was to discuss mutual priorities, improvement and remediation programmes and forward-looking issues in relation to the management of risk and the internal control framework.

Three areas of joint focus for the GAC and GRC during 2019 were:

Sustainable control environment

With oversight from the GAC, the Group Management Board initiated a programme to change and enhance the control environment in a way that can be sustained. The purpose of this programme is to ensure there is clear understanding, accountability and ownership for internal controls and end-to-end processes to deliver operational quality and consistent outcomes for customers and simpler operation of controls for colleagues. The GAC provided constructive challenge to management proposals and received regular progress updates on the work streams. Improvements were measured and tracked through a new enterprise-wide non-financial risk forum with escalation paths into the GAC and GRC. During 2020, the GAC will focus on the new business update and restructuring, and how they impact the control environment.

Financial reporting

The GAC reviewed and provided feedback on the assurance work and management's opinion on internal controls over financial reporting, as required by the Sarbanes-Oxley Act. In conjunction with the GRC, the GAC monitored the remediation of significant deficiencies and weaknesses in entity level controls raised by management and the external auditor. The GAC will continue to monitor the progress of remediation as well as efforts to integrate requirements of the Sarbanes-Oxley Act with the operational risk framework as part of the sustainable control environment programme.

For expected credit losses under IFRS 9, the GAC works with the GRC in reviewing and challenging the underlying economic scenarios, additional scenarios added by management and the reasonableness of the weightings applied to each scenario in order to understand the impact on the financial statements.

Monitoring changes to regulatory requirements

The GAC approved an annual priorities plan to review management's response to current and future changes in regulatory requirements affecting financial reporting. In 2019, this included changes in the UK and Hong Kong corporate governance codes, interpretation of new accounting standards, industry-wide regulatory reform programmes and their impact on accounting judgements. The GAC will continue to monitor specific accounting issues identified during the year and future regulatory items that will impact the integrity of financial reporting, the Group and its relationships with regulators.

Key financial metrics and strategic priorities

In exercising its oversight, the Committee assessed management's assurance and preparation of external financial reporting disclosures. In particular, the Committee provided feedback and challenge on the disclosures related to the monitoring and tracking of key financial metrics and strategic priorities.

In the third quarter of 2019, the Committee was involved at all stages in overseeing the disclosures that updated the market on the challenging revenue environment and the decision to update plans and set new financial targets.

Whistleblowing and 'speak up' culture

The GAC received regular updates on the status of the Group's whistleblowing arrangements, how they operated and how they were enhanced during the year. The Committee focused on the key culture- and conduct-related themes emerging from whistleblowing cases and the end-to-end control processes that deliver reliable, timely conclusions. This included feedback to management to drive a stronger 'speak up' culture as part of the Group's commitment to develop and maintain a culture where employees can raise issues and concerns without fear of punishment, embarrassment or rejection.

During the year, concerted efforts were made in many areas of the Group to build greater trust between employees and leaders and to normalise the act of airing concerns openly and directly. The Committee was kept informed of progress of the whistleblowing enhancement programme, which included the strengthening of entity level controls, the roll-out of a third-party technology solution and additional training for line managers.

Environmental, social and governance

The GAC received updates on future developments of the Group's ESG approach. The Committee monitored stakeholder feedback and reviewed management's gap analysis of Sustainalytics rating reports. The GAC considered best methods of assurance, presentation and alignment with the Annual Report and Accounts to allow stakeholders to gauge holistically HSBC's performance.

During the year, the Committee received reports from Global Internal Audit on the internal controls for sustainability risk.

Long-term viability statement

In accordance with the UK Corporate Governance Code, the Directors carried out a robust assessment of the principal risks of the Group and parent company. The GAC considered the statement to be made by the Directors and concluded that the Group and parent company will be able to continue in operation and meet liabilities as they fall due, and that it is appropriate that the long-term viability statement covers a period of three years.

Engagement with regulatory reform and review

The Committee held additional sessions to review and engage actively with the Competition and Markets Authority study into the statutory audit market, the Kingman review of the Financial Reporting Council and the Brydon review on the quality and effectiveness of audit. The Committee notes the importance of such reviews and proposals for reform to the work of the Committee in improving the quality of financial reporting and audit.

The Committee will continue to engage and monitor the proposals by the government to implement recommendations from these reviews.

Sir Jonathan Symonds, CBE

Chair

Group Audit Committee

18 February 2020