Annual Financial Report - Part 6

Compliance with regulatory requirements

The Board has confirmed that each member of the Committee is independent according to the criteria from the US Securities and Exchange Commission, and the Committee continues to have competence relevant to the sector in which the Group operates. The Board has determined that David Nish, Jackson Tai and Eileen Murray are all 'financial experts' for the purposes of section 407 of the Sarbanes-Oxley Act and have recent and relevant financial experience for the purposes of the UK and Hong Kong Corporate Governance Codes.

The Committee assessed the adequacy of resources of the accounting and financial reporting function. It also monitored the legal and regulatory environment relevant to its responsibilities.

The GAC Chair had regular meetings with the regulators, including the UK's PRA and the FCA. These included trilateral meetings involving the Group's external auditor PwC.

How the Committee discharged its responsibilities

Connectivity with principal subsidiary audit committees

During the year the GAC Chair regularly met with the chairs of the principal subsidiary audit committees and attended meetings to enable closer links and deeper understanding on judgements around key issues. In addition, there was regular interaction with committee chairs across the Group through the Audit and Risk Committee Chairs' Forum ('ARCC').

Appointments to the audit committees of the principal subsidiary audit committees were reviewed and endorsed by the GAC. The GAC Chair met with proposed new chairs prior to their appointment. 

On a half-yearly basis, principal subsidiary audit committees provided certifications to the GAC regarding the preparation of their financial statements, adherence to Group policies and escalation of any issues that required the attention of the GAC.

Financial reporting

The Committee's review of financial reporting during the year included the Annual Report and Accounts, Interim Report, quarterly earnings releases, analyst presentations and Pillar 3 disclosures.

As part of its review, the GAC evaluated management's application of critical accounting policies, significant accounting judgements and compliance with disclosure requirements to ensure these were consistent, appropriate and acceptable under the relevant financial reporting requirements. The Committee gave careful consideration to the key performance metrics related to strategic priorities and ensured that the performance and outlook statements were fair, balanced and reflected the risks and uncertainties appropriately.  

During the year, the Committee received regular updates from management on the additional guidance and disclosures made in relation to the Covid-19 outbreak. The Committee considered and was satisfied with the management response to the Financial Reporting Council's ('FRC') comments on HSBC's Annual Report and Accounts 2019 regarding goodwill impairment disclosures, and the industry-wide FRC publications, including the letter to audit committee chairs. 

In conjunction with the Group Risk Committee ('GRC'), the GAC considered the current position of the Group, along with the emerging and principal risks, and carried out a robust assessment of the Group's prospects, before making a recommendation to the Board on the Group's long-term viability statement. The GAC also undertook a detailed review before recommending to the Board that the Group continues to adopt the going concern basis in preparing the annual and interim financial statements. Further details can be found on page 41.

The Committee's review of the long-term viability statement and the adoption of the going concern basis factored in additional guidance issued by the FRC on financial reporting in light of the Covid-19 outbreak.

Following review and challenge of the disclosures, the Committee recommended to the Board that the financial statements, taken as a whole, were fair, balanced and understandable. The financial statements provided the shareholders with the necessary information to assess the Group's position and performance, business model, strategy and risks facing the business.

Covid-19 impact on accounting judgements

The Committee devoted significant time, including additional meetings, to the review and challenge of management's approach and analysis of IFRS 9 expected credit losses ('ECL') in light of the Covid-19 outbreak and other geopolitical events. In its review, the GAC gave due regard to the interpretation and application of additional guidelines in relation to the Covid-19 outbreak and estimating ECL that were issued by various regulators.

The Committee gave careful consideration to the measurement of ECL, in particular the key judgements and management adjustments made in relation to the forward economic guidance, underlying economic scenarios, reasonableness of the weightings and the impact on financial statements and disclosures.

There was detailed discussion on the risks to ECL models as the unprecedented nature of the pandemic meant that the severity of the economic conditions was outside the bounds of historical data and experience used to develop IFRS 9 models. The Committee challenged management on the approach to modelling ECL, specifically the use of Credit Risk judgements and invited HSBC's credit experts to present their views to the Committee.

At the request of the GAC Chair, Global Internal Audit carried out additional verification and assurance regarding the disclosures made in quarterly reporting on the range of ECL outlook and consistency of the ECL disclosures. The Group's external auditor regularly shared its views with the Committee on the reasonableness of management assumptions, given the significant changes made to the estimation of ECL due to the impact of the Covid-19 outbreak on the design, implementation and operation of ECL controls.

Other areas of significant accounting judgements requiring in-depth review due to the Covid-19 pandemic included valuation of financial instruments, goodwill impairment, hedge accounting and investment in associates. Further details can be found in the 'Principal activities and significant issues considered during 2020' table on page 220.

Internal controls

The GAC assessed the effectiveness of the internal control system for financial reporting and any developments affecting it. This was in support of the Board's assessment of internal control over financial reporting, in accordance with section 404 of the Sarbanes-Oxley Act.

The Committee received regular updates and confirmations that management had taken, or was taking, the necessary actions to remediate any failings or weaknesses identified through the operation of the Group's framework of controls. Further details of how the Board reviewed the effectiveness of key aspects of internal control can be found on page 260.

In 2020 the updates provided to the Committee included the potential impacts on internal control from the Covid-19 outbreak. These impacts included both those directly relevant to operational processes and controls, such as where new or amended controls were required to administer government relief packages, and more indirect impacts such as from colleagues working under contingency arrangements. A number of additional assurance procedures were performed across the lines of defence to monitor, assess and mitigate these impacts, with results regularly reported to the Committee.

External auditor

The Group's external auditor is PwC, which has held the role for six years, and the senior audit partner is Scott Berryman who has been in the role since 2019. The Committee reviewed the external auditor's approach and strategy for the annual audit and also received regular updates on the impact on the control environment from the Covid-19 outbreak and the Group transformation programme. Principal matters discussed with PwC are set out in its report on page 267.

PwC discussed the impact from the Covid-19 outbreak on the execution and delivery of the audit and the plans to deliver the audit through remote working and mitigating actions being taken. These included accelerating aspects of planning and performing a number of areas of audit earlier to factor in expected delays due to remote working. There was also discussion on additional relevant work in relation to significant accounting judgements, such as expected credit losses, and the impact of the Covid-19 outbreak on the basis for determining materiality.

During the year, the GAC assessed the effectiveness of PwC as the Group's external auditor, using a questionnaire that focused on the overall audit process, its effectiveness and the quality of output. The Committee gave particular focus to the actions being taken by PwC in response to the findings from the HSBC effectiveness review and the PwC firm-wide Audit Quality Review by the Financial Reporting Council. PwC highlighted the continuing investment in both additional resources and new technologies to improve the quality and consistency of the audit. The Committee Chair also met the PwC engagement quality control partner for HSBC privately to discuss the continuous audit improvement actions.

The GAC received an update on the partner rotation and succession for the Group and its principal subsidiaries and the steps taken to ensure effective transitions.

The GAC monitored the policy on hiring employees or former employees of the external auditor, and there were no breaches of the policy highlighted during the year. The external auditor attended all Committee meetings and the GAC Chair maintains regular contact with the senior audit partner and his team throughout the year.

The Committee also assessed any potential threats to independence that were self-identified or reported by PwC. The GAC considered PwC to be independent and PwC, in accordance with professional ethical standards, provided the GAC with written confirmation of its independence for the duration of 2020.

The Committee confirms it has complied with the provisions of the Competition and Markets Authority Order for the financial statements. The Committee acknowledges the provisions contained in the UK Corporate Governance Code in respect of audit tendering. In conformance with these requirements, HSBC will be required to tender for the audit for the 2025 financial year end and beyond, having appointed PwC from
1 January 2015.

The Committee believed it would not be appropriate to re-tender as a change in auditor would have a significant impact on the organisation, including on the Global Finance function. A change would lead to disruption and an increase in operational risk given the ongoing impact from the Covid-19 pandemic and the significant strategic change underway through the Group transformation programme. In addition, the Committee is closely monitoring the consultations and proposals arising from the Competition and Market Authority's statutory audit market study, the Kingman Review of the Financial Reporting Council and the Brydon Review on the quality and effectiveness of audit on the future of the UK external audit market. The Committee will consider its audit tendering strategy in line with the outcomes of the UK audit reform and well in advance of re-tendering in 2025.

The Committee has recommended to the Board that PwC should be reappointed as auditor. Resolutions concerning the reappointment of PwC and its audit fee for 2021 will be proposed to shareholders at the 2021 AGM.

Non-audit services

The Committee is responsible for setting, reviewing and monitoring the appropriateness of the provision of non-audit services by the external auditor. It also applies the Group's policy on the award of non-audit services to the external auditor. During the year, GAC reviewed changes made to the Group's policy resulting from the implementation of 'The Financial Reporting Council Revised Ethical Standard 2019' (effective in 2020) and changes to internal governance. The key change in the revised standard is the introduction of a 'whitelist of services' that the principal accountant can provide. All services not prescribed in the whitelist are prohibited. The non-audit services are carried out in accordance with the external auditor independence policy to ensure that services do not create a conflict of interest. All non-audit services are either approved by the GAC, or by Group Finance when acting within delegated limits and criteria set by the GAC.

The non-audit services carried out by PwC included 45 engagements approved during the year where the fees were over $100,000 but less than $1m. Global Finance, as a delegate of GAC, considered that it was in the best interests of the Group to use PwC for these services because they were:

•    audit-related engagements that were largely carried out by members of the audit engagement team, with the work closely related to the work performed in the audit;

•    engagements covered under other assurance services that require obtaining appropriate audit evidence to express a conclusion designed to enhance the degree of confidence of the intended users other than the responsible party about the subject matter information; or

•    other permitted services to advisory attestation reports on internal controls of a service organisation primarily prepared for and used by third-party end users.

Eight engagements during the year were approved where the fees exceeded $1m. These were mainly engagements required by the regulator and incremental fees related to previously approved engagements. One new engagement outside the scope of the pre-approved services related to preliminary advanced audit procedures for the adoption of IFRS 17 in 2023.

Global Internal Audit

The primary role of the Global Internal Audit function is to help the Board and management protect the assets, reputation and sustainability of the Group. Global Internal Audit does this by providing independent and objective assurance on the design and operating effectiveness of the Group's governance, risk management and control framework and processes, prioritising the greatest areas of risk.

The independence of Global Internal Audit from day-to-day line management responsibility is critical to its ability to deliver objective audit coverage by maintaining an independent and objective stance. Global Internal Audit is free from interference by any element in the organisation, including on matters of audit selection, scope, procedures, frequency, timing, or internal audit report content. Global Internal Audit adheres to The Institute of Internal Auditors' mandatory guidance.

The Group Head of Audit reports to the Chair of the GAC and there are frequent meetings held between them. Results of audit work, together with an assessment of the Group's overall governance, risk management and control framework and processes are reported regularly to the GAC, GRC and local audit and risk committees, as appropriate. This reporting highlights key themes identified through audit activity, business and regulatory developments, and provides an independent view of emerging and horizon risk, together with details of audit coverage.

Audit coverage is achieved using a combination of business and functional audits of processes and controls, risk management frameworks and major change initiatives, as well as regulatory audits, investigations and special reviews. In addition to the ongoing importance of regulatory-focused work, key risk theme categories for 2020 audit coverage were strategy, governance and culture, financial crime, conduct and compliance, financial resilience and operational resilience. In April 2020, in response to the Covid-19 outbreak, Global Internal Audit completed a risk-based review to revise the 2020 annual audit plan to create capacity for real-time audits targeted at key risks arising from the pandemic. Real-time audits provide real-time, independent ongoing observations to management responding to the Covid-19 outbreak. Issues are raised for significant observations that are not addressed in a timely manner. In addition, in response to the business update in February 2020, Global Internal Audit focused on governance over the transformation programme and performed project audit activity for selected complex and high-priority business cases.

Executive management is responsible for ensuring that issues raised by the Global Internal Audit function are addressed within an appropriate and agreed timetable. Confirmation to this effect must be provided to Global Internal Audit, which validates closure on a risk basis.

Consistent with previous years, the 2021 audit planning process includes assessing the inherent risks and strength of the control environment across the audit entities representing the Group. Results of this assessment are combined with a top-down analysis of risk themes by risk category to ensure that themes identified are addressed in the plan. Risk theme categories for the 2021 audit work continue to be strategy, governance and culture, financial crime, conduct and compliance, financial resilience, and operational resilience. During 2021, a quarterly assessment of key risk themes will form the basis of thematic reporting and plan updates and will ultimately drive the 2022 planning process. The annual audit plan and material plan updates are approved by the GAC. Based on regular internal audit reporting to the GAC, private sessions with the Group Head of Audit, the Global Professional Practices annual assessment and quarterly Quality Assurance updates, the GAC is satisfied with the effectiveness of the Global Internal Audit function and the appropriateness of its resources. 

Global Internal Audit maintains a close working relationship with HSBC's external auditor, PwC. The external auditor is kept informed of Global Internal Audit's activities and results, and is afforded free access to all internal audit reports and supporting records.

Principal activities and significant issues considered during 2020

Collaborative oversight by GAC and GRC

The GAC and GRC worked closely to ensure there were procedures to manage risk and oversee the internal control framework. They also worked together to ensure any common areas of responsibility were addressed appropriately with inter-committee communication or joint discussions with the Chairs.

The Chairs are members of both committees and engage on the agendas of each other's committees to further enhance connectivity, coordination and flow of information. This is further complemented with significant overlap in membership of the GAC and GRC to ensure deeper understanding and informed challenge at both meetings.

During 2020, the GAC and GRC Chairs reviewed and challenged management's proposals to transition the responsibility for oversight of entity level controls from the GAC to the GRC. The Chairs considered whether there was the suitable level of management seniority for ownership of entity level controls and whether there was regular and appropriate reporting to both committees to fulfil their oversight responsibilities.

In 2020, five ARCC Forums were held with the chairs of principal and regional subsidiaries' audit and risk committees, together with senior management from these subsidiaries. The purpose of these ARCC Forums was to discuss mutual priorities, improvement and remediation programmes and forward-looking issues in relation to the management of risk and the internal control framework. The topics discussed at the ARCC Forums can be found in the GRC report on page 226.

Three areas of joint focus for the GAC and GRC during 2020 were:

Sustainable control environment

With oversight from the GAC, the Group Executive Committee continued a programme to ensure there is clear understanding, accountability and ownership for internal controls and end-to-end processes to deliver operational quality and consistent outcomes for customers and simpler operation of controls for colleagues.

The GAC provided constructive challenge to management proposals and received regular progress updates on the work streams. Improvements were measured and tracked through a new enterprise-wide non-financial risk forum with escalation paths into the GAC and GRC.

Financial reporting

The GAC reviewed and provided feedback on the assurance work and management's opinion on internal controls over financial reporting, as required by the Sarbanes-Oxley Act. In conjunction with the GRC, the GAC monitored the remediation of significant deficiencies and weaknesses in entity level controls raised by management and the external auditor. The GAC will continue to monitor the progress of remediation as well as efforts to integrate requirements of the Sarbanes-Oxley Act with the operational risk framework as part of the sustainable control environment programme.

In 2020, the GAC and the GRC reviewed the risks arising from models used for the estimation of expected credit losses under IFRS 9, particularly given the economic backdrop of the Covid-19 outbreak. The committees challenged the underlying economic scenarios, additional scenarios added by management and the reasonableness of the weightings applied to each scenario in order to understand the impact on the financial statements.

Monitoring changes to regulatory requirements

The GAC approved an annual priorities plan to review management's response to current and future changes in regulatory requirements affecting financial reporting. In 2020, this included interpretation of new accounting standards, industry-wide regulatory reform programmes and their impact on accounting judgements. The GAC will continue to monitor specific accounting issues identified during the year and future regulatory items that will impact the integrity of financial reporting, the Group and its relationships with regulators.

There continues to be an increased focus on the quality of regulatory reporting by the PRA and other regulators globally. The GAC will review the steps taken by management to strengthen the controls over regulatory reporting and as we strengthen our processes and controls, there may be impacts on some of our regulatory ratios. 

In conjunction with the GRC, the GAC continued to oversee the progress of management's proposals and implementation of the Basel III Reforms and the Ibor transition. The GAC focused on the operational and control environment impacts from Basel III Reforms and Ibor transition on HSBC's financial reporting and interdependencies with other Group transformation programmes.

Whistleblowing and 'speak up' culture

Whistleblowing is a key element of 'speak up' culture, with the Group's whistleblowing channel, HSBC Confidential, offering a variety of ways for our people to raise whistleblowing concerns (see page 68 for further information). The GAC is responsible for the oversight of the effectiveness of the Group's whistleblowing arrangements. The Group's Chief Compliance Officer provides periodic reporting to the GAC on the efficacy of the whistleblowing arrangements, providing an assessment of controls and detailing the results of internal audit assessments. The Committee is also briefed on culture and conduct risks and associated management actions arising from whistleblowing cases. The Chair of the GAC acts as the Group's whistleblowers' champion, with responsibility for ensuring and overseeing the integrity, independence and effectiveness of HSBC's policies and procedures on whistleblowing and the protection of whistleblowers. The Chair met with the Group Head of Whistleblowing Oversight throughout the year for briefings on material whistleblowing cases and assessments of the whistleblowing arrangements.

The Committee has requested updates on a number of key areas during 2020, including an assessment of the timeliness of whistleblowing investigations. The arrangements were subject to an internal audit review during 2020, which rated the design, control and management oversight of the arrangements as satisfactory. As part of the ongoing assessment of the end-to-end arrangements, the Committee has requested a deeper review in key markets of the employee investigation function in which the whistleblowing arrangements have a dependency. An external benchmarking assessment was presented to the GAC in December 2020. This provided an overview of the overall effectiveness of whistleblowing arrangements and investigations processes against a number of industry peers, and best practice guidance issued by external consultancy and legal firms as well as the UK charity, Protect. The assessment reflected the significant progress made during 2020 such as the implementation of a new whistleblowing platform (Navex), the enhanced global minimum standards and improvements observed in the 'speak up' culture. In addition, governance was improved with a particular focus on key emerging conduct themes to enable timely management action, and a mechanism was introduced for whistleblowers to provide feedback post-investigation. The assessment also identified further opportunities for 2021 as part of the Group's fit for the future programme with updates to be provided to the whistleblowing champion and the GAC throughout 2021.