Company: HBCYF
Filing Date: 2025-02-20
Form Type: 20-F
Source: 0001089113-25-000040
Chunk: 416

Company: HSBC HOLDINGS PLC
Filing Date: 2025-02-20
Form: 20-F
Chunk 416
---
 risks from whistleblowing cases and actions taken. In 2024, the GAC Chair also met with the Group Head of Regulatory Compliance for briefings on significant whistleblowing matters. Global Internal Audit The primary role of the Global Internal Audit function is to help the Board and Management to strengthen the organisation’s ability to create, protect and sustain value. Global Internal Audit does this by providing independent, risk based and objective assurance on the design and operating effectiveness of the Group’s governance, risk management and control framework and processes, prioritising the greatest areas of risk. The independence of Global Internal Audit from day-to-day line management responsibility is fundamental to its ability to deliver objective audit coverage of all parts of the Group. Global Internal Audit is free from interference by any element in the organisation, including on matters of audit selection, scope, procedures, frequency, timing, or internal audit report content. The Group Head of Internal Audit reports to, and meets frequently with, the Chair of the GAC. In addition, in 2024, there was continued heightened interaction between Global Internal Audit Senior Management and the members of the GAC, aimed at increasing knowledge and awareness of the audit universe and existing and emerging risks identified by Global Internal Audit. Global Internal Audit adheres to The Institute of Internal Auditors' mandatory guidance. Consistent with previous years, the 2025 audit planning process includes assessing the inherent risks and strength of the control environment across the audit entities representing the Group. Results of this assessment are combined with a top-down analysis of risk themes by risk category to ensure that themes identified are addressed in the annual plan. Audit coverage is achieved using a combination of business and functional audits of processes and controls, risk management frameworks and major change initiatives, as well as regulatory audits, investigations and special reviews. In addition to the ongoing importance of regulatory-focused work, key risk theme categories for 2025 audit coverage remain as: strategy, governance and culture; financial crime, conduct and compliance; financial resilience; and operational resilience. A quarterly continuous monitoring assessment of key risk themes will form the basis of thematic reporting and plan updates and will ultimately drive the 2026 planning process. Global Internal Audit has made updates to the audit universe and risk assessment to reflect the Group reorganisation. As a result, audits have been added to the 2025 Annual Audit Plan, and audits have been refocused, to reflect the risks arising from the Group reorganisation. In addition to the Group reorganisation, Global Internal Audit’s new or heightened areas of coverage for 2025 are: Group