Company: HBCYF
Filing Date: 2025-02-20
Form Type: 20-F
Source: 0001089113-25-000040
Chunk: 216

Company: HSBC HOLDINGS PLC
Filing Date: 2025-02-20
Form: 20-F
Chunk 216
---
, which takes into account our business and functional structures as described below. Three lines of defence To create a robust control environment to manage risks, we use an activity-based three lines of defence model. This model delineates management accountabilities and responsibilities for risk management and the control environment. The model underpins our approach to risk management by clarifying responsibility and encouraging collaboration, as well as enabling effective coordination of risk and control activities. The three lines of defence are summarised below: – The first line of defence owns the risks and is responsible for identifying, recording, reporting and managing these risks in line with risk appetite, including that the right controls and assessments are in place to mitigate them. – The second line of defence challenges the first line of defence on effective risk management, and provides advice, guidance and assurance of the first line of defence to help ensure it is managing risk effectively. – The third line of defence is our Global Internal Audit function, which provides independent assurance as to whether our risk management approach and processes are designed and operating effectively. Group Risk and Compliance function Our Group Risk and Compliance function is responsible for the Group’s risk management framework. This responsibility includes establishing global policy, monitoring risk profiles, and identifying and managing forward-looking risk. Group Risk and Compliance is made up of sub-functions covering all risks to our business. Forming part of the second line of defence, the Group Risk and Compliance function is independent from the global businesses, including sales and trading functions. It provides challenge, appropriate oversight and balance in risk/return decisions. Responsibility for minimising both financial and non-financial risk, including regulatory compliance and financial crime, lies with our people. They are required to manage the risks of the business and operational activities for which they are responsible. We maintain adequate oversight of our risks through our various specialist risk stewards and the collective accountability held by our chief risk and compliance officers. We have continued to strengthen the control environment and our approach to the management of risk, as set out in our risk management framework. Our ongoing focus is on helping to enable more effective oversight and better end-to-end identification and management of financial and non-financial risks. This is overseen by the Enterprise Risk Management function, headed by the Global Head of Enterprise Risk Management. Stress testing and recovery planning Our stress testing programme assesses our capital and liquidity strength through an examination of our resilience to external shocks, and forms part of our risk management and capital and liquidity planning. As well as undertaking regulatory-driven stress tests, we conduct our own internal stress tests to understand the nature and