Company: HBCYF
Filing Date: 2025-02-20
Form Type: 20-F
Source: 0001089113-25-000040
Chunk: 504

Company: HSBC HOLDINGS PLC
Filing Date: 2025-02-20
Form: 20-F
Chunk 504
---
 including data loss, in a timely manner. We continue our focus on the quality and timeliness of the data used to inform management decisions, through measures such as early warning indicators, prudent active risk management of our risk appetite, and ensuring regular communication with our Board and other key stakeholders. Responsibility for risk management All employees are responsible for identifying and managing risk within the scope of their role as part of the three lines of defence model. This is an activity-based model to delineate management accountabilities and responsibilities for risk management and the control environment. The second line of defence sets the policy and guidelines for managing specific risk areas, provides advice and guidance in relation to the risk, and challenges the first line of defence (the risk owners) on effective risk management. The Board delegated authority to the GAC to annually review the independence, autonomy and effectiveness of the Group’s policies and procedures on whistleblowing, including the procedures for the protection of staff who raise concerns of detrimental treatment. Strategic plans Strategic plans are prepared for global businesses, global functions and geographical regions within the framework of the Group’s overall strategy. Financial resource plans, informed by detailed analysis of risk appetite describing the types and quantum of risk that the Group is prepared to take in executing its strategy, are prepared and adopted by all major Group operating companies and set out the key business initiatives and the likely financial effects of those initiatives.

Internal control over financial reporting HSBC is required to comply with section 404 of the US Sarbanes- Oxley Act of 2002 and assess its effectiveness of internal control over financial reporting at 31 December 2024. In 2014, the GAC endorsed the adoption of the principles of the Committee of Sponsoring Organizations of the Treadway Commission (’COSO’) 2013 framework for the monitoring of risk management and internal control systems to satisfy the requirements of section 404 of the Sarbanes- Oxley Act. The primary mechanism through which comfort over risk management and internal control systems is achieved is through annual assessments of the effectiveness of controls to manage risk, and the reporting of issues on a regular basis through the various risk management and risk governance forums, including regular updates to GAC. The key risk management and internal control procedures over financial reporting include the following: Entity level controls Entity level controls are a defined suite of internal controls that have a pervasive influence over the entity as a whole and meet the principles of the COSO framework. They include controls related to the control environment, such as the Group’s values and ethics, the promotion of