Although global economic activity strengthened in 2017, growth was weak in many countries and headwinds remain in both developed and emerging economies. Global central banks have initiated a gradual tightening of monetary policy that will likely continue into 2018. Sharper than expected interest rate rises, or economic and/or geopolitical shocks, could lead to an increase in capital flows volatility, especially for emerging markets, potentially impacting economic growth.

Protectionism is on the rise in many parts of the world, driven by both populist sentiment and structural challenges facing developed economies. This rise could contribute to weaker global trade, potentially affecting HSBC's traditional lines of business.

The ongoing uncertainty regarding the terms of the UK's exit from the EU, the UK's future relationship with the EU, and its trading relationship with the rest of the world, may lead to market volatility, which could affect both the Group and its customers.

The level of indebtedness in mainland China remains high. Any policy action to restrain credit growth could have wider ramifications for regional and global economic growth, trade and capital flows.

Increased tensions in the Middle East may have significant regional economic and political consequences which could impact the Group's operations within the region.

Oil prices have staged a partial recovery since mid-2017, returning to levels last seen in late 2014. Nevertheless, certain producers, exporters and oil services companies are still under financial strain, which could negatively affect their investment budgets and thus business prospects for HSBC.

Our operations and portfolios are exposed to risks associated with political instability, civil unrest and military conflict, which could lead to disruption to our operations, physical risk to our staff and/or physical damage to our assets. In addition, rising protectionism and the increasing trend of using trade and investment policies as diplomatic tools may also adversely affect global trade flows.

Geopolitical risk remained heightened throughout 2017. While elections across the EU during 2017 have temporarily stemmed a populist tide, political uncertainty remains high in the UK as negotiations progress towards an exit from the EU (see 'Process of UK withdrawal from the European Union' in Areas of special interest on page 66). In addition, the threat of terrorism within the region remains high.

Report of the Directors | Risk

Mitigating actions

•	We use internal stress tests and scenario analysis as well as regulatory stress test programmes, to adjust limits and exposures to reflect our risk appetite and mitigate risks as appropriate. Our internal credit risk ratings of sovereign counterparties take into account geopolitical developments that could potentially disrupt our portfolios and businesses.

•	Contingency planning for the UK's exit from the EU continues and we are assessing the potential impact on our portfolios, operations and staff.

•	We have taken steps to enhance physical security in those geographical areas deemed to be at high risk from terrorism and military conflicts.

The credit cycle

The credit environment remains benign as evidenced by the continued fall in loan impairment charges during 2017. However, there is a risk that the credit cycle could turn sharply as a result of shocks. These could occur as a result of political events in the US, UK and EU, or sentiment towards mainland China deteriorating amid concerns over increasing leverage in the financial system. Additionally, a renewed downward trend in oil prices could increase financial difficulties in the oil and gas sector.

Mitigating actions

•	We stress test portfolios of particular concern to identify sensitivity to loss under a range of scenarios, with management actions being taken to rebalance exposures and manage risk appetite where necessary.

•	Reviews of key portfolios are undertaken regularly to help ensure that individual customer or portfolio risks are understood and our ability to manage the level of facilities offered through any downturn is appropriate.

Cyber-threat and unauthorised access to systems

Mitigating actions

•	Cyber risk is a priority area for the Board and is regularly reported at Board level to ensure appropriate visibility, governance and executive support for our ongoing cybersecurity programme.

•	We participate in intelligence sharing with both law enforcement and industry schemes to help improve our understanding of, and ability to respond to, the evolving threats faced by us and our peers.

Regulatory, technological and sustainability developments including conduct, with adverse impact on business model and profitability

Mitigating actions

•	We hold regular meetings with UK authorities to discuss strategic contingency plans covering a wide range of scenarios relating to the UK's exit from the EU.

•	We have invested significant resources and have taken, and will continue to take, a number of steps to improve our compliance systems and controls relating to global markets activities. For

further details, see 'Regulatory compliance risk management' on page 77.

•	We continue to work with NGOs to enhance our policies to support sustainable finance.

Financial crime risk environment

Mitigating actions

•	We strengthened governance processes during 2017 by establishing formal financial crime risk governance committees at region, global business and country levels of the organisation. This will help to ensure appropriate oversight and escalation of issues to the Financial Crime Risk Management Meeting of the Group Management Board.

•	We are working to develop enhanced risk management capabilities through better use of sophisticated analytical techniques.

•	We are working to ensure that the reforms we have put in place are both effective and sustainable over the long term. Work in these areas will continue to be consistent with the terms of the orders by which we are bound and the strategic objectives of the Group.

Internally driven

IT systems infrastructure and resilience

Mitigating actions

•	During 2017, we continued to monitor and upgrade our IT systems, simplifying our service provision and replacing older IT infrastructure and applications. These enhancements led to a further improvement in service availability during the year for our customers and employees.

Impact of organisational change and regulatory demands on employees

Mitigating actions

•	Through dedicated work streams, we continue to develop succession plans using a broad array of talent-sourcing channels for key management roles, which are reviewed on a regular basis.

•	Contingency planning to address the potential impacts of the UK's exit from the EU on our staff is underway with regular updates provided to the UK authorities.

Execution risk

Mitigating actions

•	In 2017, we continued to manage execution risks through closely monitoring the punctual delivery of critical initiatives, internal and external dependencies, and key risks, to allow better portfolio management across Group. The GCC also monitors the ongoing completion of material deliverables across these programmes in order to address any resourcing challenges.

•	The GCC escalates any necessary issues to the Group Risk Management Meeting of the Group Management Board.

Report of the Directors | Risk

Risks arising from the receipt of services from third parties

Mitigating actions

•	We established a dedicated oversight forum in the second line of defence to monitor the embedding of policy requirements and performance against risk appetite.

Enhanced model risk management expectations

Mitigating actions

•	We further strengthened our model risk management framework throughout 2017 by establishing additional global model oversight committees and implementing policies and standards in accordance with key regulatory requirements.

•	As we adopt new modelling technologies, we are updating our model risk management framework and governance standards to help address any new risks arising.

Data management

Mitigating actions

•	We continue to proactively monitor customer and transaction data resolving any associated data issues. We have also implemented data controls and enhanced reconciliation in order to improve the reliability of data used by our customers and staff.

•	We have deployed risk and finance data aggregation and advanced reporting capabilities to key markets in 2017. We are on track for completing actions for the remaining countries in scope by the end of 2018.

•	A dedicated programme of work has been mobilised to execute the GDPR requirements in order to enhance our customers' data protection and privacy.

During 2017, we considered a number of areas because of the effect they may have on the Group. While these areas have been identified and considered as part of our top and emerging risks, we have placed particular focus on the UK withdrawal from the European Union in this section.

Process of UK withdrawal from the European Union

The UK is due to formally leave the EU in March 2019. Before this can happen, the UK and the EU have to finalise the Article 50 Withdrawal Agreement, which will then need to be approved by their respective Parliaments. Concluding negotiations on a comprehensive trade deal within this time frame could be challenging. A period of transition is therefore possible but the scope and length of any such arrangement would need to be agreed between the UK and the EU. Uncertainty therefore continues and with it the risk of significant market volatility.

This section describes the enterprise risk management framework, and the significant policies and practices employed by HSBC in managing its material risks.

Our risk management framework

We use an enterprise risk management framework across the organisation and across all risk types. It is underpinned by our risk culture and is reinforced by the HSBC Values and our Global Standards programme.

The framework fosters continuous monitoring of the risk environment, and an integrated evaluation of risks and their interactions. It also ensures a consistent approach to monitoring, managing and mitigating the risks we accept and incur in our activities.

The following diagram and descriptions summarise key aspects of the framework, including governance and structure, our risk management tools and our risk culture, which together help align employee behaviour with our risk appetite.

Our risk culture

For further information on remuneration, see the Directors' Remuneration Report on page 141.

Governance and structure

The Board has ultimate responsibility for the effective management of risk and approves HSBC's risk appetite. It is advised on risk-related matters by the Group Risk Committee ('GRC'), the Financial System Vulnerabilities Committee ('FSVC'), and the Conduct & Values Committee ('CVC') (see pages 130, 131 and 132 respectively).

Executive accountability for the ongoing monitoring, assessment and management of the risk environment and the effectiveness of the risk management framework resides with the Group Chief Risk Officer. He is supported by the Risk Management Meeting of the Group Management Board ('RMM').

The management of financial crime risk resides with the Group Head of Financial Crime Risk. He is supported by the Financial Crime Risk Management Meeting, as described under 'Financial crime risk management' on page 78.

Day-to-day responsibility for risk management is delegated to senior managers with individual accountability for decision making. All employees have a role to play in risk management. These roles are defined using the three lines of defence model, which takes into account the Group's business and functional structures as described below.

We use a defined executive risk governance structure to help ensure appropriate oversight and accountability of risk, which facilitates reporting and escalation to the RMM. This structure is summarised in the following table.

Report of the Directors | Risk

Our responsibilities

All employees are responsible for identifying and managing risk within the scope of their role as part of the three lines of defence model.

Three lines of defence

To create a robust control environment to manage risks, we use an activity-based three lines of defence model. This model delineates management accountabilities and responsibilities for risk management and the control environment.

The model underpins our approach to risk management by clarifying responsibility, encouraging collaboration, and enabling efficient coordination of risk and control activities. The three lines of defence are summarised below:

•	The second line of defence sets the policy and guidelines for managing specific risk areas, provides advice and guidance in relation to the risk, and challenges the first line of defence on effective risk management.

•	The third line of defence is our Internal Audit function, which provides independent and objective assurance of the adequacy of the design and operational effectiveness of the Group's risk management framework and control governance process.

Global Risk function

We have a Global Risk function, headed by the Group Chief Risk Officer, which is responsible for the Group's risk management framework. This responsibility includes establishing global policy, monitoring risk profiles, and forward-looking risk identification and management. Global Risk is made up of sub-functions covering all risks to our operations. Global Risk forms part of the second line of defence. It is independent from the global businesses, including sales and trading functions, to provide challenge, appropriate oversight and balance in risk/return decisions.

Enterprise-wide risk management tools

The Group uses a range of tools to identify, monitor and manage risk. The key enterprise-wide risk management tools are summarised below.

Risk appetite

Our risk appetite encapsulates consideration of financial and non-financial risks and is expressed in both quantitative and qualitative terms. It is applied at the global business level, at the regional level, and to material operating entities.

The Group's risk appetite defines its desired forward-looking risk profile, and informs the strategic and financial planning process. Furthermore, it is integrated with other key risk management tools, such as stress testing and our top and emerging risk reports, to help ensure consistency in risk management practices.

The Group sets out the aggregated level and risk types it accepts in order to achieve its business objectives in a risk appetite statement ('RAS'). The RAS is reviewed on an ongoing basis, and formally approved by the Board every six months on the recommendation of the GRC.

The Group's actual performance is reported monthly against the approved RAS to the RMM, enabling senior management to monitor the risk profile and guide business activity to balance risk and return. This reporting allows risks to be promptly identified and mitigated, and informs risk-adjusted remuneration to drive a strong risk culture.

Global businesses, regions and strategically important countries are required to have their own RASs, which are monitored to ensure they remain aligned with the Group's. All RASs and business activities are guided and underpinned by qualitative principles (see page 131). Additionally, for key risk areas, quantitative metrics are defined along with appetite and tolerance thresholds.

Risk map

The Group risk map provides a point-in-time view of the risk profiles of countries, regions and global businesses across HSBC's risk taxonomy. It assesses the potential for these risks to have a material impact on the Group's financial results, reputation and the sustainability of its business. Risk stewards assign 'current' and 'projected' risk ratings, supported by commentary. Risks that have an 'amber' or 'red' risk rating require monitoring and mitigating action plans to be either in place or initiated to manage the risk down to acceptable levels.

Descriptions of our material banking and insurance risks are set out on page 70.

Top and emerging risks

We use a top and emerging risks process to provide a forward-looking view of issues with the potential to threaten the execution of our strategy or operations over the medium to long term.

We proactively assess the internal and external risk environment, as well as review the themes identified across our regions and global businesses, for any risks that may require global escalation, updating our top and emerging risks as necessary.

We define a 'top risk' as a thematic issue that may form and crystallise in between six months and one year, and that has the potential to materially affect the Group's financial results, reputation or business model. It may arise across any combination of risk types, regions or global businesses. The impact may be well understood by senior management and some mitigating actions may already be in place. Stress tests of varying granularity may also have been carried out to assess the impact.

An 'emerging risk' is a thematic issue with large unknown components that may form and crystallise beyond a one-year time horizon. If it were to materialise, it could have a material effect on the Group's long-term strategy, profitability and/or reputation. Existing mitigation plans are likely to be minimal, reflecting the uncertain nature of these risks at this stage. Some high-level analysis and/or stress testing may have been carried out to assess the potential impact.

Our current top and emerging risks are discussed on page 63.

Stress testing

HSBC operates a comprehensive stress testing programme that supports our risk management and capital planning. It includes execution of stress tests mandated by our regulators. Our stress testing is supported by dedicated teams and infrastructure, and is overseen at the most senior levels of the Group.

Our stress testing programme assesses our capital strength through a rigorous examination of our resilience to external shocks. It also helps us understand and mitigate risks and informs our decisions about capital levels. As well as undertaking regulatory-driven stress tests, we conduct our own internal stress tests.

Many of our regulators - including the BoE, the FRB and the HKMA - use stress testing as a prudential regulatory tool and the Group has focused significant governance and resources to meet their requirements.

Bank of England stress test results for 2017

The BoE's Annual Cyclical Scenario ('ACS') stress test in 2017 specified a global downturn with severe effects in the UK, US, Hong Kong and mainland China, which accounted for approximately two-thirds of HSBC's RWAs at the end of 2016. We estimated that the economic shock to global GDP in this scenario was about as severe as in the global financial crisis of 2007 to 2009, but with a greater impact on emerging markets: for example, the scenario featured a contraction of 1.2% of the Chinese economy in the first year. Additionally, and in contrast to 2016, the ACS featured a 32% depreciation of sterling in the first year and a rise of UK base rates to 4%. The assumed GDP growth rates are detailed in the following table.  

Internal stress tests are an important element in our risk management and capital management frameworks. Our capital plan is assessed through a range of stress scenarios which explore risks identified by management. They include potential adverse macroeconomic, geopolitical and operational risk events, and other potential events that are specific to HSBC. The selection of scenarios reflects our top and emerging risks identification process and our risk appetite. Stress testing analysis helps management understand the nature and extent of vulnerabilities to which the bank is exposed. Using this information, management decides whether risks can or should be mitigated through management actions or, if they were to crystallise, should be absorbed through capital. This in turn informs decisions about preferred capital levels.

We conduct reverse stress tests each year at Group and, where required, subsidiary entity level in order to understand which potential extreme conditions would make our business model non-viable. Reverse stress testing identifies potential stresses and vulnerabilities we might face, and helps inform early warning triggers, management actions and contingency plans designed to mitigate risks.

In addition to the Group-wide stress testing scenarios, each major HSBC subsidiary conducts regular macroeconomic and event-driven scenario analyses specific to its region. They also participate as required in the regulatory stress testing programmes of the jurisdictions in which they operate, such as the Comprehensive Capital Analysis and Review and Dodd-Frank Act Stress Test programmes in the US, and the stress tests of the HKMA. Global functions and businesses also perform bespoke stress testing to inform their assessment of risks in potential scenarios.

The Group stress testing programme is overseen by the GRC and results are reported, where appropriate, to the RMM and GRC.

Report of the Directors | Risk

Our insurance manufacturing subsidiaries are regulated separately from our banking operations. Risks in our insurance entities are managed using methodologies and processes that are subject to

Group oversight. Our insurance operations are also subject to some of the same risks as our banking operations, which are covered by the Group's risk management processes.

Report of the Directors | Risk

Credit risk management

Details of changes in our credit risk profile in 2017 can be found on page 81, in 'Key developments and risk profile in 2017'.

There were no material changes to the policies and practices for the management of credit risk in 2017.

Credit risk sub-function

Credit approval authorities are delegated by the Board to the Group Chief Executive together with the authority to sub-delegate them. The Credit Risk sub-function in Global Risk is responsible for the key policies and processes for managing credit risk, which include formulating Group credit policies and risk rating frameworks, guiding the Group's appetite for credit risk exposures, undertaking independent reviews and objective assessment of credit risk, and monitoring performance and management of portfolios.

The principal objectives of our credit risk management are:

•	to both partner and challenge our businesses in defining, implementing and continually re-evaluating our risk appetite under actual and scenario conditions; and

•	to ensure there is independent, expert scrutiny of credit risks, their costs and their mitigation.

Concentration of exposure

Concentrations of credit risk arise when a number of counterparties or exposures have comparable economic characteristics, or such counterparties are engaged in similar activities or operate in the same geographical areas or industry sectors so that their collective ability to meet contractual obligations is uniformly affected by changes in economic, political

or other conditions. We use a number of controls and measures to minimise undue concentration of exposure in our portfolios across industries, countries and global businesses. These include portfolio and counterparty limits, approval and review controls, and stress testing.

Credit quality of financial instruments

Our risk rating system facilitates the internal ratings-based approach under the Basel framework adopted by the Group to support calculation of our minimum credit regulatory capital requirement.

The customer risk rating ('CRR') 10-grade scale summarises a more granular underlying 23-grade scale of obligor probability of default ('PD'). All corporate customers are rated using the 10- or 23-grade scale, depending on the degree of sophistication of the Basel II approach adopted for the exposure.

Each CRR band is associated with an external rating grade by reference to long-run default rates for that grade, represented by the average of issuer-weighted historical default rates. This mapping between internal and external ratings is indicative and may vary over time.

The expected loss ('EL') 10-grade scale for retail business summarises a more granular underlying EL scale for this customer segment. This combines obligor and facility/product risk factors in a composite measure.

For the five credit quality classifications defined, each encompasses a range of granular internal credit rating grades assigned to wholesale and retail lending businesses, and the external ratings attributed by external agencies to debt securities.

For debt securities and certain other financial instruments, external ratings have been aligned to the five quality classifications based upon the mapping of related CRR to external credit rating.

Renegotiated loans and forbearance

'Forbearance' describes concessions made on the contractual terms of a loan in response to an obligor's financial difficulties.

A loan is classed as 'renegotiated' when we modify the contractual payment terms, on concessionary terms, because we have significant concerns about the borrowers' ability to meet contractual payments when due.

Non-payment related concessions (e.g. covenant waivers), while potential indicators of impairment, do not trigger identification as renegotiated loans.

Loans that have been identified as renegotiated retain this designation until maturity or derecognition. A loan that is renegotiated is derecognised if the existing agreement is cancelled and a new agreement is made on substantially different terms, or if the terms of an existing agreement are modified such that the renegotiated loan is substantially a different financial instrument. Loans arising as a result of derecognition events will continue to be disclosed as renegotiated loans.

Credit quality of renegotiated loans

On execution of a renegotiation, the loan will also be classified as impaired if it is not already so classified. In wholesale lending, all facilities with a customer, including loans which have not been modified, are considered impaired following the provision of a renegotiated loan.

Those loans that are considered impaired retain the impaired classification for a minimum of one year. Renegotiated loans will continue to be disclosed as impaired until there is sufficient evidence to demonstrate a significant reduction in the risk of non-payment of future cash flows (the evidence typically comprises a history of payment performance against the original or revised terms), and there are no other indicators of impairment.

Renegotiated loans and recognition of impairment allowances

For retail lending, renegotiated loans are segregated from other parts of the loan portfolio for collective impairment assessment to reflect the higher rates of losses typically encountered with renegotiated loans.

For wholesale lending, renegotiated loans are typically assessed individually. Credit risk ratings are intrinsic to the impairment assessments. The individual impairment assessment takes into account the higher risk of the non-payment of future cash flows inherent in renegotiated loans.

Impairment assessment

For details of our impairment policies on loans and advances and financial investments, see Note 1.2(d) on the Financial Statements.

Write-off of loans and advances

For details of our policy on the write-off of loans and advances, see Note 1.2(d) on the Financial Statements.

Unsecured personal facilities, including credit cards, are generally written off at between 150 and 210 days past due. The standard period runs until the end of the month in which the account becomes 180 days contractually delinquent. Write-off periods may be extended, generally to no more than 360 days past due. However, in exceptional circumstances, they may be extended further. For example, in a few countries where local regulation or legislation constrain earlier write-off, or where the realisation of collateral for secured real estate lending takes more time.

For secured personal facilities, final write-off should generally occur within 60 months of the default.

In the event of bankruptcy or analogous proceedings, write-off may occur earlier than the maximum periods stated above. Collection procedures may continue after write-off.

Impairment methodologies for available-for-sale asset-backed securities ('ABSs')

To identify objective evidence of impairment for available-for-sale ABSs, an industry standard valuation model is normally applied which uses data with reference to the underlying asset pools and models their projected future cash flows. The estimated future cash flows of the securities are assessed at the specific financial asset level to determine whether any of them are unlikely to be recovered as a result of loss events occurring on or before the reporting date.

The principal assumptions and inputs to the models are typically the delinquency status of the underlying loans, the probability of delinquent loans progressing to default, the prepayment profiles of the underlying assets and the loss severity in the event of default. However, the models utilise other variables relevant to specific classes of collateral to forecast future defaults and recovery rates. Management uses externally available data and applies judgement when determining the appropriate assumptions in respect of these factors. We use a modelling approach which incorporates historically observed progression rates to default to determine if the decline in aggregate projected cash flows from the underlying collateral will lead to a shortfall in contractual cash flows. In such cases, the security is considered to be impaired.

In respect of collateralised debt obligations ('CDOs'), expected future cash flows for the underlying collateral are assessed to determine whether there is likely to be a shortfall in the contractual cash flows of the CDO.

When a security benefits from a contract provided by a monoline insurer that insures payments of principal and interest, the expected recovery on the contract is assessed in determining the total expected credit support available to the ABS.

Liquidity and funding risk management

Liquidity and funding risk management framework

•	operating entity classification by inherent liquidity risk ('ILR') categorisation;

•	minimum LCR requirement depending on ILR categorisation;

•	minimum NSFR requirement depending on ILR categorisation;

•	legal entity depositor concentration limit;

•	three-month and 12-month cumulative rolling term contractual maturity limits covering deposits from banks, deposits from non-bank financial institutions and securities issued;

•	annual individual liquidity adequacy assessment by principal operating entity;

•	minimum LCR requirement by currency;

•	management and monitoring of intra-day liquidity;

•	liquidity funds transfer pricing; and

•	forward-looking funding assessments.

Report of the Directors | Risk

Risk governance and oversight

•	Annual internal liquidity adequacy assessment process ('ILAAP') for principal operating entities used to validate risk tolerance and set risk appetite.

HSBC Holdings

HSBC Holdings' primary sources of liquidity are dividends received from subsidiaries, interest on and repayment of intra-group loans and securities, and interest earned on its own liquid funds. HSBC Holdings also raises ancillary funds in the debt capital markets through subordinated and senior debt issuances. Cash is primarily used for the provision of capital and subordinated funding to subsidiaries, payment of operating expenses, interest payments to debt holders and dividend payments to shareholders.

HSBC Holdings is also subject to contingent liquidity risk by virtue of credit-related commitments and guarantees and similar contracts issued relating to its subsidiaries. Such commitments and guarantees are only issued after due consideration of HSBC Holdings' ability to finance the commitments and guarantees and the likelihood of the need arising.

HSBC Holdings actively manages the cash flows from its subsidiaries to optimise the amount of cash held at the holding company level. During 2017, consistent with the Group's capital plan, the Group's subsidiaries did not experience any significant restrictions on paying dividends or repaying loans and advances. Also, there are no foreseen restrictions envisaged with regard to planned dividends or payments. However, the ability of subsidiaries to pay dividends or advance monies to HSBC Holdings depends on, among other things, their respective local regulatory capital and banking requirements, exchange controls, statutory reserves, and financial and operating performance.

Market risk management

Details of changes in our market risk profile in 2017 can be found on page 81, in ' Key developments and risk profile in 2017'.

Market risk in global businesses

The diagram below summarises the main business areas where trading and non-trading market risks reside, and the market risk measures used to monitor and limit exposures.

Where appropriate, we apply similar risk management policies and measurement techniques to both trading and non-trading portfolios. Our objective is to manage and control market risk exposures to optimise return on risk while maintaining a market profile consistent with our established risk appetite.

The nature of the hedging and risk mitigation strategies performed across the Group corresponds to the market risk management instruments available within each operating jurisdiction. These strategies range from the use of traditional market instruments, such as interest rate swaps, to more sophisticated hedging strategies to address a combination of risk factors arising at the portfolio level.

Market risk governance

Market risk is managed and controlled through limits approved by the RMM for HSBC Holdings. These limits are allocated across business lines and to the Group's legal entities.

Market risk measures

Monitoring and limiting market risk exposures

Our objective is to manage and control market risk exposures while maintaining a market profile consistent with our risk appetite.

We use a range of tools to monitor and limit market risk exposures including sensitivity analysis, value at risk and stress testing.

Sensitivity analysis

Sensitivity analysis measures the impact of individual market factor movements on specific instruments or portfolios, including interest rates, foreign exchange rates and equity prices, such as the effect of a one basis point change in yield. We use sensitivity measures to monitor the market risk positions within each risk type. Sensitivity limits are set for portfolios, products and risk types, with the depth of the market being a principal factor in determining the level.

Value at risk

Value at risk ('VaR') is a technique for estimating potential losses on risk positions as a result of movements in market rates and prices over a specified time horizon and to a given level of confidence. The use of VaR is integrated into market risk management and calculated for all trading positions regardless of how we capitalise them. Where there is not an approved internal model, we use the appropriate local rules to capitalise exposures. In addition, we calculate VaR for non-trading portfolios to have a complete picture of risk. Where we do not calculate VaR explicitly, we use alternative tools as summarised in the 'Stress testing' section below.

Our models are predominantly based on historical simulation that incorporates the following features:

The models also incorporate the effect of option features on the underlying exposures. The nature of the VaR models means that an increase in observed market volatility will lead to an increase in VaR without any changes in the underlying positions.

VaR model limitations

Although a valuable guide to risk, VaR should always be viewed in the context of its limitations. For example:

Risk not in VaR framework

The risks not in VaR ('RNIV') framework aims to capture and capitalise material market risks that are not adequately covered in the VaR model, such as the LIBOR tenor basis.

Risk factors are reviewed on a regular basis and either incorporated directly in the VaR models, where possible, or quantified through the VaR-based RNIV approach or a stress test

approach within the RNIV framework. The outcome of the VaR-based RNIV is included in the VaR calculation and back-testing; a stressed VaR RNIV is also computed for the risk factors considered in the VaR-based RNIV approach.

Stress-type RNIVs include a gap risk exposure measure to capture risk on non-recourse margin loans and a de-peg risk measure to capture risk to pegged and heavily-managed currencies.

Stress testing

Stress testing is an important procedure that is integrated into our market risk management framework to evaluate the potential impact on portfolio values of more extreme, although plausible, events or movements in a set of financial variables. In such scenarios, losses can be much greater than those predicted by VaR modelling.

Stress testing is implemented at legal entity, regional and overall Group levels. A set of scenarios is used consistently across all regions within the Group. Scenarios are tailored to capture the relevant potential events or market movements at each level. The risk appetite around potential stress losses for the Group is set and monitored against referral limits.

Market risk reverse stress tests are undertaken on the premise that there is a fixed loss. The stress testing process identifies which scenarios lead to this loss. The rationale behind the reverse stress test is to understand scenarios that are beyond normal business settings and could have contagion and systemic implications.

Stressed VaR and stress testing, together with reverse stress testing and the management of gap risk, provide management with insights regarding the 'tail risk' beyond VaR, for which HSBC's appetite is limited.

Trading portfolios

Back-testing

We routinely validate the accuracy of our VaR models by back-testing them against both actual and hypothetical profit and loss against the corresponding VaR numbers. Hypothetical profit and loss excludes non-modelled items such as fees, commissions and revenues of intra-day transactions.

We would expect, on average, to see two or three profits and two or three losses in excess of VaR at the 99% confidence level over a one-year period. The actual number of profits or losses in excess of VaR over this period can therefore be used to gauge how well the models are performing.

We back-test our Group VaR at various levels that reflect a full legal entity scope of HSBC, including entities that do not have local permission to use VaR for regulatory purposes.

Structural foreign exchange exposures

Structural foreign exchange exposures represent net investments in subsidiaries, branches and associates, the functional currencies of which are currencies other than the US dollar. An entity's functional currency is normally that of the primary economic environment in which the entity operates.

Exchange differences on structural exposures are recognised in 'Other comprehensive income'. We use the US dollar as our presentation currency in our consolidated financial statements because the US dollar and currencies linked to it form the major currency bloc in which we transact and fund our business. Our consolidated balance sheet is, therefore, affected by exchange differences between the US dollar and all the non-US dollar functional currencies of underlying subsidiaries.

Our structural foreign exchange exposures are managed with the primary objective of ensuring, where practical, that our consolidated capital ratios and the capital ratios of individual banking subsidiaries are largely protected from the effect of changes in exchange rates. We hedge structural foreign exchange exposures only in limited circumstances.

For further details of our structural foreign exchange exposures, please see page 108.

Report of the Directors | Risk

Interest rate risk in the banking book

Overview

Key risk drivers

Governance and structure

Measurement of interest rate risk in the banking book

Non-traded VaR

NII sensitivity

Economic value of equity

HSBC Holdings

HSBC Holdings is a financial services holding company. Its activities predominantly involve maintaining sufficient capital resources to support the Group's diverse activities; allocating these capital resources across our businesses; earning dividend and interest income on its investments in our businesses; payment of operating expenses; providing dividend payments to its equity shareholders and interest payments to providers of debt capital; and maintaining a supply of short-term liquid assets for deployment under extraordinary circumstances.

The main market risks to which HSBC Holdings is exposed are banking book interest rate risk and foreign currency risk. Exposure to these risks arises from short-term cash balances, funding positions held, loans to subsidiaries, investments in long-term financial assets and financial liabilities including debt capital issued. The objective of HSBC Holdings' market risk management strategy is to reduce exposure to these risks and minimise volatility in capital resources, cash flows and distributable reserves. Market risk for HSBC Holdings is monitored by Holdings ALCO in accordance with its risk appetite statement.

HSBC Holdings uses interest rate swaps and cross-currency interest rate swaps to manage the interest rate risk and foreign currency risk arising from its long-term debt issues.

Operational risk management

Details of our operational risk profile in 2017 can be found on page 111, in 'Operational risk exposures in 2017'.

Overview

The objective of our operational risk management is to manage and control operational risk in a cost-effective manner within targeted levels of operational risk consistent with our risk appetite, as defined by the GMB.

Key developments in 2017

Further information on the three lines of defence model can be found in the 'Our risk management framework' section on page 66.

Governance and structure

The ORMF defines minimum standards and processes, and the governance structure for the management of operational risk and internal control in our geographical regions, global businesses and global functions. The ORMF has been codified in a high-level standards manual, supplemented with detailed policies, which describes our approach to identifying, assessing, monitoring and controlling operational risk and gives guidance on mitigating action to be taken when weaknesses are identified.

We have a dedicated Global Operational Risk sub-function within our Global Risk function. It is responsible for leading the embedding of the ORMF, and assuring adherence to associated policies and processes across the first and second lines of defence. It supports the Group Chief Risk Officer and the Global Operational Risk Committee, which meets at least quarterly to discuss key risk issues and review implementation of the ORMF. The sub-function is also responsible for preparation of operational risk reporting at Group level, including reports for consideration by the RMM and Group Risk Committee. A formal governance structure provides oversight of the sub-function's management.

Key risk management processes

Business managers throughout the Group are responsible for maintaining an acceptable level of internal control commensurate with the scale and nature of operations, and for identifying and assessing risks, designing controls and monitoring the effectiveness of these controls. The ORMF helps managers to fulfil these responsibilities by defining a standard risk assessment methodology and providing a tool for the systematic reporting of operational loss data.

A group-wide risk management system is used to record the results of the operational risk management process. Operational risk and control self-assessments, along with issue and action plans, are entered and maintained by business units. Business and functional management monitor the progress of documented action plans to address shortcomings. To help ensure that operational risk losses are consistently reported and monitored at Group level, all Group companies are required to report individual losses when the net loss is expected to exceed $10,000, and to aggregate all other operational risk losses under $10,000. Losses are entered into the group-wide risk management system and reported to governance on a monthly basis.

Regulatory compliance risk management

Overview

The Regulatory Compliance sub-function ('RC') provides independent, objective oversight and challenge, and promotes a compliance-orientated culture that supports the business in delivering fair outcomes for customers, maintaining the integrity of financial markets and achieving HSBC's strategic objectives.

Key developments in 2017

Governance and structure

The Global Head of RC reports to the Group Chief Risk Officer. To align with our global business structure and help ensure coverage of local regulatory requirements, RC is structured as a global function with regional and country RC teams, which support and advise each global business and global function.

Key risk management processes

We regularly review our policies and procedures. Global policies and procedures require the prompt identification and escalation of any actual or potential regulatory breach to RC. Reportable events are escalated to the RMM and the Group Risk Committee, as appropriate. Matters relating to the Group's regulatory conduct of business are reported to the Conduct & Values Committee.

Report of the Directors | Risk

Conduct of business

The Board maintained oversight of conduct matters through the Conduct & Values Committee.

Further detail can be found under the Our conduct section of www.hsbc.com. For conduct-related costs relating to significant items, see page 61.

Financial crime risk management

Overview

Key developments in 2017

Key risk management processes

The Monitor

Under the agreements entered into with the US Department of Justice ('DoJ') and the UK Financial Conduct Authority ('FCA') in 2012, including the five-year deferred prosecution agreement ('AML DPA') and a Direction issued by the FCA, the Monitor (who is, for FCA purposes, a 'skilled person' under section 166 of the Financial Services and Markets Act) was appointed in July 2013 for an expected five-year period to produce annual assessments of the effectiveness of the Group's AML and sanctions compliance programme. Additionally, under the Cease and Desist Order issued by the US Federal Reserve Board ('FRB') in 2012, the Monitor also serves as an independent consultant to conduct annual assessments.

In December 2017, the AML DPA expired and the charges deferred by the AML DPA were dismissed. The Monitor will continue working in his capacity as a skilled person and independent consultant for a period of time at the FCA's and FRB's discretion.

In February 2018, the Monitor delivered his fourth annual follow-up review report based on various thematic and country reviews he had conducted during 2017. In his report, the Monitor concluded that, in 2017, HSBC made significant progress in developing a reasonably effective and sustainable AML and sanctions compliance programme and expressed confidence that HSBC can achieve its target end state within the next 18 months if it is able to maintain the concerted effort and focus it has demonstrated in remediating and enhancing its programme over the last five years. Nonetheless, the Monitor identified various challenges that HSBC faces in achieving this objective, noted deficiencies in HSBC's financial crime compliance controls and areas of HSBC's programme that require further work, and highlighted potential instances of financial crime and certain areas in which he believes that HSBC is not yet adequately managing financial crime risk.  As described on page 246 of note 34, the Monitor identified potential anti-money laundering and sanctions compliance issues that HSBC is reviewing further with the DoJ, FRB and/or FCA.

Throughout 2017, the FSVC received regular reports on HSBC's relationship with the Monitor and its compliance with the AML DPA. The FSVC received regular updates on the Monitor's review activity as part of the fourth annual review, and has received the Monitor's fourth annual review report.

Insurance manufacturing operations risk management

Details of changes in our insurance manufacturing operations risk profile in 2017 can be found on page 111, under 'Insurance manufacturing operations risk profile'.

There were no material changes to our policies and practices for the management of risks arising in our insurance manufacturing operations in 2017.

Governance

Insurance risks are managed to a defined risk appetite, which is aligned to the Group's risk appetite and risk management framework, including its three lines of defence model. For details of the Group's governance framework, see page 66. The Global Insurance Risk Management Meeting oversees the control framework globally and is accountable to the RBWM Risk Management Meeting on risk matters relating to the insurance business.

The monitoring of the risks within our insurance operations is carried out by insurance risk teams. Specific risk functions, including Wholesale Credit & Market Risk, Operational Risk, Information Security Risk and Financial Crime Risk and Regulatory Compliance support Insurance Risk teams in their respective areas of expertise.

Stress and scenario testing

Stress testing forms a key part of the risk management framework for the insurance business. We participate in local and Group-wide regulatory stress tests, including the Bank of England stress test of the banking system, the Hong Kong Monetary Authority stress test, the European Insurance and Occupational Pensions Authority stress test, and individual country insurance regulatory stress tests.

These have highlighted that a key risk scenario for the insurance business is a prolonged low interest rate environment. In order to mitigate the impact of this scenario, the insurance operations have taken a number of actions including repricing some products to reflect lower interest rates, launching less capital intensive products, investing in more capital efficient assets and developing investment strategies to optimise the expected returns against the cost of economic capital.

Management and mitigation of key risk types

Market risk

All our insurance manufacturing subsidiaries have market risk mandates which specify the investment instruments in which they are permitted to invest and the maximum quantum of market risk which they may retain. They manage market risk by using, among others, some or all of the techniques listed below, depending on the nature of the contracts written:

Credit risk

Our insurance manufacturing subsidiaries are responsible for the credit risk, quality and performance of their investment portfolios. Our assessment of the creditworthiness of issuers and counterparties is based primarily upon internationally recognised credit ratings and other publicly available information.

Investment credit exposures are monitored against limits by our insurance manufacturing subsidiaries, and are aggregated and reported to the Group Insurance Credit Risk and Group Credit Risk functions. Stress testing is performed on investment credit exposures using credit spread sensitivities and default probabilities.

We use tools to manage and monitor credit risk. These include a credit report containing a watch-list of investments with current credit concerns, primarily investments that may be at risk of future impairment or where high concentrations to counterparties are present in the investment portfolio. The report is circulated monthly to senior management in Group Insurance and individual country chief risk officers to identify investments that may be at risk of future impairment.

Liquidity risk

Risk is managed by cash flow matching and maintaining sufficient cash resources, investing in high credit-quality investments with deep and liquid markets, monitoring investment concentrations and restricting them where appropriate, and establishing committed contingency borrowing facilities.

Insurance manufacturing subsidiaries are required to complete quarterly liquidity risk reports for the Group Insurance Risk function and an annual review of the liquidity risks to which they are exposed.

Insurance risk

HSBC Insurance primarily uses the following techniques to manage and mitigate insurance risk:

Reputational risk management

Overview

Report of the Directors | Risk

Key developments in 2017

Governance and structure

Key risk management processes

The Global Communications function maintains policies and gives policy advice for the issues that might affect HSBC's reputation and standing with customers, employees, opinion formers and the public. It oversees the identification, management and control of reputational risk for all HSBC entities in the areas of media relations and engagement with non-governmental organisations and other external stakeholders.

Our Reputational Risk and Client Selection ('RRCS') team, which reports to both the Global Head of Financial Crime Compliance and the Global Head of Regulatory Compliance, oversees the identification, management and control of all other significant reputational risks across the Group. It is responsible for setting policies to guide the Group's reputational risk management, devising strategies to protect against reputational risk, and advising the global businesses and global functions to help them identify, assess and mitigate such risks, where possible. It is led by a headquarters-based team. This is supported by teams in each business line and region, which help ensure that issues are directed to the appropriate forums, that decisions are made and implemented effectively, and that management information is generated to aid senior management in the businesses and regions in understanding where reputational risk exists. Each global business has established a governance process that empowers the RRCS's committees to address reputational risk issues at the right level, escalating decisions where appropriate. The global functions manage and escalate reputational risks within established operational risk frameworks.

Our policies set out our risk appetite and operational procedures for all areas of reputational risk, including financial crime prevention, regulatory compliance, conduct-related concerns, environmental impacts, human rights matters and employee relations.

For further details of our financial crime risk management and regulatory compliance risk management, see 'Financial crime risk management' on page 78 and 'Regulatory compliance risk management' on page 77 respectively.

Further details can be found at www.hsbc.com.

Sustainability risk management

Overview

Assessing the environmental and social impacts of providing finance to our customers is integral to our overall risk management processes.

Key developments in 2017

Governance and structure

Key risk management processes

The Global Risk function's responsibilities in relation to sustainability risk include:

Pension risk management

There were no material changes to our policies and practices for the management of pension risk in 2017.

Governance and structure

A global pension risk framework and accompanying global policies on the management of risks related to defined benefit and defined contribution plans are in place. Pension risk is managed by a network of local and regional pension risk forums. The Global Pensions Oversight Forum is responsible for the governance and oversight of all pension plans sponsored by HSBC around the world.

Key risk management processes

Our global pensions strategy is to move from defined benefit to defined contribution plans, where local law allows and it is considered competitive to do so.

In defined contribution pension plans, the contributions that HSBC is required to make are known, while the ultimate pension benefit will vary, typically with investment returns achieved by investment choices made by the employee. While the market risk to HSBC of defined contribution plans is low, the Group is still exposed to operational and reputational risk.

In defined benefit pension plans, the level of pension benefit is known. Therefore, the level of contributions required by HSBC will vary due to a number of risks, including:

In 2017, HSBC undertook a number of initiatives to enhance its approach to the management of risk. These included:

For details on the adoption of IFRS 9, see Note 1.1(c) on the Financial Statements.

A summary of our current policies and practices regarding the management of credit risk is provided from page 72.

Gross loans and advances increased by $103bn to $1,060bn. This included foreign exchange movements increasing balances by $48bn.

Loan impairment charges and other credit provisions ('LICs') for the year were $1.8bn, which was $1.6bn lower than the prior year.

In wholesale lending, balances increased by $67bn to $684bn. This increase included foreign exchange movements of $30bn. Excluding foreign exchange movements, Asia grew strongly with loans and advances increasing by $34bn. In North America and Latin America, loans and advances increased by $2.3bn in each region, while Europe increased by $1.8bn. These increases were offset by a decrease in loans and advances in MENA of $3.2bn.

Report of the Directors | Risk