Freddie Mac 2004 Annual Report Download - page 108

A major corporate reorganization in early 2005 resulted in a functional organization structure with
responsibilities for operations and technology under a new executive vice president position. We also
completed a full integration of all Ñnancial accounting functions under the Chief Financial OÇcer to enable
greater accountability and role clarity.
Finally, we have undertaken a key initiative to improve our capabilities to better measure our operational
risks. We have deÑned an operational risks framework that we believe is consistent with the Basel II Advanced
Measurement Approach scheduled to be adopted by large U.S. banks. See ""BUSINESS Ì Regulatory and
Governmental Matters Ì Other Regulatory Matters.'' The framework includes common risk language, the
operational loss event, tracking key risk indicators and control self-assessments. We believe that the
implementation of this framework improves our operational risks management capabilities. We are in the early
stage of a multi-year eÅort to fully implement the components of this framework.
Sources of Operational Risks
Process Risk. Process risk includes transaction execution, modeling, and vendor management risk.
Transaction execution risk is mitigated through comprehensive product development processes, suitable
approval authorities, data quality standards and identiÑcation and execution of control procedures. While we
are exposed to the risk of loss from failure to develop or follow appropriate processes for our business
transactions, process risk management enables us to fulÑll our commitment to introduce new products and
programs to improve homeownership opportunities for low- and moderate-income borrowers and to meet our
customers' needs. We have strengthened our controls over the new product process with the creation of a New
Products Committee, designed to clearly identify the requirements for implementing all new product ideas.
We make signiÑcant use of business and Ñnancial models. In 2004, we strengthened our processes to
validate assumptions, model code and theory. We have enhanced our oversight processes, including
establishing a corporate function to focus on the key models used in management decisions and Ñnancial
reporting. While controls over model risk have been enhanced, signiÑcant eÅorts remain with respect to
controls over model applications. We plan to further remediate model oversight issues during 2005.
Vendor management is critical for us because we currently outsource to external parties certain key
functions. These functions include processing functions for trade capture, market risk management analytics,
asset valuation (Blackrock Financial Management, Inc.), and processing functions for mortgage loan
underwriting (Electronic Data Systems Corporation). We may enter into similar outsourcing relationships in
the same or other business areas in the future. If one or more of these key external parties were not able to
perform their functions for a period of time or at an acceptable service level, there is a risk that our Ñnancial
condition or results of operations would be adversely aÅected, perhaps materially. Our use of vendors also
exposes us to the risk of a loss of intellectual property or a breach of conÑdentiality or other harm. We
endeavor to mitigate these risks through detailed vendor requirements, active vendor management, legal
contracts, business continuity planning, and third party review of vendors. In addition, to ensure the integrity
of data used in Ñnancial reporting, we have implemented quality assurance processes valuations and processes
performed by Blackrock.
Technology Risk. Technology risk includes the risk of inadequate or failed systems, inappropriate
systems implementation and inadequate system security that allows unauthorized access to computer systems.
We monitor computer security measures and applications and we use corporate information access policies
and periodic access reviews to verify that only authorized personnel have access to our systems. We identiÑed
material weaknesses related to system security, change management and information technology application
and general controls during our control reviews in 2004. These weaknesses related not only to Ñnancial
reporting systems, but other business applications as well. Remediation eÅorts to correct these weaknesses
began in 2004 and will continue through 2005. See ""Internal Controls over Financial Reporting'' for more
information concerning internal control issues related to our systems.
We are making signiÑcant investments to build new Ñnancial reporting systems and to move to more
eÅective and eÇcient business processing systems. During the transition period, however, we are more reliant
on end-user computing systems than we prefer. End-user computing systems increase the risk of errors in
Freddie Mac
96