Freddie Mac 2014 Annual Report Download - page 50

45 Freddie Mac
and guarantee fee pricing, interest-rate risk management, market risk management, credit risk management, quality-control
sampling strategies for loans in our single-family credit guarantee portfolio, and representation and warranty and other
settlements with our counterparties. Furthermore, any strategies we employ to attempt to manage the risks associated with our
use of models may not be effective. See “MD&A — CRITICAL ACCOUNTING POLICIES AND ESTIMATES” and
“QUANTITATIVE AND QUALITATIVE DISCLOSURES ABOUT MARKET RISK — Interest-Rate Risk and Other Market
Risks” for more information on our use of models.
A failure in our operational systems or infrastructure, or those of third parties, could impair our liquidity, disrupt our
business, damage our reputation, and cause losses.
We face significant levels of operational risk due to a variety of factors, including the complexity of our business
operations and the amount of change to our core systems required to keep pace with regulatory and other requirements.
Shortcomings or failures in our internal processes, people or systems could lead to impairment of our liquidity, financial
and economic loss, errors in our financial statements, disruption of our business, liability to customers, further legislative or
regulatory intervention, or reputational damage. We have certain legacy systems that require manual support and intervention,
which may lead to heightened risk of system failures.
Our business is highly dependent on our ability to process a large number of transactions on a daily basis and manage and
analyze significant amounts of information, much of which is provided by third parties. The transactions we process are
complex and are subject to various legal, accounting, and regulatory standards. The types of transactions we process and the
standards relating to those transactions can change rapidly in response to external events, such as the implementation of
government-mandated programs and changes in market conditions. Our financial, accounting, data processing, or other
operating systems and facilities may fail to operate properly or become disabled, adversely affecting our ability to process these
transactions. Our systems may contain design flaws. The information provided by third parties may be incorrect, or we may fail
to properly manage or analyze it. The inability of our systems to accommodate an increasing volume of transactions or new
types of transactions or products could constrain our ability to pursue new business initiatives or improve existing business
activities.
We also face increased operational risk due to the magnitude and complexity of the new initiatives we are undertaking,
including our efforts to help build a new housing finance system (such as the development of the common securitization
platform). Some of these initiatives require significant changes to our operational systems. In some cases, the changes must be
implemented within a short period of time. Our legacy systems may also create increased operational risk for these new
initiatives. Internal corporate reorganizations (e.g., relating to our implementation of an enhanced three-lines-of-defense risk
management framework) may also increase our operational risk, particularly during the period of implementation.
Our employees could act improperly for their own gain and cause unexpected losses or reputational damage. While we
have processes and systems in place designed to prevent and detect fraud, there can be no assurance that such processes and
systems will be successful.
Most of our key business activities are conducted in our offices in Virginia and represent a concentrated risk of people,
technology, and facilities. As a result, a power outage or other infrastructure disruption in the area near our offices could
significantly adversely affect our ability to conduct normal business operations. A terrorist event or natural disaster in the area
near our offices could have a similar impact. Any measures we take to mitigate this risk may not be sufficient to respond to the
full range of events that may occur.
The threat landscape in cyber security is changing rapidly and growing in sophistication. We may not be able to protect our
systems with complete assurance or fully protect the confidentiality of our information from cyber attack and other
unauthorized access, disclosure, and disruption.
Our operations rely on the secure receipt, processing, storage, and transmission of confidential and other information in
our computer systems and networks and with our business partners. Like many corporations and government entities, from time
to time we have been, and likely will continue to be, the target of attempted cyber attacks. Although we devote significant
resources to protecting our various systems and processes, there is no assurance that our security measures will provide fully
effective security. Our computer systems, software, and networks may be vulnerable to cyber attack, unauthorized access,
supply chain disruptions, computer viruses or other malicious code, or other attempts to harm them or misuse or steal
confidential information. If one or more of such events were to occur, this potentially could jeopardize or result in the
unauthorized disclosure, misuse or corruption of confidential and other information (including information of borrowers, our
customers or our counterparties), or otherwise cause interruptions or malfunctions in our operations or the operations of our
customers or counterparties. This could result in significant losses or reputational damage, adversely affect our relationships
with our customers and counterparties, negatively affect our competitive position, and otherwise harm our business. We could
also face regulatory action. We might be required to expend significant additional resources to modify our protective measures
or to investigate and remediate vulnerabilities or other exposures, and we might be subject to litigation and financial losses that
are not fully insured. In addition, there can be no assurance that business partners, counterparties and governmental
organizations are adequately protecting the confidential and other information that we share with them. As a result, a cyber
Table of Contents