Freddie Mac 2015 Annual Report Download - page 139

Management's Discussion and Analysis Risk Management | Operational Risk
Freddie Mac 2015 Form 10-K 137
OPERATIONAL RISK
We define operational risk as the risk of loss resulting from inadequate or failed internal processes,
people, systems, or external events. Operational risk is inherent in all of our activities. Operational risk
events include accounting or operational errors, business interruptions, non-compliance with legal or
regulatory requirements, fraudulent acts, inappropriate acts by employees, information security incidents,
or vendors who do not perform in accordance with their contracts. These events could result in financial
loss, legal actions, regulatory fines, and reputational harm.
Operational Risk Management and Risk Profile
Our operational risk management framework includes risk identification, assessment, measurement,
mitigation and reporting. When operational risk events are identified, our policies require that the events
be documented and analyzed to determine whether changes are required in our systems and/or
processes to further mitigate the risk of future events.
During 2015 we continued to enhance and refine our three-lines-of-defense framework to both strengthen
risk ownership in our business units and add clarity to risk management roles and responsibilities. Our
framework focuses on balancing ownership of risk by our business units with corporate oversight and
independent assurance of the design and effectiveness of our risk management activities.
We moved several key functions within the organization to better align business decision-making with the
first-line-of-defense. We expanded our second-line-of-defense testing capabilities over our operational
controls. We continue a multi-year project focused on identifying and eliminating redundant control
activities. In addition, we conducted select organizational design reviews focused on reducing the number
of operating layers within the organization. We believe these enhancements will improve our risk
management effectiveness.
In order to evaluate and monitor operational risk, each business unit completes a quarterly assessment
using the Risk and Control Self-Assessment (RCSA) framework. The framework is designed to identify
and assess the business unit's exposure to operational risk and determine if additional action is required
to manage the risk to an acceptable level.
In addition to the RCSA process, we employ several tools to identify and measure operational risks,
including loss event data, key risk indicators, root cause analysis, and testing. While our operational risk
framework includes tools to support effective management of operational risk, the primary responsibility
for managing both the day-to-day risk and longer-term or emerging risks lies with the business units.
We continue to strengthen our operational controls. During 2015, we continued to improve our operational
control environment and reduced our outstanding control issues to low levels. We continued to improve
our out-of-region disaster recovery capabilities. Our out-of-region data center, which became operational
in 2014, improved our ability to recover our business systems in the event of a catastrophic regional
business event, such as a disaster that affects our Northern Virginia production data centers. However,
we continue to face significant levels of operational risks, including those discussed in “Risk Factors -
Operational Risks.”
We face increased operational risk due to the magnitude and complexity of FHFA initiatives and other
new initiatives we are undertaking, including initiatives we are pursuing under the Conservatorship