Sallie Mae 2008 Annual Report Download - page 122

MANAGEMENT’S ANNUAL REPORT ON INTERNAL CONTROL OVER FINANCIAL REPORTING
Our management is responsible for establishing and maintaining adequate internal control over financial
reporting (as defined in Rule 13a-15(f) under the Securities Exchange Act of 1934, as amended). Under the
supervision and with the participation of our management, including our Chief Executive Officer and Chief
Financial Officer, we assessed the effectiveness of our internal control over financial reporting as of
December 31, 2008. In making this assessment, our management used the criteria established in Internal
Control — Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway
Commission (“COSO”). Management also used an IT governance framework that is based on the COSO
framework, Control Objectives for Information and related Technology, which was issued by the Information
Systems Audit and Control Association and the IT Governance Institute. Based on our assessment and those
criteria, management concluded that, as of December 31, 2008, our internal control over financial reporting is
effective.
PricewaterhouseCoopers LLP, an independent registered public accounting firm, audited the effectiveness
of the Company’s internal control over financial reporting as of December 31, 2008, as stated in their report
which appears below.
Because of its inherent limitations, internal control over financial reporting may not prevent or detect
misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that
controls may become inadequate because of changes in conditions, or that the degree of compliance with the
policies or procedures may deteriorate.
F-2