Fannie Mae 2004 Annual Report Download - page 138

framework include establishing corporate-wide policies for risk management, delegating to business units
primary responsibility for the management of the day-to-day risks inherent in the activities of the business
unit, and monitoring aggregate risks and compliance with risk policies at a corporate level.
Our corporate risk framework is supported by a governance structure encompassing the Board of Directors, an
independent corporate risk oversight organization, business units, management-level risk committees and
Internal Audit. As we continue in our efforts to build out our risk oversight organization, our goal is to
establish clear lines of authority, clarify roles and responsibilities, and enact policies and procedures designed
to ensure that we have an independent risk oversight function and a well-disciplined risk management process
with appropriate checks and balances throughout our company.
Risk Policy and Capital Committee of the Board of Directors
The Board of Directors is responsible for approving our risk governance framework and providing capital and
risk management oversight. The Board exercises its oversight of credit risk, market risk, operational risk and
liquidity risk primarily through the Board’s Risk Policy and Capital Committee. The responsibilities of the
Risk Policy and Capital Committee include:
• evaluating and, where appropriate, recommending for Board approval enterprise-wide risk management
policies, metrics and limits consistent with our mission and our safety and soundness;
• reviewing policies and procedures designed to: (i) define, measure, identify and report on credit, market,
liquidity and operational risk; and (ii) establish and communicate risk management controls throughout
the company;
• overseeing compliance with all enterprise-wide risk management policies;
• overseeing the Chief Risk Office; and
• reviewing the sufficiency of personnel, systems and other risk management capabilities.
Chief Risk Office
The Chief Risk Office is an independent risk oversight organization with responsibility for oversight of credit
risk, market risk and operational risk. The Chief Risk Office is headed by a Chief Risk Officer who reports
directly to the Chief Executive Officer and independently to the Risk Policy and Capital Committee of the
Board of Directors. The Chief Risk Office and the position of Chief Risk Officer were established in 2005.
The Chief Risk Office is responsible for formulating corporate risk policies and monitoring the company’s
aggregate risk profile. The Chief Risk Office works closely with our business units to ensure they have in
place the structure and information systems necessary to adequately measure, report, monitor and control their
key business risks, consistent with corporate standards. The Chief Risk Office also is responsible for validation
of risk models and for developing and implementing an economic risk capital framework.
The Chief Risk Officer is responsible for establishing our overall risk governance structure and providing
independent evaluation and oversight of our risk management activities. In addition to directing the Chief Risk
Office, the Chief Risk Officer oversees our management-level corporate risk committees. The Chief Risk
Officer reports on a regular basis to our Board of Directors regarding our corporate risk profile, including our
aggregate risk exposure, the level of risk by type of risk, performance relative to risk tolerance limits and any
significant risk management issues.
Risk Management Committees
In 2006, we further enhanced our risk governance framework by creating two management-level committees:
(i) the Corporate Risk Management Committee, which focuses on credit and market risk and is a successor to
our Portfolio and Capital Committee; and (ii) the Operational Risk Committee, which focuses on operational
risk. Each committee is responsible for, among other things:
• monitoring aggregated risk exposure;
• discussing emerging risk issues;
• reviewing proposed risk limits;
• approving the risk aspects of significant new business initiatives; and
133