Fannie Mae 2004 Annual Report Download - page 172

As discussed above, we structure our debt and derivatives to match and offset the interest rate risk of our
mortgage investments as much as possible. The interest rate sensitivities presented in Table 38 convey the
extent to which changes in the estimated fair value of our mortgage assets are offset by changes in the
estimated fair value of our debt and derivatives. Based on our sensitivity analyses, we estimate that a 50 basis
point instantaneous decrease in interest rates and a 100 basis point instantaneous increase in interest rates
would reduce the estimated fair value of our net assets as of December 31, 2004 by approximately 5.6% and
1.3%, respectively. We estimate that a 50 basis point instantaneous decrease in interest rates and a 100 basis
point instantaneous increase in interest rates would reduce the estimated fair value of our net assets as of
December 31, 2003 by approximately 5.1% and 0.2%, respectively. These sensitivities, which are relatively
stable from the end of 2003 to the end of 2004, indicate a relatively low level of interest rate risk.
We also show in footnote 6 of Table 38 the sensitivity of the estimated fair value of our net assets, excluding
the sensitivity of our guaranty assets and guaranty obligations, net (net of tax). We evaluate the sensitivity of
the fair value of our net assets, excluding the sensitivity of our guaranty assets and guaranty obligations,
because, as previously discussed, we do not actively manage the interest rate risk of our guaranty business.
These sensitivity analyses are limited in that they contemplate only certain movements in interest rates and are
performed at a particular point in time based on the estimated fair values of our existing assets and liabilities.
The sensitivity analyses do not incorporate other factors that may have a significant impact, most notably the
value from expected future business activities and strategic actions that management may take to manage
interest rate risk. Moreover, our sensitivity analyses require numerous assumptions, including prepayment
factors and discount rates, which require management judgment. While we believe the assumptions and
methodology used in our sensitivity analyses are reasonable, there is no standard methodology for estimating
the sensitivity of net asset fair value and different assumptions could produce materially different sensitivity
estimates.
In October 2000 we made a voluntary commitment to publicly disclose the results of interest rate risk
sensitivity analyses on a monthly basis and began a monthly disclosure of net interest income at risk. Because
our restatement affected net interest income at risk, we suspended this disclosure beginning in December
2004. Pursuant to our September 1, 2005 agreement with OFHEO, we will begin disclosing the estimated
impact on our financial condition of a 50-basis point shift in rates and a 25-basis point change in the slope of
the yield curve when we have current financial statements.
Operational Risk Management
Operational risk can manifest itself in many ways, including accounting or operational errors, business
disruptions, fraud, technological failures and other operational challenges resulting from failed or inadequate
internal controls. These events may potentially result in financial losses and other damage to our business,
including reputational harm.
We currently manage operational risk through an enterprise-wide framework. In 2006, we established an
independent Operational Risk Oversight (“ORO”) function within the Chief Risk Office with responsibility for
oversight of the business units’ operational risk management activities. In accordance with our Policy on
Operational Risk Management established in October 2006, ORO regularly reports to senior management and
the Board of Directors on the quality of our operational risk management and on identified operational risk
exposures. ORO is also responsible for the design and implementation of operational risk management
processes pertaining to capturing loss and “near miss” event data, risk and control assessments by the business
units, key risk indicators, and analysis of scenarios representing significant potential losses to our business. To
further strengthen our existing operational risk programs, in 2006, we centralized oversight of our business
continuity efforts, information security programs, fraud management and our corporate insurance program
under this new operational risk oversight function. We continue to work on improving our internal controls
and procedures relating to the management of operational risk.
Our individual business units have direct responsibility for the identification, assessment, control and
mitigation of the operational risks associated with their business activities. Senior officers within the business
units have been designated as division operational risk officers, with dedicated staff responsible for the
167