Fannie Mae 2004 Annual Report Download - page 206

• Human Resources
Our human resources function did not have clear enterprise-wide coordination, which resulted in
ineffective definition and communication of employee roles and responsibilities. In addition, training and
performance evaluations were not always effective. As a result, we did not have a sufficient number of
qualified staff, clear job descriptions, and appropriate policies and procedures relating to human resources.
Lines of delegated authority were not always clear.
•Fraud Risk Management Program
We did not maintain a comprehensive, centrally coordinated enterprise-wide fraud risk management
program. Furthermore, we did not have a specific, comprehensive fraud risk management program related
to internal control over financial reporting.
•Whistleblower Program
We lacked effective internal control over financial reporting relating to our whistleblower program that
would ensure the anonymity, confidentiality and physical security of the information provided, as well as
periodic reporting of that information. Although an enterprise-wide whistleblower program was in effect
during 2004, regular reporting to a committee of the Board of Directors did not occur, and we believe the
program was not trusted by company personnel.
•Accounting/Finance Staffing Levels
We did not maintain a sufficient complement of personnel with an appropriate level of accounting
knowledge, experience and training in the application of GAAP commensurate with our financial
reporting requirements. Further, the process we used to ensure that employees were assigned appropriate
responsibilities based upon their credentials and experience was inadequate.
•Information Technology Policy
We did not maintain and clearly communicate information technology policies and procedures. This
weakness contributed to our inadequate internal control over financial reporting systems.
•Policies and Procedures
We did not maintain adequate policies and procedures related to initiating, authorizing, recording,
processing and reporting transactions. This lack of documentation led to (a) inconsistent execution of
business practices, (b) inability to ensure practices were in accordance with management standards and
(c) ambiguity in delegation of authority.
Application of GAAP
We did not maintain effective internal control over financial reporting relating to our process and information
technology applications for determining, monitoring, disseminating, implementing and updating accounting
policies that complied with GAAP. We identified numerous material and immaterial misapplications of GAAP
that indicate that a material weakness in our application of GAAP existed as of December 31, 2004. As
described in “Item 7—MD&A—Restatement,” we have identified misapplications of GAAP in the following
primary categories:
• our accounting for debt and derivatives;
• our accounting for commitments;
• our accounting for investments in securities;
• our accounting for MBS trust consolidations and sale accounting;
• our accounting for financial guaranties and master servicing;
• our amortization of cost basis adjustments; and
• other adjustments, including accounting for income taxes.
201