Fannie Mae 2004 Annual Report Download - page 207

Many of these misapplications of GAAP resulted in material modifications to our financial statements and
many of the other misapplications of GAAP that did not result in a material modification could have resulted
in a material misstatement in the financial statements.
Financial Reporting Process
We did not maintain an effective, timely and accurate financial reporting process. Specifically, we identified
the following material weaknesses in our financial reporting process as of December 31, 2004:
•Financial Statement Preparation and Reporting
We did not perform timely and complete reviews of the consolidated financial statements by personnel
with knowledge sufficient to reach appropriate accounting conclusions. Specifically, our systems and
processes were not designed and in operation to enable us to prepare accurate consolidated financial
statements in accordance with GAAP. These systems and processes, coupled with our human resources
and other material weaknesses, resulted in our inability to prepare and complete accurate financial
information.
•Disclosure Controls
We did not maintain effective disclosure controls and procedures, including an effective Disclosure
Committee, designed to ensure complete and accurate disclosure as required by GAAP. In addition, we
have not filed periodic reports on a timely basis as required by the rules of the SEC and the NYSE.
•General Ledger Controls
We did not maintain effective internal control over financial reporting relating to the general ledger and
the periodic closing of the general ledger. Specifically, the design and operation of this control was
inadequate for managing the addition or deletion of specific balance sheet or consolidated statements of
income accounts. In addition, personnel were not granted access to the general ledger that was appropriate
to their scope of responsibility and we lacked a formalized process with adequate controls designed to
ensure that the general ledger was closed properly at the end of each period.
•Journal Entry Controls
We did not maintain effective internal control over financial reporting relating to the recording of journal
entries, both recurring and non-recurring. Specifically, the design and operation of this control was
inadequate for ensuring that journal entries were prepared by personnel with adequate knowledge of the
activity being posted. The entries were not supported by appropriate documentation and were not
reviewed at the appropriate level to ensure the accuracy and completeness of the entries recorded.
•Reconciliation Controls
We did not maintain effective internal control over financial reporting relating to the reconciliation of
many of our financial statement accounts and other data records that served as inputs to those accounts.
Specifically, the design and operation of this control was inadequate for ensuring that our accounts were
complete, accurate and in agreement with detailed supporting documentation. In addition, this control did
not ensure proper review and approval of reconciliations by appropriate personnel.
Information Technology Applications and Infrastructure
We did not maintain effective internal control over financial reporting related to information technology
applications and infrastructure, and the references in this section to “controls” refer to our internal control over
financial reporting. Specifically, we identified the following material weaknesses relating to our information
technology applications and infrastructure as of December 31, 2004:
•Access Control
We did not maintain effective design of controls over access to financial reporting applications and data.
Specifically, ineffective controls included unrestricted access to programs and data, lack of periodic
review and monitoring of such access, and lack of clearly communicated policies and procedures
202