Fannie Mae 2004 Annual Report Download - page 212

• Internal Audit
In June 2005, management and the Audit Committee of the Board appointed a new Chief Audit Executive
from outside the company. The Chief Audit Executive reports directly to the Audit Committee with
indirect reporting to the CEO. The Chief Audit Executive has enhanced the level of communication with
the Audit Committee, which includes increased communication with the Chairman of the Audit
Committee and enhanced detail within the formal reports to the Audit Committee. Additionally, the
Internal Audit function has completed a comprehensive review and analysis of its organizational design
and audit processes, including organizational structure, staffing levels, skill assessments, audit planning,
audit execution and reporting. Internal Audit has filled its key management positions and continues to
reassess and enhance its staffing. The Internal Audit management team was expanded from one officer to
four, three of whom are external hires. All officers in the Internal Audit department hold one or more of
the following professional credentials: certified public accountant, certified internal auditor, certified fraud
examiner, certified information systems auditor or certified bank auditor. Internal Audit has developed
and communicated a risk-based audit plan, which it reports upon regularly to the Audit Committee.
•Human Resources
As part of our organizational redesign, we have repositioned and redefined the role of our human
resources function. This has included rollout of a new performance assessment process, enhancement of
job descriptions, and clearly communicated policies and procedures regarding human resources. Addition-
ally, we have hired additional personnel into HR functions to assist in strengthening the role of human
resources within the company. We have also completed a comprehensive corporate review of delegations
of authority.
•Fraud Risk Management Program
We have designed a comprehensive, centrally coordinated enterprise-wide fraud risk management
program. We adopted a fraud risk management policy and developed a formal fraud assessment process,
which was initially implemented for those business areas identified as having high potential for fraud risk.
A fraud risk management training program has been designed and rolled out to risk-prioritized business
units. The Audit Committee of the Board of Directors has also successfully completed fraud risk
management training.
We have also established the Operational Risk Oversight unit (ORO) reporting directly to the Chief Risk
Officer. Management and monitoring of the fraud risk management program is the responsibility of the
ORO.
•Whistleblower Program
We believe that we remediated this material weakness prior to the date of this filing. We have enhanced
our whistleblower program with a new corporate ethics line that offers full anonymity to callers, if
desired, regular reporting of cases to the Chief Compliance Officer, and regular formal reporting of cases
to the Compliance and Audit Committees of the Board of Directors.
•Accounting/Finance Staffing Levels
We believe that we remediated this material weakness prior to the date of this filing. As part of our
organizational redesign, we have performed a thorough staffing assessment of our accounting and finance
organizations. We have replaced substantially all senior finance and accounting employees, including
hiring a new Chief Financial Officer who joined the organization in January 2006. Additionally,
management has increased the number of full-time employees in our accounting function and supple-
mented the function with outside contractors having the appropriate level of accounting experience and
expertise to assist us in our restatement efforts. We have made progress in, and continue to execute upon,
a hiring plan to replace such contractors with full-time employees.
207