Fannie Mae 2005 Annual Report Download - page 115

Internal Audit. As we continue in our efforts to build out our risk oversight organization, we are establishing
clear lines of authority, clarifying roles and responsibilities, and enacting policies and procedures designed to
ensure that we have an independent risk oversight function with appropriate checks and balances throughout
our company.
Risk Policy and Capital Committee of the Board of Directors
The Board of Directors is responsible for approving our risk governance framework and providing capital and
risk management oversight. The Board exercises its oversight of credit risk, market risk, operational risk and
liquidity risk primarily through the Board’s Risk Policy and Capital Committee. The responsibilities of the
Risk Policy and Capital Committee include:
• recommending for Board approval enterprise risk governance policy and limits consistent with our
mission, safety and soundness;
• overseeing the development of policies and procedures designed to: (i) define, measure, identify and
report on credit, market, liquidity and operational risk; and (ii) establish and communicate risk manage-
ment controls throughout the company;
• overseeing compliance with all enterprise-wide risk management policies;
• overseeing the Chief Risk Office; and
• reviewing the sufficiency of personnel, systems and other risk management capabilities.
In 2006, the Board of Directors adopted corporate risk principles that are being implemented to govern our
risk activities. These principles include taking risks in an informed and disciplined manner and ensuring that
we are adequately compensated for the risks we take, consistent with our mission goals.
Chief Risk Office
The Chief Risk Office is an independent risk oversight organization with responsibility for oversight of credit
risk, market risk and operational risk. The Chief Risk Office is headed by a Chief Risk Officer who reports
directly to the Chief Executive Officer and independently to the Risk Policy and Capital Committee of the
Board of Directors. The Chief Risk Office and the position of Chief Risk Officer were established in 2005.
The Chief Risk Office is responsible for formulating corporate risk policies and monitoring the company’s
aggregate risk profile. The Chief Risk Office works closely with our business units to ensure they have in
place the structure and information systems necessary to adequately identify, measure, report, monitor and
control their key business risks, consistent with corporate standards. The Chief Risk Office also is responsible
for validation of risk models and for developing and implementing an economic risk capital framework.
The Chief Risk Officer is responsible for establishing our overall risk governance structure and providing
independent evaluation and oversight of our risk management activities. In addition to directing the Chief Risk
Office, the Chief Risk Officer oversees our management-level corporate risk committees. The Chief Risk
Officer reports on a regular basis to our Board of Directors regarding our corporate risk profile, including our
aggregate risk exposure, the level of risk by type of risk, performance relative to risk limits and any significant
risk management issues. The Chief Risk Officer also reports to the Board of Directors annually on
management’s adherence to our corporate risk principles.
Risk Management Committees
At the end of 2006, we restructured our risk management committees to enhance our risk governance
framework. We dissolved the Corporate Risk Management Committee, which had previously focused on both
credit and market risk oversight, and formed two separate committees, the Credit Risk Committee and the
Market Risk Committee. We now have three management-level risk committees that focus on our major
categories of risk: (i) the Credit Risk Committee, which focuses on credit risk; (ii) the Market Risk
110