Fannie Mae 2005 Annual Report Download - page 116

Committee, which focuses on market, liquidity and model risk; and (iii) the Operational Risk Committee,
which focuses on operational risk. Each committee is responsible for, among other things:
• monitoring aggregated risk exposure;
• discussing emerging risk issues;
• reviewing key corporate risk limits and exposures;
• reviewing the risk aspects of significant new business initiatives; and
• reviewing and recommending risk policies with corporate-wide or significant business unit implications.
We also established two additional management-level risk committees that focus on other significant business
risks: (i) the Capital Structure Committee, which focuses on capital management activities; and (ii) the
Compliance Coordination Committee, which focuses on compliance with legal and regulatory requirements.
Our Compliance Coordination Committee also is responsible for coordinating the legal and regulatory
compliance risk governance functions with other control functions, such as Legal, Internal Audit and the Chief
Risk Office.
The Management Executive Committee, which is chaired by the Chief Executive Officer and composed of
principal executive officers of the company, has responsibility for reviewing and approving our enterprise-wide
risk tolerance policy and our enterprise-wide risk framework, addressing issues referred to it by our risk
committees, addressing matters that involve multiple types of risks and addressing other significant business
and reputational risks. Where appropriate, the Management Executive Committee brings transactions of an
extraordinary nature and significant potential new business activities to the Risk Policy and Capital Committee
of the Board of Directors, as well as other relevant committees if necessary, for review and approval.
Business Units
Business unit managers execute company-wide risk policies set by the Chief Risk Officer, develop risk
management strategies for their specific businesses, and establish and implement risk management policies and
practices within their businesses. Each business unit is responsible for identifying, measuring and managing
key credit risks within its business. In addition, each business unit has business unit risk managers who are
responsible for ensuring that there are clear delineations of responsibility for managing credit risk, adequate
systems for measuring credit risk, appropriately structured limits on risk taking, effective internal controls and
a comprehensive risk reporting process. As part of our risk governance structure, we have established within
each business unit risk committees that are responsible for decisions relating to risk strategy, policies and
controls.
Internal Audit
Our Internal Audit group, under the direction of the Chief Audit Executive, provides an objective assessment
of the design and execution of our internal control system, including our management systems, risk
governance, and policies and procedures. The Chief Audit Executive reports directly and independently to the
Audit Committee of the Board of Directors, and audit personnel are compensated on objectives set for the
group by the Audit Committee rather than corporate financial results or goals. The Chief Audit Executive
operates independently of management and may be removed only upon Board approval. Internal Audit
activities are designed to provide reasonable assurance that resources are safeguarded; that significant financial,
managerial and operating information is complete, accurate and reliable; and that employee actions comply
with our policies and applicable laws and regulations.
Office of Compliance and Ethics
Our Office of Compliance and Ethics, under the direction of the Chief Compliance Officer, is responsible for
developing and carrying out corporate policies related to compliance, ethics and investigations. The Office of
Compliance and Ethics and the position of Chief Compliance Officer were established in 2005. The Chief
Compliance Officer reports directly to the Chief Executive Officer and independently to the Compliance
111