Fannie Mae 2005 Annual Report Download - page 193

implementation impacts researched in coordination with the Controller’s department, business unit
personnel and other divisions that would be impacted. Additionally, accounting policy is actively engaged
in new product and process approval designed to ensure that the correct accounting policy decisions are
reached and implemented.
In addition, in order to provide a segregation of duties between those who develop our accounting policies
and those who implement them, as part of our organizational redesign, reporting responsibility for the
accounting policy function was moved from the Controller to the CFO. In May 2005, we announced the
hiring of a new senior officer to oversee the accounting policy function.
•Enterprise-Wide Risk Oversight
We have established an enterprise-wide risk organization with oversight of credit risk, market risk and
operational risk, as well as model review. In May 2006, we announced the hiring of a Chief Risk Officer,
and new senior officers responsible for credit risk oversight and operational risk oversight reporting to the
new Chief Risk Officer. In 2006, we also hired a senior officer responsible for market risk oversight,
capital methodology and model review. We have developed and communicated corporate-wide risk
policies and enhanced our business unit risk management processes. We have implemented a new
organizational risk structure that includes risk management personnel within each business unit. Those
individuals report to business unit leadership and have responsibility for implementing the corporate-wide
risk policies in their respective business units. We have enhanced Board monitoring and communication
regarding credit risk and market risk by establishing the Risk Policy and Capital Committee of the Board
of Directors. The Chief Risk Officer reports independently to the Risk Policy and Capital Committee, and
also reports directly to the Chief Executive Officer.
•Internal Audit
In July 2005, management and the Audit Committee of the Board appointed a new Chief Audit Executive
from outside the company. The Chief Audit Executive reports directly to the Audit Committee with
indirect reporting to the Chief Executive Officer. The Chief Audit Executive has enhanced the level of
communication with the Audit Committee, which includes increased communication with the Chairman
of the Audit Committee and enhanced detail within the formal reports to the Audit Committee.
Additionally, the Internal Audit function has completed a comprehensive review and analysis of its
organizational design and audit processes, including organizational structure, staffing levels, skill assess-
ments, audit planning, audit execution and reporting. Internal Audit has filled its key management
positions and continues to reassess and enhance its staffing. The Internal Audit management team was
expanded from one officer to four, three of whom were external hires. All officers in the Internal Audit
department hold one or more of the following professional credentials: certified public accountant,
certified internal auditor, certified fraud examiner, certified information systems auditor or certified bank
auditor. Internal Audit has developed and communicated a risk-based audit plan, which it reports upon
regularly to the Audit Committee.
•Human Resources
As part of our organizational redesign, we have repositioned and redefined the role of our human
resources function. This has included adoption and implementation of a new performance assessment
process, enhancement of job descriptions, and clearly communicated policies and procedures regarding
human resources. We have also hired additional personnel into HR functions to assist in strengthening the
role of human resources within the company. Additionally, we have completed a comprehensive corporate
review of delegations of authority and developed and communicated a corporate-wide policy.
•Information Technology Policy
We have implemented an information technology standard setting board that governs the development
and communication of information technology policies, corporate technology standards and detailed
technology operating procedures throughout the company.
188