Fannie Mae 2006 Annual Report Download - page 179

Policy and Capital Committee of the Board of Directors in July 2006. The Chief Risk Officer reports
independently to the Risk Policy and Capital Committee, and also reports directly to the Chief Executive
Officer.
•Internal Audit
In July 2005, management and the Audit Committee of the Board appointed a new Chief Audit Executive
from outside the company. The Chief Audit Executive reports directly to the Audit Committee with
indirect reporting to the Chief Executive Officer. The Chief Audit Executive enhanced the level of
communication with the Audit Committee, which includes increased communication with the Chairman
of the Audit Committee and enhanced detail within the formal reports to the Audit Committee.
Additionally, the Internal Audit function completed a comprehensive review and analysis of its
organizational design and audit processes, including organizational structure, staffing levels, skill
assessments, audit planning, audit execution and reporting. Internal Audit has filled its key management
positions and continues to reassess and enhance its staffing. The Internal Audit management team was
expanded in 2006 from one officer to four, three of whom were external hires. All officers in the Internal
Audit department hold one or more of the following professional credentials: certified public accountant,
certified internal auditor, certified fraud examiner, certified information systems auditor or certified bank
auditor. As of January 2006, Internal Audit developed and communicated a risk-based audit plan, which it
reports upon regularly to the Audit Committee.
•Human Resources
As part of our organizational redesign, we repositioned and redefined the role of our human resources
function. In October 2006, this included implementation of a new performance assessment process,
enhancement of job descriptions, and clearly communicated policies and procedures regarding human
resources. We also hired additional personnel into HR functions to assist in strengthening the role of
human resources within the company. Additionally, we completed a comprehensive corporate review of
delegations of authority and developed and communicated a corporate-wide policy.
•Information Technology Policy
We implemented an information technology standard setting board in 2005 that governs the development
and communication of information technology policies, corporate technology standards and, in September
2006, implemented detailed technology operating procedures throughout the company. In addition, in
November 2006, we hired a new Chief Information Officer responsible for oversight of all of our
technology efforts.
•Policies and Procedures
In September 2006, we implemented corporate-wide standards for policies and procedures for use
throughout our business to support a uniform approach to the documentation of current policies,
procedures and delegated authority in most areas of the company. Concurrent with our corporate policy
and procedures initiative, each of our business units identified and corrected deficient policies and
procedures documentation for processes relevant to internal control over financial reporting. As noted
above, we also completed a comprehensive corporate review of delegations of authority and developed
and communicated a corporate-wide policy.
Financial Reporting Process
•General Ledger Controls
We implemented additional review and approval controls to manage the addition and deletion of general
ledger accounts. We also strengthened supervisory review controls over account management and the
periodic close process. These controls were implemented in the second quarter of 2006.
164