Fannie Mae 2006 Annual Report Download - page 180

Information Technology Applications and Infrastructure
•Change Management
We implemented additional procedures in September 2006 to control changes to all of the applications
that are material to our financial reporting process. Such procedures include standard request, approval
and review controls over any system or data change. Significant changes are managed through a
governance committee of corporate representatives from technology and business unit management. In
addition, we have implemented reconciliation or user controls designed to ensure that the desired change
was implemented as intended.
•End User Computing
We implemented procedures to control changes to our end user computing (“EUC”) applications, such as
spreadsheets. These procedures included:
• ongoing identification of EUCs used in all significant financial reporting processes;
• protecting EUCs through maintenance on a controlled platform, implemented in August 2006, within
our IT infrastructure where EUC access can be controlled using a process similar to the corporate
application access provision process;
• version control for a significant portion of EUCs; and
• data change control for a significant portion of EUCs.
Independent Model Review Process
A corporate model policy approved in September 2005 established an independent model review process that
assesses and validates on a regular basis whether the models and assumptions are reasonable for their intended
use. We established an independent model review function under the Chief Risk Officer. As of December 31,
2006, we applied this process to our most critical financial models pursuant to our new independent model
review process.
Treasury and Trading Operations
We redesigned our process for authorizing, approving, validating and settling trades, including segregating
duties among trading, settlement and valuation activities within both our treasury and trading operations. In
addition, with the assistance of an independent consulting firm, we assessed the organizational design of our
treasury and trading operations, and completed changes in those functions in December 2006.
Wire Transfer Controls
We completed the implementation of redesigned controls related to our wire transfer activity in September
2006. Specifically, we implemented system changes, developed multiple department policies and created a
cross functional team to develop enhancements to our wire transfer process and controls. As a result, we
enhanced our access controls by segregating the wire initiation and wire system access functions, implemented
a periodic access review process and strengthened our access approval procedures. Additionally, we eliminated
the use of paper manual wire transfers from our standard processes and have reduced our list of inactive
counterparty wire instructions in our database. Lastly, we also increased business unit staffing levels and hired
an external consultant to provide best practice and industry standards guidance.
Independent Price Verification Process
In 2006 we established an independent price verification process with appropriate segregation of duties from
our pricing function. This function implemented independent validation controls to provide verification of fair
value prices through comparisons with external market sources and analytical procedures for prices.
165