Fannie Mae 2009 Annual Report Download - page 149

•Market Risk. Market risk is the exposure generated by adverse changes in the value of financial
instruments caused by a change in market prices or interest rates. Two significant market risks we face
and actively manage are interest rate risk and liquidity risk. Interest rate risk is the risk of changes in our
long-term earnings or in the value of our net assets due to fluctuations in interest rates. Liquidity risk is
the potential inability of the Company to meet its funding obligations in a timely manner.
•Operational Risk. Operational risk is the loss resulting from inadequate or failed internal processes,
people, systems, or from external events.
•Model Risk. Model risk is the potential for model errors to adversely impact the company. We use
models to help manage our business. For example, we use models to measure and monitor our exposures
to credit and market risk (including interest rate risk), make key business decisions relating to credit
guaranty fee pricing, credit loss mitigation, asset acquisition, and debt issuances. We also use the results
of models to report our financial performance and determine asset and liability fair values. As such,
modeling errors can occur when predicting prepayments, projecting defaults and losses, or valuing options
either through human error or inaccurate assumptions.
We are also subject to a number of other risks that could adversely impact our business, financial condition,
earnings and cash flows, including legal and reputational risks that may arise due to a failure to comply with
laws, regulations or ethical standards and codes of conduct applicable to our business activities and functions.
See “Risk Factors.”
Our risk management framework and governance structure are intended to provide comprehensive controls and
ongoing management of the major risks inherent in our business activities. Our ability to identify, assess,
mitigate and control, and report and monitor risk is crucial to our safety and soundness.
•Risk Identification: We are exposed to risk through our daily business dealings. Risks are identified
through our risk management framework. Employees who manage risk are responsible for identifying and
determining potential losses that could arise from specific or unusual events.
•Risk Assessment: We assess risk using a variety of methodologies, such as calculation of potential
losses from loans, stress tests relating to interest rate sensitivity, and rebalancing of financial instruments
to maintain a close match between the duration of our assets and liabilities. Information obtained from
these assessments is reviewed on a regular basis to ensure that our risk assumptions are reasonable and
reflect our current positions.
•Risk Mitigation & Control: We manage risk through four control elements that are designed to work in
conjunction with each other: (1) risk policies provide guidance for the management of risk; (2) limits
establish boundaries for level of risk taking, subject to our risk tolerances. Limits can be established at the
Board, management or operating level by the Board of Directors, executive management, or senior
management, respectively; (3) delegations of authority exist to provide oversight and accountability in
decision making; and (4) our risk committee structure provides a forum for discussing emerging risks, risk
mitigation strategies and communicating across functional lines to enhance risk management. Business
units are required to proactively develop appropriate controls and procedures to help ensure exposures do
not exceed established tolerances.
•Risk Reporting & Monitoring: Our business units actively monitor emerging and identified risks that
are taken when executing our strategies. Risks and concerns are reported to the appropriate level of
management to ensure that the necessary action is taken to mitigate the risk.
Enterprise Risk Governance
Our enterprise risk management structure is designed to balance a strong corporate risk management
philosophy, appetite and culture with a well-defined independent risk management function. Our objective is to
ensure that people and processes are organized in a way to promote a cross-functional approach to risk
management and that controls are in place to better manage our risks and comply with legal and regulatory
requirements.
144