Fannie Mae 2009 Annual Report Download - page 189

Management of Business Resiliency
Our business resiliency program is designed to provide reasonable assurance for continuity of critical business
operations in the event of disruptions caused by the loss of facilities, technology or personnel. Despite
proactive planning, testing and continuous preparation of back up venues, these measures may not prevent a
significant business disruption from an improbable but highly catastrophic event.
Non-Mortgage Related Fraud Risk
Our anti-fraud program provides a framework for managing non-mortgage related fraud risk. The program is
designed to provide reasonable assurance for the prevention and detection of non-mortgage related fraudulent
activity. However, because fraudulent activity requires the intentional circumvention of the internal control
structure, the efforts of the program may not always prevent, or immediately detect, instances of such activity.
See “Risk Factors” for a discussion of operational risk at Fannie Mae.
Model Risk Management
We make significant use of models to manage our business. We use models to measure and monitor our
exposures to credit and market risk (including interest rate risk). We use the information provided by models
to make key business decisions related to such areas as credit guaranty fee pricing, credit loss mitigation, asset
acquisition, and debt issuances. We also use the results of models to report our financial performance and
determine asset and liability fair values.
Model risk is the potential for model errors to adversely impact the company. We manage model risk within
an established framework that provides for identifying, assessing, mitigating and controlling, and reporting and
monitoring model risk. This framework includes, among other controls, a process for validating and approving
models for production use and for periodic performance assessments of the models once they have been
implemented into production. Model validation and assessment reviews are conducted by a team within the
Enterprise Risk Division team who are independent of the model developers. A key goal of this process is to
ensure that model assumptions and limitations are fully understood, as models are inherently risky given the
impossibility of predicting the future with certainty.
Our model risk policy applies to all models used for financial reporting, risk management, and business
decision making. The model risk policy applies both to models developed internally and to models licensed
from third-party vendors. This policy includes an independent function within our Enterprise Risk
Management division which has oversight responsibility for models and is independent of both model
developers and business users.
During the normal course of business, we utilize a significant number of models with varying degrees of
complexity. Most of these are specialized models used to predict prepayments, project defaults and losses, or
value options. We maintain an inventory of all models and assign a risk priority rating to the model, based on
the potential impact of the information generated from the model. Based on the rating assigned to a new
model, it is reviewed by our independent oversight function before it is placed into production. We have a
variety of process controls in place to oversee and manage changes made to our models. We continue to focus
on enhancing these controls and improving communication related to model changes to address downstream
impacts.
Model Limitations
Our models have evolved over time in response to changes in the composition of our portfolio, improvements
in modeling techniques, systems capabilities and changes in market conditions. In addition, our models may
require additional assumptions for products that do not have extensive historical price data, or for illiquid
positions for which accurate daily prices are not consistently available. For example, historical data that form
the basis of our prepayment assumptions may fail to accurately predict future prepayments, and our interest
rate risk metrics may not fully capture the effects of market illiquidity.
184