Fannie Mae 2010 Annual Report Download - page 153

Our organizational structure and risk management framework work in conjunction with each other to identify
risk-related trends with respect to customers, products or portfolios and external events to develop appropriate
strategies to mitigate emerging and identified risks.
Board of Directors
The Board of Directors is responsible for the oversight of risk management primarily through the Board’s Risk
Policy and Capital Committee. This board committee oversees risk-related policies, including: review of the
corporate-level risk policies and limits; performance against these policies and limits; and the sufficiency of
risk management capabilities. In addition, the Audit Committee reviews the system of internal controls that we
rely upon to provide reasonable assurance of compliance with our enterprise risk management processes.
Enterprise Risk Management Division
Our Enterprise Risk Management division is headed by the Chief Risk Officer. The Chief Risk Officer reports
directly to the Chief Executive Officer and independently to the Board of Directors, primarily through the
Board’s Risk Policy and Capital Committee. Enterprise Risk Management is responsible for providing our risk
management directives and functions as well as for establishing effective controls, including policy
development, risk management methodologies and risk reporting.
Our Enterprise Risk Management division has designated chief risk officers for each of our business segments
in addition to risk officers who are responsible for the management of our financial risks. These chief risk
officers are responsible for oversight and approval of key risks within their respective business unit and for
developing the appropriate risk policies and reporting requirements for their business unit.
Risk Committees
We use our risk committees as a forum for discussing emerging risks, risk mitigation strategies, and
communication across business lines. Risk committees enhance the risk management framework by reinforcing
our risk management culture and providing accountability for the resolution of key risk issues and decisions.
Each business risk committee is co-chaired by the business unit chief risk officer and the business unit
executive vice president and includes key business and risk leaders.
Our current committee structure includes four Business Risk Committees (Capital Markets Risk, Credit
Portfolio Management Risk, Multifamily Risk and Single-Family Risk) and five Enterprise Risk Committees
(Asset and Liability, Credit Risk, Credit Expense Forecast and Allowance, Model Risk Oversight and Change
Management, and Operational Risk).
Internal Audit
Our Internal Audit group, under the direction of the Chief Audit Executive, provides an objective assessment
of the design and execution of our internal control system, including our management systems, risk
governance, and policies and procedures. The Chief Audit Executive reports directly and independently to the
Audit Committee of the Board of Directors, and audit personnel are compensated on objectives set for the
group by the Audit Committee rather than corporate financial results or goals. The Chief Audit Executive
reports administratively to the Chief Executive Officer and may be removed only upon approval by the
Board’s Audit Committee. Internal audit activities are designed to provide reasonable assurance that resources
are safeguarded; that significant financial, managerial and operating information is complete, accurate and
reliable; and that employee actions comply with our policies and applicable laws and regulations.
Compliance and Ethics
The Compliance and Ethics division, under the direction of the Chief Compliance Officer, is dedicated to
developing policies and procedures to help ensure that Fannie Mae and its employees comply with the law,
our Code of Conduct, and all regulatory obligations. The Chief Compliance Officer reports directly to our
Chief Executive Officer and independently to the Audit Committee of the Board of Directors, and Compliance
148