Fannie Mae 2011 Annual Report Download - page 154

as frequency, severity, concentration, correlation, volatility and loss. Information obtained from these
assessments is reviewed on a regular basis to ensure that our risk assumptions are reasonable and reflect our
current positions.
•Risk Mitigation & Control. We proactively develop appropriate mitigation strategies to prevent excessive
risk exposure, address risks that exceed established tolerances, and address risks that create unanticipated
business impact. Mitigation strategies and controls can be in the form of reduction, transference, acceptance
or avoidance of the identified risk. We also manage risk through four control elements that are designed to
work in conjunction with each other: (1) risk policies, (2) risk limits, (3) delegations of authority, and
(4) risk committees.
•Risk Reporting & Monitoring. Our business units actively monitor emerging and identified risks that are
taken when executing our strategies. Risks and concerns are reported to the appropriate level of
management to ensure that the necessary action is taken to mitigate the risk.
Enterprise Risk Governance
Our enterprise risk management structure was reorganized in 2011, and we continue to work with FHFA to
implement its final form. We intend the final structure to be designed to balance a strong corporate risk
management philosophy, appetite and culture with a well-defined, independent risk management function. Our
objective is to ensure that people and processes are organized in a way to promote a cross-functional approach to
risk management and that controls are in place to better manage our risks and comply with legal and regulatory
requirements.
Our enterprise risk governance structure consists of the Board of Directors, executive leadership, including the
Chief Risk Officer, the Enterprise Risk Management division, designated officers responsible for managing our
financial risks, business unit chief risk officers, and risk management committees. This structure is designed to
encourage a culture of accountability within the divisions and promote effective risk management throughout the
company.
Our organizational structure and risk management framework work in conjunction with each other to identify
risk-related trends with respect to customers, products or portfolios and external events to develop appropriate
strategies to mitigate emerging and identified risks.
Board of Directors
The Board’s Risk Policy & Capital Committee provides oversight of enterprise risk management activities and
pursuant to its charter, assists the Board in providing oversight of our risk management, including overseeing the
management of credit, market and operational risk policies and limits. In addition, the Audit Committee reviews
the system of internal controls that we rely upon to provide reasonable assurance of compliance with our
enterprise risk management processes.
Enterprise Risk Management Division
Our Enterprise Risk Management division reports directly to the Chief Risk Officer who reports directly to the
Chief Executive Officer. The Chief Risk Officer also reports independently to the Board’s Risk Policy & Capital
Committee. Enterprise Risk Management is responsible for the identification of emerging risks, the monitoring
and reporting of risk within the existing policies and limits and independent oversight of risk management across
the company.
We manage risk by using a “three line of defense” structure. The first line of defense is the active management of
risk by the business unit. Each business unit is charged with conforming to the risk guidelines, risk appetite, risk
policies and limits approved by the Board’s Risk Policy & Capital Committee and the Management Committee,
with additional oversight provided by FHFA. The second line of defense is Enterprise Risk Management, which
is responsible for ensuring compliance with the risk framework and independently reporting on risk management
- 149 -