Fannie Mae 2012 Annual Report Download - page 124

119
RISK MANAGEMENT
Our business activities expose us to the following three major categories of financial risk: credit risk, market risk (including
interest rate and liquidity risk) and operational risk. We seek to actively monitor and manage these risks by using an
established risk management framework. Our risk management framework is intended to provide the basis for the principles
that govern our risk management activities.
• Credit Risk. Credit risk is the potential for financial loss resulting from the failure of a borrower or institutional
counterparty to honor its financial or contractual obligations, resulting in a potential loss of earnings or cash flows. In
regards to financial securities or instruments, credit risk is the risk of not receiving principal, interest or any other
financial obligation on a timely basis, for any reason. Credit risk exists primarily in our mortgage credit book of
business and derivatives portfolio.
• Market Risk. Market risk is the exposure generated by adverse changes in the value of financial instruments caused by
a change in market prices or interest rates. Two significant market risks we face and actively manage are interest rate
risk and liquidity risk. Interest rate risk is the risk of changes in our long-term earnings or in the value of our assets due
to fluctuations in interest rates. Liquidity risk is our potential inability to meet our funding obligations in a timely
manner.
• Operational Risk. Operational risk is the loss resulting from inadequate or failed internal processes, people, systems, or
from external events.
We are also subject to a number of other risks that could adversely impact our business, financial condition, earnings and
cash flow, including human capital, legal, regulatory and compliance, reputational, strategic and execution risks that may
arise due to a failure to comply with laws, regulations or ethical standards and codes of conduct applicable to our business
activities and functions. These risks are typically brought to the attention of our Management Committee, our Board of
Directors or one or more of the Board’s committees and, in some cases, FHFA for discussion.
Another risk that can impact our financial condition, earnings and cash flow is model risk, which is defined as the potential
for model errors to adversely affect the company. This occurs because of our use of modeled estimations of future economic
environments, borrower behavior or valuation methodologies. See “Risk Factors” for a discussion of the risks associated with
our reliance on models.
Our risk management framework and governance structure are intended to provide comprehensive controls and ongoing
management of the major risks inherent in our business activities. Our ability to identify, assess, mitigate and control, and
report and monitor risk is crucial to our safety and soundness.
• Risk Identification. Risk identification is the process of finding, recognizing and describing risk. The identification of
risk facilitates effective risk management by achieving awareness of the sources, impact and magnitude of risk.
• Risk Assessment. We assess risk using a variety of methodologies, such as calculation of potential losses from loans
and stress tests relating to interest rate sensitivity. When we assess risk, we look at metrics such as frequency, severity,
concentration, correlation, volatility and loss. Information obtained from these assessments is reviewed on a regular
basis to ensure that our risk assumptions are reasonable and reflect our current positions.
• Risk Mitigation & Control. We proactively develop appropriate mitigation strategies to prevent excessive risk
exposure, address risks that exceed established tolerances, and address risks that create unanticipated business impact.
Mitigation strategies and controls can be in the form of reduction, transference, acceptance or avoidance of the
identified risk. We also manage risk through four control elements that are designed to work in conjunction with each
other: (1) risk policies, (2) risk limits, (3) delegations of authority, and (4) risk committees.
• Risk Reporting & Monitoring. Our business units actively monitor emerging and identified risks that are taken when
executing our strategies. Risks and concerns are reported to the appropriate level of management to ensure that the
necessary action is taken to mitigate the risk.
Enterprise Risk Governance
Our enterprise risk management structure consists of the Board of Directors, executive leadership, including the Chief Risk
Officer, the Enterprise Risk Management division, designated officers responsible for managing our financial risks, business
unit chief risk officers, and risk management committees. This structure is designed to encourage a culture of accountability
within the divisions and promote effective risk management throughout the company.