Freddie Mac 2004 Annual Report Download - page 107

RISK MANAGEMENT
Our business of purchasing mortgages and mortgage-related securities, funding these purchases and
guaranteeing the payment of principal and interest on the mortgage-related securities we issue exposes us to
three broad categories of risk: operational risks, market risk, and credit risk. Managing these risks is a critical
function for us as our eÅectiveness inÖuences our ability to accomplish our mission as well as the level and
stability of our earnings and long-term value. Our strategies for managing operational risks, market risk, and
credit risk are based upon the principle that risk should be understood, measured and managed directly by our
business areas, with appropriate, independent oversight.
Risk Oversight
We oversee business area management of operational, market and credit risks through our Enterprise
Risk Oversight group led by the Chief Enterprise Risk OÇcer, who reports directly to the Chief Executive
OÇcer. The Chief Enterprise Risk OÇcer provides advice to senior management on key risk management
issues and provides reporting on risk matters to the Audit Committee of the Board of Directors. Within the
Enterprise Risk Oversight function, the Operational Risk Oversight group, the Market Risk Oversight group
and the Credit Risk Oversight group each provide independent oversight. Oversight of our financial reporting
processes and internal controls occurs through the Chief Financial OÇcer. The Chief Financial OÇcer
provides overall guidance on the internal controls framework and communicates an assessment of internal
controls to senior management and the Audit Committee of the Board of Directors on a regular basis. The
Chief Financial OÇcer has established an internal controls organization to oversee the adequacy of internal
controls across the enterprise.
Our Internal Audit and Corporate Compliance Divisions play key roles in our risk oversight process.
Internal Audit assesses whether our risk management, control and governance processes are adequate and
functioning eÅectively. Corporate Compliance helps ensure that we comply with statutory and regulatory
requirements, and related corporate policies that govern our business activities. Internal Audit reports to the
Audit Committee. The Chief Compliance OÇcer reports directly to the Chief Executive OÇcer and provides
reports on compliance matters to the Audit Committee.
The Board of Directors oversees risk management through the Audit Committee, the Finance and
Capital Deployment Committee and the Mission and Sourcing Committee. An independent director chairs
each of these Committees.
Operational Risks
Summary
Operational risks represent the potential for Ñnancial loss resulting from failed or inadequate controls with
respect to process, technology, people or external events. Operational risks are present in all of our business
processes, including Ñnancial reporting. While we have made strides in remediating internal control
weaknesses with respect to Ñnancial reporting, we have a signiÑcant number of internal control issues that
have not been fully remediated and considerable challenges remain. Some of these control issues represent
""material weaknesses'' in our internal controls over Ñnancial reporting. We have detailed these material
weaknesses and remediation activities in Ì ""Internal Controls over Financial Reporting''. We have focused
intense eÅort in 2004 on identifying and remediating control design issues; however, we may discover new
control weaknesses as we complete our controls eÅectiveness testing eÅort which is currently underway.
Our process for managing operational risks is to identify, measure, remediate, and monitor all key sources
of operational risks. To improve our ability to manage operational risks, we have undertaken a number of
corporate initiatives. In 2004 we implemented corporate-wide ethics training; an enhanced employee hotline
process for reporting concerns, including those relating to our Ñnancial reporting processes; a revised corporate
disclosure policy; an enhanced Disclosure Committee; and a New Products Committee. We believe these
initiatives have strengthened our entity-level control, and emphasized a ""tone from the top'' of strong integrity
and ethical behavior.
Freddie Mac
95