Freddie Mac 2005 Annual Report Download - page 70

We currently outsource certain key functions to external parties, including processing functions for trade capture,
market risk management analytics, asset valuation, and mortgage loan underwriting. We mitigate the risk from outsourcing
by engaging in active vendor management, including establishing detailed vendor requirements, reviewing business
continuity plans, monitoring quality assurance processes and engaging third party reviews of our vendors. In addition, we use
a process of delegated underwriting for the single-family mortgages we purchase or securitize. In this process, we provide
originators with a series of mortgage underwriting guidelines and they represent and warrant to us that the mortgages sold to
us meet these guidelines. See ""Credit Risks Ì Mortgage Credit Risk Ì Mortgage Credit Risk Management Strategies Ì
Underwriting Requirements and Quality Control Standards'' and ""Institutional Credit Risk Ì Mortgage Seller/Servicers''
for information about how we mitigate the risks associated with delegated underwriting.
We are making signiÑcant investments to build new Ñnancial reporting systems and to move to more eÅective and
eÇcient business processing systems. During the transition period, however, we are more reliant on end-user computing
systems than is desirable and are challenged to deliver integrated production systems. Certain of these end-user computing
systems increase the risk of errors in some of our core operational processes and increase our reliance on monitoring
controls, which is an area where we have a material weakness in our internal control over Ñnancial reporting. They may also
limit our capacity for change. In the near term, we are mitigating this risk by improving our documentation and controls
over these systems and placing key end-user systems under the same technology controls as our production applications. We
also face challenges in the areas of system security, change management and information technology application and general
controls. See ""Internal Control over Financial Reporting'' for more information concerning internal control issues related to
our systems, both Ñnancial and non-Ñnancial reporting.
We are also exposed to the risk that our business processes could be adversely aÅected by inadequate staÇng, which
strains existing resources and increases the risk that an error or fraud will not be detected. This risk is of particular concern
for us because of high turnover rates, critical vacancies and recent changes in our senior management. We have Ñlled some
important vacancies such as General Counsel, General Auditor, Principal Accounting OÇcer, and Senior Vice President,
Enterprise Operational Risk. Our President and Chief Operating OÇcer has assumed the responsibilities of the Chief
Financial OÇcer while we conduct a search to Ñll that position. Recently, high employee turnover rates have contributed to
increased operational risk. While we have made progress in our eÅorts to build a strong management team by Ñlling several
senior positions, we need to continue to recruit additional qualiÑed people into leadership positions across the organization
in order to achieve our objectives in regard to remediation of our internal control deÑciencies.
In addition to the particular risks and challenges we are facing, we face ongoing risks that are similar to those of other
large Ñnancial institutions. For example, we are exposed to the risk that a catastrophic event, such as a terrorist event or
natural disaster, could result in a signiÑcant business disruption and an inability to process transactions through normal
business processes. To mitigate this risk, we maintain and test business continuity plans and have established backup
facilities for critical business processes and systems away from, although in the same metropolitan area as, our main oÇces.
In 2005, we began an eÅort to establish out-of-region capabilities for clearing and treasury services. However, it is not clear
that these measures will be suÇcient to respond to the full range of catastrophic events that might occur.
Internal Control over Financial Reporting
Since the revision and restatement of our Ñnancial results for 2000 through 2002, we have had to face many challenging
and complex accounting and Ñnancial reporting issues, including ongoing controls remediation and systems re-engineering
and development. We fell behind in our periodic reporting for the years ended December 31, 2002, 2003, 2004 and 2005,
and we have not yet returned to quarterly reporting. Improving internal control over Ñnancial reporting and mitigating the
risks presented by material weaknesses and other control deÑciencies in our Ñnancial reporting processes continue to be top
corporate priorities. Many of the material weaknesses and other control deÑciencies identiÑed in prior years persisted
throughout 2005 and continue to present challenges for us in 2006. In addition, we determined that some previously
identiÑed deÑciencies were more serious than originally assessed. We also identiÑed additional control deÑciencies in 2005.
While we believe we have made progress in the remediation of certain material weaknesses and other control deÑciencies
that have been identiÑed, these will continue to pose signiÑcant risks to our Ñnancial reporting process until fully
remediated. For example, in the course of completing our Ñnancial reporting processes for 2005, we discovered a number of
internal control issues that resulted in adjustments to our interim 2005 Ñnancial results.
The material weaknesses that aÅected us throughout 2005 and at the end of the year included:
‚ Integration among our systems, business units and external service providers Ì Integration issues among our systems
and processes related to our operational and Ñnancial accounting systems, business units and external service
providers, which collectively increase the risk of error in our Ñnancial reporting due to: (a) the potential failure to
correctly pass information between systems and processes; (b) incompatibility of data between systems;
(c) incompatible systems; or (d) a lack of clarity in process ownership. To compensate for this weakness, we have
54 Freddie Mac