Freddie Mac 2006 Annual Report Download - page 69

We outsource certain key functions to external parties, including (a) processing functions for trade capture, market risk
management analytics and asset valuation, (b) custody and recordkeeping and (c) processing functions for mortgage loan
underwriting. In addition, we use a process of delegated underwriting for the single-family mortgages we purchase or
securitize. We also expect to implement a process of delegated underwriting for certain multifamily mortgages we purchase
or securitize. See ""Credit Risks Ì Mortgage Credit Risk Ì Underwriting Requirements and Quality Control Standards''
for information about how we mitigate the risks associated with delegated underwriting. We mitigate the risk from our use
of external parties by engaging in active vendor management, such as establishing detailed vendor requirements, reviewing
business continuity plans, monitoring quality assurance processes and using third party reviews of our vendors.
In recognition of the importance of the accuracy and reliability of our valuation of Ñnancial instruments, we engage in an
ongoing internal review of our valuations. We perform analysis of internal valuations on a monthly basis to conÑrm the
reasonableness of the valuations. This analysis is performed by a group that is independent of the business area responsible
for valuing the positions. Our veriÑcation and validation procedures depend on the nature of the security and valuation
methodology being reviewed and may include: comparisons with external pricing sources, comparisons with observed trades,
independent veriÑcation of key valuation model inputs and independent security modeling. Results of the monthly
veriÑcation process, as well as any changes in our valuation methodologies, are reported to a management committee that is
responsible for reviewing and approving the approaches used in our valuations to ensure that they are well controlled and
eÅective, and result in reasonable fair values.
We are also exposed to the risk that our business processes could be adversely aÅected by inadequate staÇng, which
strains existing resources and increases the risk that an error or fraud will not be detected. This risk is of particular concern
for us because of high voluntary employee turnover rates experienced in 2005, critical vacancies and recent changes in our
senior management. During 2006, we Ñlled some important vacancies such as Chief Financial OÇcer, General Counsel,
General Auditor, Corporate Controller and Principal Accounting OÇcer and Chief Information OÇcer. While we have
made progress in our eÅorts to reduce voluntary employee turnover rates and to build a strong management team by Ñlling
several senior positions, we need to continue to recruit additional qualiÑed people into key positions across the organization in
order to achieve our remediation objectives. See ""Internal Control Over Financial Reporting'' for more information
concerning staÇng adequacy risk related to Ñnancial reporting.
In addition to the particular risks and challenges we are facing, we experience ongoing risks that are similar to those of
other large Ñnancial institutions. For example, we are exposed to the risk that a catastrophic event, such as a terrorist event
or natural disaster, could result in a signiÑcant business disruption and an inability to process transactions through normal
business processes. To mitigate this risk, we maintain and test business continuity plans and have established backup
facilities for critical business processes and systems away from, although in the same metropolitan area as, our main oÇces.
In 2006, we established out-of-region capabilities for clearing and treasury services. However, we can make no assurances
that these measures will be suÇcient to respond to the full range of catastrophic events that might occur.
Internal Control Over Financial Reporting
Improving internal control over Ñnancial reporting and mitigating the risks presented by material weaknesses and
signiÑcant deÑciencies in our Ñnancial reporting processes continue to be top corporate priorities. During 2006, we developed
a comprehensive plan for returning to quarterly Ñnancial reporting. The comprehensive plan includes mitigation and
remediation of identiÑed material weaknesses and signiÑcant deÑciencies; strengthening of our Ñnancial close process;
implementation of critical systems initiatives; and completion of a review of our system of internal controls related to the
processing and recording of Ñnancial transactions.
We have made progress implementing changes to our accounting, Ñnancial reporting and operational infrastructure that
have improved our internal control environment, including outsourcing the custody and recordkeeping functions for our
Retained portfolio and Cash and investments portfolio, implementing a new accounting sub-ledger for our Cash and
investments portfolio and upgrading our general ledger system. However, certain key initiatives, including the implementa-
tion of a new sub-ledger for our Retained portfolio, were not completed by year-end as originally planned and will continue
to be part of our remediation eÅorts in 2007.
As a result of our eÅorts, we made signiÑcant progress toward the remediation of our material weaknesses, as described
below. However, each of the material weaknesses identiÑed in prior years persisted throughout 2006 and they continue to
present challenges for us in 2007.
We also made progress in the remediation of the signiÑcant deÑciencies in our internal control and we have mitigated
some of them so that they have been reduced to control deÑciencies in our internal control over Ñnancial reporting. For
example, we enhanced our risk governance framework thereby reducing the severity of the weaknesses that existed in this
area. We also improved our processes for identifying security impairments and the governance of and change management
57 Freddie Mac