Freddie Mac 2011 Annual Report Download - page 321

information known by FHFA on an ongoing basis is communicated from FHFA to Freddie Mac’s management in a
manner that allows for timely decisions regarding our required disclosure. Based on discussions with FHFA and the
structural nature of this continuing weakness, it is likely that we will not remediate this weakness in our disclosure
controls and procedures while we are under conservatorship.
In addition, based on our assessment as of December 31, 2011, we identified a material weakness related to our
inability to effectively manage information technology changes and maintain adequate controls over information security
monitoring, resulting from increased levels of employee turnover.
Management’s Report on Internal Control Over Financial Reporting
Management is responsible for establishing and maintaining adequate internal control over financial reporting, as
such term is defined in Exchange Act Rule 13a-15(f). Internal control over financial reporting is a process designed by, or
under the supervision of, our Chief Executive Officer and Chief Financial Officer and effected by the Board of Directors,
management and other personnel to provide reasonable assurance regarding the reliability of our financial reporting and
the preparation of financial statements for external purposes in accordance with GAAP.
Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements.
It is a process that involves human diligence and compliance and is, therefore, subject to lapses in judgment and
breakdowns resulting from human error. It also can be circumvented by collusion or improper management override.
Because of its limitations, there is a risk that internal control over financial reporting may not prevent or detect on a
timely basis errors that could cause a material misstatement of the financial statements.
We assessed the effectiveness of our internal control over financial reporting as of December 31, 2011. In making our
assessment, we used the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission, or
COSO, in Internal Control — Integrated Framework. A material weakness is a deficiency, or a combination of
deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material
misstatement of the company’s annual or interim financial statements will not be prevented or detected on a timely basis
by a company’s internal controls. Based on our assessment, we identified two material weaknesses related to: (a) our
inability to update our disclosure controls and procedures in a manner that adequately ensures the accumulation and
communication to management of information known to FHFA that is needed to meet our disclosure obligations under the
federal securities laws, including disclosures affecting our consolidated financial statements; and (b) our inability to
effectively manage information technology changes and maintain adequate controls over information security monitoring,
resulting from increased levels of employee turnover.
We have been under conservatorship of FHFA since September 6, 2008. FHFA is an independent agency that
currently functions as both our Conservator and our regulator with respect to our safety, soundness and mission. Because
we are in conservatorship, some of the information that we may need to meet our disclosure obligations may be solely
within the knowledge of FHFA. As our Conservator, FHFA has the power to take actions without our knowledge that
could be material to investors and could significantly affect our financial performance. Although we and FHFA have
attempted to design and implement disclosure policies and procedures that would account for the conservatorship and
accomplish the same objectives as disclosure controls and procedures for a typical reporting company, there are inherent
structural limitations on our ability to design, implement, test or operate effective disclosure controls and procedures under
the current circumstances. As our Conservator and regulator, FHFA is limited in its ability to design and implement a
complete set of disclosure controls and procedures relating to us, particularly with respect to current reporting pursuant to
Form 8-K. Similarly, as a regulated entity, we are limited in our ability to design, implement, operate and test the controls
and procedures for which FHFA is responsible. For example, FHFA may formulate certain intentions with respect to the
conduct of our business that, if known to management, would require consideration for disclosure or reflection in our
financial statements, but that FHFA, for regulatory reasons, may be constrained from communicating to management. As a
result, we have concluded that this control deficiency constitutes a material weakness in our internal control over financial
reporting.
We are finding it difficult to retain and engage critical employees and attract people with the skills and experience
we need. In most areas, we have been able to leverage succession plans and reassign responsibilities to maintain sound
internal control over financial reporting. However, in the fourth quarter of 2011, we experienced a significant increase in
the number of control breakdowns within certain areas of our information technology division, specifically within groups
responsible for information change management and information security. We identified deficiencies in the following
areas: (a) approval and monitoring of changes to certain technology applications and infrastructure; (b) monitoring of
select privileged user activities; and (c) monitoring user activities performed on certain technology hardware systems.
These control breakdowns could have impacted applications which support our financial reporting processes. Increased
316 Freddie Mac