Freddie Mac 2015 Annual Report Download - page 140

Management's Discussion and Analysis Risk Management | Operational Risk
Freddie Mac 2015 Form 10-K 138
Scorecards. We continue to make various multi-year investments to build the infrastructure for a future
housing finance system, including the development of the common securitization platform by the CSS,
which is jointly owned by Freddie Mac and Fannie Mae, and a single (common) security. With regard to
the common securitization platform, while we exercise influence over CSS through our Board
representation, we do not control its day to day operations. As a result, if this initiative is not successful,
we may not recover our investments. In addition, the transition to the common securitization platform,
which is currently scheduled to begin in late 2016, presents significant operational and technological
challenges.
The threat landscape in cyber security is changing rapidly and growing in sophistication. We may not be
able to protect our systems with complete assurance or fully protect the confidentiality of our information
from a cyber attack or other unauthorized access, disclosure, or disruption. We continue to invest in the
information security area to strengthen our capabilities and help us defend against advanced threats. In
2014, we launched a multi-year data protection initiative designed to mitigate this risk.
Operational Risk Related to the Use of Models
Our business activities rely on the use of models. We use a variety of models to inform management
decisions related to our businesses. These include models that forecast significant factors such as
interest rates, mortgage rates, and house prices, as well as models that project future cash flows related
to borrower prepayment and default behavior. Risks emerge when unexpected changes cause future
outcomes to be different from the outcomes projected by our models.
Model development, changes to existing models, and model risks are managed in each line of business
according to our three-lines-of-defense framework. New model development and changes to existing
models undergo a rigorous review process. Each business periodically reviews model performance,
embedded assumptions, and modeling techniques, and updates its models as it deems appropriate. The
Enterprise Risk Management Division, the second-line-of-defense, develops corporate model risk policies
and independently reviews the work done by the first-line-of-defense. The Internal Audit Division, the
third-line-of-defense, provides additional periodic independent assessment that model governance,
policies, and procedures are followed appropriately.
Given the importance and complexity of models in our business, model development may take several
months to complete. Delays in our model development process could affect our ability to make sound
business and risk management decisions, and increase our exposure to risk. We have procedures
designed to mitigate this risk.
We face heightened exposure to risk in our model governance processes at this time, as we continue to
transition to our enhanced three-lines-of-defense framework. We intend to make additional changes to
strengthen our model governance processes. We also are having difficulty finding and retaining high
quality technical model staff.
A corporate Model Operating Committee serves as a coordination forum for any issues arising from
models that are used across divisions. Issues that remain unresolved at the Model Operating Committee
are escalated to the ERC as necessary. We face significant risks associated with our use of models, as
discussed in "Risk Factors - Operational Risks - We face risks and uncertainties associated with the
models that we use to inform business and risk management decisions and for financial accounting and
reporting purposes."