Company: FMCCN
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0001026214-25-000040
Chunk: 103

Company: FEDERAL HOME LOAN MORTGAGE CORP
Filing Date: 2025-02-13
Form: 10-K
Item: Item 15
Chunk 103
---
 evaluate and monitor the risks associated with business processes, each business line periodically completes an assessment using the risk assessment methodology. The methodology is designed to identify and assess the business line's exposure to operational risk and determine if action is required to manage the risk to an acceptable level.

In addition to the risk and control self-assessment process, we employ several tools to identify, measure, and monitor operational risks, including loss event data, key risk indicators, root cause analysis, and testing. Our operational risk methodology requires that the primary responsibility for managing both the day-to-day risk and longer-term or emerging risks lies with the business divisions, with independent oversight performed by the second line.

We continue to face heightened operational risk and expect the risk to remain elevated for the near term. This elevated risk profile is due to the layering impact of several factors including: legacy systems requiring upgrade for operational resiliency; reliance on manual processes and models; volume and complexity of business initiatives, including new initiatives we are pursuing as required by the Conservatorship Scorecard; external events such as cybersecurity incidents, other security 

FREDDIE MAC  |  2024 Form 10-K80

Management's Discussion and AnalysisRisk Management

incidents, and third-party failures; and issues requiring remediation. Other factors contributing to our heightened operational risk are discussed in Risk Factors - Operational Risks.

While our operational risk profile remains elevated, we are continuing to strengthen our control environment by further developing metrics to monitor and report on our risk and control environment.

Operational Resiliency Risk

Operational resiliency risk refers to the potential threats and vulnerabilities that an organization faces in maintaining continuous and reliable operations. It involves the ability to anticipate, prepare for, and operate through disruptions, including technological failures, cybersecurity incidents, natural disasters, supply chain disruptions, and human error. The inability to manage resiliency risk to our critical business processes can impact the achievement of business objectives. To reduce operational resiliency risk, Freddie Mac has implemented strategies, continuity plans, dual-site technology operations, and other risk mitigation measures designed to meet desired recovery time objectives and minimize the impact of a disruption.

CSP

We continue to make investments to support the ongoing development and maintenance of the CSP. The CSP is owned and operated by CSS, which is jointly owned by Freddie Mac and Fannie Mae. While we exercise influence over CSS through our representation on the CSS Board of Managers, we do not control its day-to-day operations. Freddie Mac, Fannie Mae, FHFA, and CSS