NATIONAL RURAL UTILITIES COOPERATIVE FINANCE CORP DC

Operational risk represents the risk of loss resulting from certain risk classifications, including, but not limited to, the execution of unauthorized transactions by employees; reputation risk; talent management (e.g., the inability to retain or attract sufficiently qualified employees); errors relating to loan documentation, transaction processing and technology; the inability to perfect liens on collateral; breaches of internal control and information systems; and the risk of fraud by employees or persons outside the company. Potential legal actions that could arise as a result of operational deficiencies, noncompliance with covenants in our revolving credit agreements and indentures, employee misconduct or adverse business decisions are also considered part of operational risk. In the event of a breakdown in internal controls, improper access to or operation of systems or improper employee actions, we could incur financial loss. Operational risk also includes breaches of technology and information systems resulting from unauthorized access to confidential or sensitive information or from internal or external threats, such as cyberattacks, whether on our technology infrastructure or in relation to third-party vendors that store confidential or sensitive internal data. Furthermore, third-party risk is another important component of our operational risk focus requiring identification, assessment and mitigation of critical risks arising from relationships with third-party vendors, suppliers, partners, service providers and contractors. Not having a set of practices to increase the visibility of third-party risk, including performing due diligence on current and new vendors through standardized questionnaires and forms, creating a risk register for recorded risks and implementing risk prioritization, would potentially expose CFC to externally generated operational risks that could disrupt our standard operating environment.

Operational risk is inherent in all business activities. The measurement, assessment and effective management of such risk is important to the achievement of our objectives. Operational risk is a core component of CFC’s Enterprise Risk Management framework and is governed by the CFC Board of Directors while management oversight of the risk is the responsibility of the Chief Risk Officer. We maintain related risk guidelines and limits, business policies and procedures, employee training, an internal control framework, a comprehensive business continuity and disaster recovery plan, as well as a detailed third-party risk management program that are collectively intended to provide a sound operational environment. Our business policies and controls have been designed to manage operational risk at appropriate levels given our financial strength, the business environment and markets in which we operate, and the nature of our businesses, while also considering factors such as competition and regulation. Corporate Compliance monitors compliance with established procedures and applicable laws that are designed to ensure adherence to generally accepted conduct, ethics and business practices defined in our corporate policies. We provide employee compliance training programs, including information protection, Regulation FD (“Fair Disclosure”) compliance and operational risk. Internal Audit examines the design and operating effectiveness of our operational, compliance and financial reporting internal controls on an ongoing basis.

Our business continuity and disaster recovery plan is monitored by our Business Technology Services Group and establishes the basic principles necessary to ensure emergency response, resumption, restoration and permanent recovery of CFC’s operations and business activities during a business interruption event. Each of our departments is required to develop, exercise, test and maintain business resumption plans for the recovery of business functions and processing resources to minimize disruption for our members and other parties with whom we do business. We conduct disaster recovery exercises periodically that include both the Business Technology Services Group and business areas. The business resumption plans are based on a risk assessment that considers potential losses due to unavailability of service versus the cost of resumption. These plans anticipate a variety of probable scenarios ranging from local to regional crises.

We continue to enhance our crisis management framework to provide additional corporate guidance on the management of and response to significant crises that may have an adverse disruptive impact on our business. The crises identified include, but are not limited to, man-made and natural disasters including infectious disease pandemics, technology disruption and workforce issues. The objectives of the enhancements are to ensure, in the event of an identified crisis, we have well-documented plans in place to protect our employees and the work environment, safeguard CFC’s operations, protect CFC’s brand and reputation and minimize the impact of business disruptions. We conducted a business impact analysis for each identified crisis to assess the potential impact on our business operations, financial performance, technology and staff. The results of the business impact analysis have been utilized to develop management action plans that align business priorities, clarify responsibilities and establish processes and procedures that enable us to respond in a timely, proactive manner and take appropriate actions to manage and mitigate the potential disruptive impact of specified crises.

Our cybersecurity risk-management efforts are a core component of our overall enterprise risk management framework and CFC’s operational risk oversight. We provide more information on our cybersecurity risk management and strategy as well as cybersecurity governance in “Item 1C. Cybersecurity.”