NATIONAL RURAL UTILITIES COOPERATIVE FINANCE CORP /DC/

Operational risk is the risk of loss arising from inadequate or failed internal processes, people, systems or external events. This risk includes, among other things, unauthorized transactions by employees; reputation risk; talent management risks, including the inability to attract or retain sufficiently qualified employees; errors in loan documentation, transaction processing or technology; failure to perfect liens on collateral; breaches of internal controls or information systems; and fraud by employees or third parties. Operational risk also includes potential legal actions arising from operational deficiencies, noncompliance with covenants in our revolving credit agreements or indentures, employee misconduct or adverse business decisions. A breakdown in internal controls, improper access to or operation of systems, or improper employee conduct could result in financial loss. Operational risk further includes risks associated with technology and information systems, including unauthorized access to confidential or sensitive information and internal or external threats, such as cyberattacks, whether directed at our technology infrastructure or at third-party vendors that store or process confidential or sensitive internal data. In addition, third-party risk is an important component of our operational risk framework and requires the identification, assessment and mitigation of critical risks arising from our relationships with vendors, suppliers, partners, service providers and contractors.

Operational risk is inherent in all business activities. The measurement, assessment and effective management of such risk is important to the achievement of our objectives. Operational risk is a core component of CFC’s Enterprise Risk Management framework and is governed by the CFC Board of Directors while management oversight of the risk is the responsibility of the Chief Risk Officer. We maintain related risk guidelines and limits, business policies and procedures, employee training, an internal control framework, a comprehensive business continuity and disaster recovery plan, as well as a detailed third-party risk management program that are collectively intended to provide a sound operational environment. Our business policies and controls have been designed to manage operational risk at appropriate levels given our financial strength, the business environment and markets in which we operate, and the nature of our businesses, while also considering factors such as competition and regulation. Corporate Compliance monitors compliance with established procedures and applicable laws that are designed to ensure adherence to generally accepted conduct, ethics and business practices defined in our corporate policies. We provide employee compliance training programs, including information protection, Regulation FD (“Fair Disclosure”) compliance and operational risk. Internal Audit examines the design and operating effectiveness of our operational, compliance and financial reporting internal controls on an ongoing basis.

Our business continuity and disaster recovery plan establishes the basic principles necessary to ensure emergency response, resumption, restoration and permanent recovery of CFC’s operations and business activities during a business interruption event. Each of our departments is required to develop, exercise, test and maintain business resumption plans for the recovery of business functions and processing resources to minimize disruption for our members and other parties with whom we do business. We periodically conduct disaster recovery exercises. The business resumption plans are based on a risk assessment that considers potential losses due to unavailability of service versus the cost of resumption. These plans anticipate a variety of probable scenarios ranging from local to regional crises.

We continue to enhance our crisis management framework to provide additional corporate guidance on the management of and response to significant crises that may have an adverse disruptive impact on our business. The crises identified include, but are not limited to, man-made and natural disasters including infectious disease pandemics, technology disruption and workforce issues. The objectives of the enhancements are to ensure, in the event of an identified crisis, we have well-documented plans in place to protect our employees and the work environment, safeguard CFC’s operations, protect CFC’s brand and reputation and minimize the impact of business disruptions. We conducted a business impact analysis for each identified crisis to assess the potential impact on our business operations, financial performance, technology and staff. The results of the business impact analysis have been utilized to develop management action plans that align business priorities, clarify responsibilities and establish processes and procedures that enable us to respond in a timely, proactive manner and take appropriate actions to manage and mitigate the potential disruptive impact of specified crises.

Our cybersecurity risk-management efforts are a core component of our overall enterprise risk management framework and CFC’s operational risk oversight. We provide more information on our cybersecurity risk management and strategy as well as cybersecurity governance in “Item 1C. Cybersecurity.”