board of trustees compliance committee - nerc committee 2013/botcc... · •finalizing program...

Board of Trustees Compliance Committee August 13, 2014 | 10:00 a.m. – 11:00 a.m. Pacific

The Westin Bayshore1601 Bayshore DriveVancouver, BC V6G 2V4

Reliability Assurance Initiative (RAI) Progress ReportJerry Hedrick, Director of Regional Entity Assurance and OversightSonia Mendonca, Associate General Counsel and Director of EnforcementCompliance Committee Open MeetingAugust 13, 2014

RELIABILITY | ACCOUNTABILITY3

• RAI Project Overview• Progress Report• Compliance Exception Program• Aggregation / Logging Program• RAI Project Timelines• Regional Implementation Update• Joint Regional and Registered Entity RAI Discussions WECC / Tucson Electric SERC / Georgia Transmission Texas RE / ERCOT

Agenda


• Compliance monitoring activities focused on risks to reliability• Enforcement resources focused on noncompliance that poses a

serious and substantial risk to reliability• Continued oversight and visibility• Discretion on whether to initiate an enforcement action to

resolve noncompliance

Overview


Progress Report

• Develop industry and auditor training for risk elements and Inherent Risk Assessment

Resources and Tools

• Finalizing the Inherent Risk Assessment Guide and examples• Developing the Risk Elements methodology and procedures for the IP/AML• Beginning work on the Internal Control Evaluation Guide

Single Compliance Design

• Finalized user guides to support improved self-reporting process• Implemented improved process flow across ERO enterprise• Expanding aggregation/logging and compliance exception programs

Enforcement Processes

• Integrating program design feedback loops and processes• Finalizing program documents for multi-regional registered entities

Compliance and Enforcement Integration


Compliance Exceptions Program

MRO, 14

NPCC, 3

RF, 3

SERC, 4

WECC, 4

Items Closed as of August 1, 2014


Aggregation/Logging Program

Regional Entity Registered Entity Participants as of August 1, 2014MRO Alliant Energy East

Alliant Energy WestNebraska Public Power DistrictMidAmerican Energy CompanyAmerican Transmission Company

NPCC New York Power AuthorityRF American Electric Power (jointly with SPP and TRE)

PJM Interconnection (jointly with SERC)

SERC Associated Electric Cooperative, Inc.

TRE CenterPoint EnergyLuminant EnergyLuminant GenerationLower Colorado River Authority


2015

Compliance and Enforcement Timeline

May 2014 User guides posted; Compliance Exceptions and Aggregation programs reviewed and expanded (throughout 2014)

July 2014 Published the Inherent Risk Assessment Guide for comment

Aug. 2014 Publish the Risk Elements Methodology for the modified Implementation Plan (IP) and Actively Monitored List (AML)Multi-Region Registered Entity (MRRE) program documents finalized (monitoring and enforcement activities)

Sept. 2014 Finalize Inherent Risk Assessment based on industry feedback

July Aug Sep Oct Nov Dec Jan Feb MarJuneMay2014


Compliance and Enforcement Timeline

Oct. 2014 Publish the 2015 IP and AMLDevelop and begin delivering training on completed modules to industry and regional auditorsPublish the Internal Control Evaluation (ICE) and Compliance Monitoring and Evaluation Program (CMEP) Tools Modules

Q4 2014 FERC informational filing submitted Q1 2015 MRRE program implemented

Deploy ICE and Compliance Monitoring Tools

2015

July Aug Sep Oct Nov Dec Jan Feb MarJuneMay2014


• Regional Lessons Learned From the Compliance Pilots Risk Assessment and Scoping Controls Evaluation and Testing Training and Education

• RAI Regional Program Implementation Compliance Activities Enforcement Activities

• Organizational Alignment Creation of Risk teams

Regional Implementation Update

Constance B. White Vice President of Compliance

WECC’s RAI ExperienceNERC Board Presentation

August 13, 2014

12

• IRA (Inherent Risk Assessment) o WECC reviewed TEPC’s compliance and event

history to determine any entity specific risks • ICE (Internal Controls Assessment) focused

on Operations and Planning Standards in the following risk areas: o Configuration Management o Operationso Information Managemento Planning

Tucson Electric Power –Preparation

13

• Sample Question 1: How do you control and manage changes to configuration of protection system devices?

• Controls Reviewed: Maintenance and testing program, systems and tools, interaction between systems

• Result: Risks identified

• Sample Question 2: Explain how you ensure Blackstart Resources are capable of meeting the requirements of its restoration plan

• Controls Reviewed: Annual testing of entity’s two Blackstart Resources, management observes testing, test results are documented and reviewed

• Result: Low Risk

Tucson Electric Power – ICE Example

14

• WECC identified some strong controls • Based on the results, the WECC audit team

customized the audito Removed 7 low risk requirements o Heightened focus on PRC-005 and PRC-008

• WECC plans to significantly reduce TEPC’s 2015 Self Certification

• WECC selected specific TEPC issues for the compliance exception process

Tucson Electric Power – ICE Results

15

• Entities are receptive • Training and education is necessary • Risk-based process is effective but will take

time to develop • WECC refined the processes for another

entity scheduled for audit and is focusing on CIP standards for the Internal Controls Evaluation process

• Additional clarity is needed

Tucson Electric Power – Lessons Learned

Tucson Electric Power Feedback

• Opportunity to allow for open dialogue and to tell/show our compliance “story”

• Opportunity for additional education and discussion on internal controls

• Reduced administrative burden • Suggestion: provide additional clarity of and

context for data requests in future reviews --may facilitate obtaining desired responses from registered entities

RAI Experience at SERCAugust 12, 2014Vancouver, BC

Angie SheffieldVP, General Auditor and Chief Regulatory Compliance Officer

Georgia Transmission Corporation

Scott HenryPresident and CEO

SERC Reliability Corporation

17

• Inherent Risk Assessment– Data collection regarding GTC risks through pre-audit

survey– SERC’s consideration of risks resulted in adjustment of

standards in scope as compared to AML Focus on communication and coordination of operators

due to arrangement of entity with other entities for performance of registered functions

Scope increased by eight Requirements

Pre-Audit Preparation

18

• Internal Controls Evaluation– SERC auditors reviewed GTC’s Independent Audit

Reports (IAR)– SERC accepted GTC’s IAR

For 18 of the 38 requirements in scope, SERC did little to no additional testing

Pre-Audit Preparation

19

• Audit team deemed IAR adequately addressed Standards/Requirements.

• IAR reflected an appropriate level of rigor for SERC staff to draw the same conclusions.

• Audit team determined the IAR was relevant to the audit period.

• Audit team requested minor supplemental evidence.

Independent Auditor Evaluation

20

• Improved focus from prior audit in 2008– Still required same level of effort from GTC– However, more focused on GTC’s inherent risk– Did not duplicate effort by re-testing areas that GTC was

adequately monitoring• Encouraged GTC to continue building its internal

control program and endorsed our focus on self-monitoring

Benefits

21

• Additional communication/collaboration should occur during IRA

• Further training for entity and regional staff is essential– Timing

• Audit should be focused on the “what”• Risk assessment results could be used to scope other

types of compliance monitoring– Self-certifications– Spot-checks

Lessons Learned

22

Curtis Crews, Texas Reliability Entity, Inc.Chuck Manning, Electric Reliability Council of

Texas

RAI within the ERCOT Region

24

ERCOT Audit/Spot Check Experience

● Registered as BA, IA, PC, RC, RP, TOP, TSP 2008 Compliance Violation Investigation 693 2008, 2009, 2010 693 Audit 2009 CIP Spot Check 2010 CIP Audit 2011 FERC, NERC and Texas RE Investigation

(Cold Weather) 2011, 2012 Four 693 Spot Checks 2012 693 Audit 2013 CIP Audit

NERC BOTCCAugust 2014

25

ERCOT 2012 and 2013 Engagements

Attention to high risk areas

Reliability-focused engagements

In-depth review Address risk appropriately

Risk Elementsw/ Key Resources

Risk-Based

Benefits to ERCOTAudit was efficient and focusedBoth teams had the same goal of reliability and securityRecommendations and concerns versus compliance onlyProductive recommendationsCuring period allowed for further dialogue among experts

NERC BOTCCAugust 2014


[email protected]

mailto:[email protected]

Physical Security ImplementationSteven Noess, Associate Director of Standards DevelopmentCompliance Committee MeetingAugust 13, 2014


• CIP-014-1 Purpose: “To identify and protect Transmission stations and Transmission substations, and their associated primary control centers, that if rendered inoperable or damaged as a result of a physical attack could result in widespread instability, uncontrolled separation, or Cascading within an Interconnection.”*

*Note: (“widespread” proposed for removal by FERC in NOPR issued July 17, 2014)

Overview


• Applies to certain Transmission Owners (TOs) and Transmission Operators (TOPs)

• Standard requires owners or operators to: Identify critical facilities on the Bulk-Power System Evaluate threats on those facilities Implement plans to protect critical facilities against those threats

Requirements


All TOs and TOPs (CIP-014-1 not applicable to all)

Applicable TOs who must determine if stations/substations are “critical”

TOs/TOPs with critical facilities (full standard applies)

Tiered Applicability


• Critical facility identification must be verified by third party Directed by FERC order Verifier must be a Planning Coordinator, Transmission Planner, Reliability

Coordinator, or entity with transmission planning experience Verification may recommend addition/subtraction

• Threat evaluation and security plan reviewed by third party Directed by FERC order Reviewer must meet certain experience criteria Review may recommend changes to security plan

Third-Party Verifications/Reviews


• NOPR proposing approval issued July 17, 2014• Forty five-day comment period from federal register

publication, September 22, 2014• NOPR proposes to direct two modifications: Governmental authorities may add or subtract from critical facilities Revise certain wording that may narrow scope (“widespread”)

• NOPR proposes to direct two informational filings: “High Impact” Control Centers (six months of effective date of final rule) Possible resiliency measures, in addition to those required by standard,

following loss of critical facilities (one year of effective date of final rule)

FERC Proposes Approval


• Critical facility identification: complete before effective date (six months following FERC approval) Standard filed with FERC May 23, 2014 NOPR proposing approval (with directives) issued July 17, 2014

• Tiered timeline for balance of requirements (within 15 months)• Training and other coordination Audit and Enforcement Common approaches (Planning Committee, regional groups, etc.)

Implementation


• NERC Board of Trustees directed NERC management to monitor and assess implementation on ongoing basis: Number of assets critical under the standard Defining characteristics of the assets identified as critical Scope of security plans (types of security and resiliency contemplated) Timelines included for implementing security and resiliency measures Industry’s progress in implementing the standard

ERO to Monitor Implementation

Key Compliance Enforcement Metrics and TrendsCompliance Committee Open SessionAugust 13, 2014


ERO Enterprise 2014 Goals—Compliance Enforcement

• Timeliness and transparency of compliance results (caseload index and violation aging)

• Promotion of self-identification of noncompliance

• Timeliness of mitigation • RAI enforcement reforms

2014 Goals


Caseload Index as of July 1, 2014

Target: 7 months Threshold: 8 months

ERO

Enterprise

9.5 months

Regional Entities

8.3 months

NERC

1.2 months

* Excludes violations that are held by appeal, a regulator, or a court.


Caseload Reduction as of July 1, 2014

Target: 0Threshold: 65



Violation Age in the ERO Enterprise



Violation Age in the ERO Enterprise –Inventory by Discovery Year



Promoting Self-Assessment and Identification of Noncompliance

Target: 75%Threshold: 70%


Monitoring Mitigation Completion Pre-2014 Progress

Time frameProgress

toward the goal

Threshold Target

2013 56% 75% 80%

2012 87% 90% 95%

2011 94% 95% 98%2010 and

older 99% 98% 100%


FFT Utilization – ERO Enterprise


FFT Utilization By Regional Entity


Risk Assessment


Trends by Standard in 2013 and Q1 and Q2 2014


Risk Assessment for Top 10 Violated Standards (2013)

board of trustees compliance committee - nerc committee 2013/botcc... · •finalizing program...

Documents