NERC Compliance Monitoring and Enforcement Program

1. NERC Compliance Monitoring and Enforcement Program Cherie Broadrick Manager of Regional Compliance Program Oversight

2. NERC Programs FERC NERC Oversight of Regional Implementation Standards Development Compliance Monitoring & Enforcement Organization Registration& Certification Reliability Readiness & Improvement Training & Education ReliabilityAssessment & Performance Situation Awareness & Critical Infrastructure Protection

3. Compliance Enforcement Program Why Do We Need a Compliance Monitoring and Enforcement Program? • Voluntary compliance with reliability rules has proven inadequate • Competitive pressures • New industry participants • Lack of incentive to correct poor performance • Energy Policy Act

4. Compliance Monitoring & Enforcement Program Design • Blue Ribbon Panel • Modeled after otherindustry based self-regulatoryorganizations • Required federal legislation to effectively implement

5. Compliance - Brief History • Started in 1998 • Triggered by the 1996 western blackouts • First administered in 1999 • Increased requirements in program each year • 2003 – Formal stakeholder guidance (Compliance & Certification Committee) • 2004 – Northeast blackout recommendations initiated: • 48-hour reporting • Greater NERC board involvement

6. Policies, Standards, Templates • 1998 – Operating Policies and Planning Standards • Developed Compliance Templates • November 2000 – Low hanging fruit picked • Compliance began to define standard requirements • Need to improve standards • October 2001 – New standards process • April 2005 – Version 0 standards

7. Compliance Monitoring and Enforcement Program The Program So Far • Since its beginning in 1999 • Monitor compliance withsimulated enforcement(WECC exception) • Letters to noncompliant entities • Noncompliance identified corrective actions taken • Quarterly & annual reports developed and posted at www.nerc.com

8. Compliance Program Results

9. Annual Program Description • Actively monitor a sample of the 91 standards (1,000+ requirements) • 2005 - 44 standards (95 requirements) • 2004 - 40 standards (compliance templates) • Some monitored every year • Others periodically • Standards incorporated into regional compliance activities • Regions report violations to NERC

10. Compliance Monitoring & Assessment Compliance Monitoring • Self-certification • Periodic reporting • Exception reporting • Investigations • Random spot checking or audits • Compliance audits • SELF REPORTING

11. Compliance Audits • Apply to all entities responsiblefor complying with standards • Includes balancing authorities, generation owners, and generation operators • Historical • Have requirements been met • Monitor compliance with standards • Confirm self-reporting • May be on-site or table top

12. Regional Programs Today • Implementation Varies • Program legacy • Limited staff • “Member” involvement • Assessments • Audits • Sanctioning • Change will be necessary

13. Compliance and Enforcement - FERC • ERO and regions must have a single audit program for rigorous audit activities • ERO and regions have reporting procedures for prompt reporting • Confidentiality provisions • ERO files summary reports to FERC • ERO or region imposes fair penalties and sanctions • Single ERO appeal process

14. ERO Compliance Program • Basis: • Current compliance processes • Lessons learned during past six years • Processes from other self-regulatory models • 1996 NERC documents – SRRO formation • Bilateral Electric Reliability Oversight Groupprinciples • Legislation • Develop consistent and coordinated compliance enforcement program • Meet requirements of FERC implementing rule

15. ERO CEP – Moving Forward Program Design • NERC oversight role • Audit regional implementation • Measure regional compliance • Report to governmental andregulatory authorities(US, Canada and Mexico) • Regional implementation • Regional entities monitor Registered entities (responsible parties)

16. NERC Rules of Procedure • Promotes consistency, fairness, and accountability in ERO and delegated regional entity compliance activities • Minimizes conflicts of interest among regional activities • Defines role of regional compliance staff • Carry out investigations and audits • Make initial determination of alleged violations • Calculate monetary penalties

17. NERC CMEP Concepts • Accountable to regulators • Must have authority to effectively run the entire program • Independence throughout the program • Transparency in processes and reporting • Due process afforded to all parties • Create consistency and fairness among regional programs • Meet international requirements and obligations • Maintain appropriate confidentiality • Meet antitrust guidelines

18. Three Program Areas – NERC CMEP • Regional Implementation • Regional Entities perform bulk of compliance monitoring via delegation agreement • Oversight of Regional Programs • Ensures regional programs follow principles and delegation agreement • Monitoring of Regional Compliance to Reliability Standards • Monitors compliance to reliability standards that apply solely to regions

19. Requirements of Regional Programs • Governance of the regional entity must exhibit independence • Regional entity must exercise responsibility and authority • No sub-delegation of compliance responsibility or authority • Regional staff independence • Make all noncompliance determinations • Authority to investigate, audit, and impose sanctions • Avoid conflicts of interest

20. Requirements of Regional Entity Implementation • Independent industry experts can participate • Provide technical advice • Provide recommendations • Periodic compliance audits • Regional due process • Region must have a hearing process • Single appeal to NERC

21. Delegation Agreement - FERC • ERO may enter into agreement with region • Regional entity must have: • Independent or balanced stakeholder board • Independence from owners, operators, and users for delegated authorities • Adhere to ERO rules of procedure • Meet delegation agreement objectives • FERC seeks consistency uniformity among regional programs

22. NERC Delegation Agreement • Develop delegation agreement with REs • File agreements with FERC (mid November?) • Most items detailed in the NERC CMEP and the Rules of Procedure with regional deviations noted in the individual delegation agreement. • Work with regions in a “trust, but verify” relationship

23. Regional Delegation • Includes Exhibit D- regional commitment to & deviations from NERC Compliance Monitoring and Enforcement Program • Provides minimum requirements to be included in a regional program • May not achieve uniformity in implementation

24. Uniform Programs • Organization of documents • NERC files Uniform Compliance Monitoring and Enforcement Program • Process flows • Agreed upon high level processes • Working to “drill down” • Audit guidelines • Uniform pre- audit questionnaire • Uniform reporting forms • One training program • Uniform compliance and reporting procedures • Regions must justify program differences

25. Oversight of Regional Programs • ALLalleged violations reported to NERC • NERC reports violationsto FERC or governmental authorities • NERC assesses regional implementation on an ongoing basis & facilitates uniformity • NERC audits regionalentity every three years

26. Monitoring RRO & RE Compliance • NERC directly monitors Regional Entities and Regional Reliability Organizations for compliance to standards • NERC audits regional entity compliance activities every three years • NERC publicly reports findings

27. Compliance Enforcement as ERO • Strong NERC oversight of regional compliance activities • NERC establishes program requirements • Disclosure of violations as established by FERC • Compliance authority applies to all bulk power system owners, operators, and users • Regional implementation uniformity – the goal

28. Violation Risk • Board & FERC • Not all standards are created equal • What is the significance to the grid? • Standards will include two factors • Violation risk factor • Temporal characteristic (this may not be include as part of the standard, but as a stand along item used in the sanctions process

29. Increasing Risk of Cascading, Instability, or Collapse Violation Risk Assessment Lower Risk Factor Administrative or Adequate Time to Mitigate Increased Risk Moderate Risk Factor Increased Risk Degraded System or Ability to Monitor or Restore the System High Risk Factor Potentially Places Electric System at Unacceptable Risk of Failure

30. Reporting and Disclosure • Pre-blackout • Confidentiality, confidentiality,confidentiality • Post blackout • NERC reporting and disclosureguidelines • 48 hour for non-administrative • Quarterly for all confirmed • ERO • Full reporting – alleged and confirmed

31. Penalty and Sanction Process • Regional Entity will assess initial penalty • Registered Entity may contest penalty, sanction or mitigation plan requirement. This contest is at the regional level. • If the Registered Entity is not satisfied with the outcome of the regional contest, it may appeal to ERO. • NERC stakeholder group hears ERO appeal (Compliance & Certification Committee)

32. Penalty and Sanction Process cont. • The appeal is based upon on the record outcome of the original regional contest. (No new information may be entered in the appeal process) • The registered entity may appeal the ERO appeal outcome to FERC or other applicable venue.

33. ERO Issues to be resolved • Regional uniformity • Legacy programs • Understaffing and industry volunteers • Timing of processes • Staff authority and independence • Training • BEROG principles – trained auditors • Competency of the program • Understaffing and industry volunteers • NERC field personnel • Data reporting • Seamless reporting to NERC and FERC

34. Summary • Compliance is tied to approved standards • A subset is selected annually for audit of or reporting by Registered Entities. • Compliance is required for all approved standards, not just those in the annual program • Compliance audits are separate from reliability readiness audits • May audit standards other than those actively monitored • Seek regional uniformity in application

35. Questions

36. Organization Registration

37. Organization Registration Who Must Comply? • Any entity responsible for any part of bulk power system reliability • Historically defined as control areas and reliability coordinators • Functional entities • Aligns reliability requirements with functional unbundling

38. Functional Responsibilities Registered In 2005 Reliability Coordinator Balancing Authority Transmission Operator Generation Operator Generation Owner Transmission Owner Planning Authority Load-Serving Entity Distribution Provider Purchasing- Selling Entity Regional Reliability Organization Reserve Sharing Group Transmission Planner Transmission Service Provider Resource Planner

39. Owners, Operators, and Users • Energy Policy Act: • All owners, operators, and users of the bulk power system shall comply with reliability standards • FERC Rule • All entities subject to the Commission’s reliability jurisdiction… (owners, operators, and users of the bulk power system) shall comply with applicable reliability standards …

40. Entity Registration • FERC requires all owners, operators, and users of the bulk power system in U.S. to: • comply with reliability standards • register with ERO according to ERO rules • provide requested information to regions and ERO • NERC initial registration is underway • Entities will be officially “registered” Notice provided to entity of being place on the compliance registry

41. Organization Registration • Registration process • Entities may register directly • Regions or NERC may add to the registration list • Others may nominate for registration • Entity may challenge being placed on the compliance registry • Must demonstrate why it is not a bulk power system owner, operator, or user

42. Organization Certification • Certain entities with primary reliability responsibilities will be certified • Reliability Coordinators • Balancing Authorities • Transmission Operators • Certification Standards under development • Field test of standard underway • Will require a certification audit

43. Implementation • Transitional Process: • Control Area Certification Procedure • New procedure with certification standards • Use the Existing Control Area Certification Procedures • New entities performing the balancing authority or transmission operator functions • Existing Control Areas • Can receive initial certification as control area • Control area recertification procedures • Readiness audits • Focus on responsibilities identified in reliability standards

44. Roles of the Committees Board Compliance Committee Compliance and Certification Committee Program Results Recommend Board Actions Direct Staff Actions Stakeholder Policy Input Recommend Process Changes to BOT Program Audits Program Effectiveness

45. Questions