Internal Controls Assessment Ruchi Shah Director, Risk Assessment & Mitigation & Deb McEndaffer Director, Compliance Monitoring

Agenda Internal controls assessment framework Benefits of Internal Controls Internal Controls Evaluation (ICE) process & Timelines New Initiative for Internal Controls Expectations regarding Internal Controls during audit Internal Controls at audit without ICE Frequently Asked Questions

Internal Controls Assessment Framework

Benefits of Internal Controls Helps identify the gaps in the existing process. WECC gets reasonable assurance of future compliance. Helps determine frequency of monitoring and the type of monitoring. Less Area of Concern and more recommendation for further strengthening the controls.

ICE Process & Timelines RAM accepts the request RAM identifies the scope of ICE 150 days prior to the audit Entity provides Internal Controls summary 120 days prior to audit RAM performs design review of Internal Controls 30 days prior to audit Audit team performs implementation review. During Audit RAM drafts the report and shares with the Entity 60 days after the audit WECC Finalizes the Report 30 days after entity comments

Expectation from Entity During Internal Controls summary submission Provide summary of Risk and Controls for Standard and Requirement in scope of ICE Provide general controls to explain you Internal Controls Program During Design Review Allow your SMEs responsible for control design to participate during phone conversation Be prepared to share/show support documentation that describes the control design in detail

Expectation from Entity During Implementation Review Interviews with SMEs to verify the implementation of designed controls Occasional walkthroughs to check for automated controls During Draft report Review If there is additional detail that was not discussed/requested, please provide that Focus on the considerations provided for future improvements

New Initiative for Internal Controls

New Initiative for Internal Controls Internal controls practice group

Highlights – Internal controls practice group Purpose Serve as an industry platform to have WECC and industry thought leaders share good practices regarding development and sustainability of internal controls program, specifically for the NERC Reliability Standards. Targeted outreach specific to Internal Controls SME participation and peer share Hosted quarterly (depending on participation)

Highlights – Internal controls practice group Key Objectives To facilitate/offer specific guidance on the implementation of Internal Controls Program. To increase industry knowledge of the NERC Internal Controls Guide To build a common understanding of Internal Controls terminology To build a catalogue of industry good practices of internal controls suitable to reduce operational risk

Expectations of Internal Controls during audit Required by GAGAS Since it is possible for an entity to be compliant with the Standards and requirements without the implementation of effective internal controls, there will not be any non-compliance if an entity fails to show implementation of the designed controls.

Internal Controls at Audit without ICE Auditors may conduct interviews, walk throughs or ask for specific documentation to check the implementation of controls when there is an Area of Concern (AoC). The objective is to understand if the controls will help you ensure you meet your compliance objectives or what recommendations to make. Likewise if strong internal controls are demonstrated to be repeatable and sustainable they could be considered in future COP.

FAQ Why was I audited on a particular Standard and Requirement even though WECC informed me that I had strong internal controls? High Inherent Risk Changes to the Standard and Requirement Reginal Risk identified for that Standard and Requirement Why does audit team ask about internal controls if I did not volunteer for ICE? GAGAS. To determine if there are areas they could make recommendation in for better reliability or security. To learn best practices that can be shared with other WECC Entities and reinforced your good practices.

Ruchi Shah Ph: 801-883-6881 rshah@wecc.biz Thank You Ruchi Shah Ph: 801-883-6881 rshah@wecc.biz Deb McEndaffer Ph: 801-819-7699 dmcendaffer@wecc.biz