Road Map for Audit Preparation FRCC Compliance Workshops September / October 2008

Initial Questions Do you have an established, formal program for internal compliance? Is it Independent? Is compliance fully supported by senior management? How frequently do you review and modify the compliance program? In addition to training, do you have an ongoing process for auditing compliance? 2

Background In late 2005, FERC adopted the Enforcement Policy Statement -takes into consideration the seriousness of a violation and the efforts a company takes to remedy a violation in a timely manner. Should a violation occur, FERC will look at the following: Was it reported immediately? Did you take immediate steps to remedy the violation? Did you cooperate with FRCC, NERC? How have you responded to a previous wrongdoing? Did you adopt new controls to prevent a recurrence? 3

What should you do to be prepared for an audit? Ask 10 people and you’ll likely get 10 different answers! However, other entities use the following 8 step process to assist them in being fully compliant during their compliance audit. Disclaimer: No guarantees!! 4

Have you reviewed the latest Version 4.0 of the Statement of Compliance Registry Criteria? Describes functions and registry requirements. Have you referred to NERC’s Rules of Procedure section 500 for applicability? – Start with FRCC Compliance Monitoring and Enforcement Program section 2.0 on FRCC website at – Review NERC Compliance Registry (link located on “Compliance” page of FRCC site) to crosscheck the functions for which you are registered. Step #1:Are you Registered for the Correct Functions? 5

Step #2: Review Standards applicable to each Function Are you satisfied that you are registered correctly? If not, contact FRCC staff. Review all standards and all requirements for those functions for which you are registered within FRCC. Identify all tasks associated with meeting the requirements. Does the requirement say “go forth and do good” or is documentation required to meet it? 6

Step #3: Who will be accountable for meeting the requirements of the standards? Will you make a department accountable? Or, will you make a Manager accountable? Maybe even make the specific employee “punching the button” accountable? Recommend a matrix cross-referencing all requirements to the person(s) accountable and cited procedures. NERC keeps a matrix (VRF) on their website that can be modified to fit your needs: 7

Step #4: What Type of Documentation is Required? Does evidence warrant written procedure, methodology, or guideline being developed? Is your current documentation up to date for the requirement? Does it meet the latest version of standard? When was the document created-pre June 18, 2007 or post June 18, 2007? If after June 18, 2007, need to provide what was being used prior to this date (at least back to June 18 th ) for evidence( s, phone logs, EMS data, etc.). 8

Step #5: Consider a Documentation Application It protects documents/evidence from unauthorized edits. Need formal process for making revisions; administrator of the application who is the gatekeeper for all revisions. Recommend it “stamp” version dates on revisions. Need to have query capabilities. Many vendors out there providing this service Make sure you get your money’s worth!! Be sure to know cost for making changes to application! 9

Step #6: Review RSAWs for Applicable Standards I n 2007, the FRCC auditors brought language from the corresponding RSAWs into their audit questions. Review the RSAWs thoroughly for each requirement of each standard and begin developing and preparing evidence. Develop answers for each RSAW and attach specific language from procedures, guidelines, etc. used as evidence directly into an electronic copy of the RSAW. Also provide the name of the document the evidence is being extracted from and reference it in the RSAW. 10

Step #7: Assemble all Documents Have an electronic copy of all procedures referenced and provide to the audit team; Flashdrives are one way of providing large volumes of information. Use the populated RSAWs developed prior to the audit for evidence. Projectors are an excellent means for a SME to show evidence during the audit. Using the projector, show ONLY evidence (excerpts from Procedures) pertaining to requirement and highlight the language. 11

Step #8: Perform “Mock” Audit Prior to Real Audit Have internal team perform mock audit using RSAW questions. Request documentation and evidence necessary for compliance. Plan to present just like a real audit! In mock and real audits, answer the question directly and effectively without “drifting” away from the audit question. Focus on providing evidence on how compliant you are! Provide only the sections of evidence necessary for proof. Cite the name of the procedure on your RSAW. 12

Questions ? For additional information check 13