1. Electric System Financial Results Financial Planning Budget and Rates Building Community Reliability Standard Advisory Service NERC Onsite Visit, Feb 2013 1 RSA Program Purpose: Promote a proactive approach to Reliability Standard compliance Support the industry through the identification of procedures, practices and controls that address reliability risks resulting from noncompliance Leveraging lessons learned to facilitate future Reliability Standards development and creating effective compliance guidance Program Overview: 3-day onsite workshop, facilitated by NERC staff & a regional auditor How to identify Risk Internal Control Development process Utilized process to identify risks and internal controls for PER-005-1

2. Electric System Financial Results Financial Planning Budget and Rates Building Community Reliability Standard Advisory Service NERC Onsite Visit, Feb 2013 2

3. Electric System Financial Results Financial Planning Budget and Rates Building Community COSO Framework 3 Type of Internal Controls: Preventive Controls – stop noncompliance from occurring Designed to discourage errors or prevent irregularities from occurring. They are proactive controls that help prevent a loss. Detective Controls – identify noncompliance after it occurs. Designed to find errors or irregularities after they have occurred Compensating Control – Designed for instances when adequate segregation of duties is not present. Generally require a third party review, occur after an action is complete and takes more resources to investigate and correct errors.

4. Electric System Financial Results Financial Planning Budget and Rates Building Community COSO Framework 4 Preventive Controls Policies and Procedures Training and education Performance reviews Certification requirements Safeguarding assets Segregation of duties Independent compliance function

5. Electric System Financial Results Financial Planning Budget and Rates Building Community COSO Framework 5 Detective Controls Reviews Analyses Variance analyses Reconciliations physical inventories, and audits.

6. Electric System Financial Results Financial Planning Budget and Rates Building Community COSO Framework 6 Compensating Controls Information and communication is key Mock audits Management reporting Event analysis Investigations Root cause analysis

7. Electric System Financial Results Financial Planning Budget and Rates Building Community Reliability Standard Advisory Service NERC Onsite Visit, Feb 2013 7 RSA Exercises, PER-005-1 Risk and IC Exercise Example R1.1 Each Reliability Coordinator, Balancing Authority and Transmission Operator shall create a list of BES company-specific reliability-related tasks performed by its System Operators. RiskFailure to create a Reliability Related Task (RRT) list per the company defined approach IC DesignOwner – Joe Smith Determine type of control – Preventive Control – Program document Ensure E 2, internal control is efficient & effective IC MonitoringAttribute (how test the control) – Program document Frequency – Annually and as needed Method – Program document review, review of Standard revisions and review of work processes Sampling – N/A Output1.Approved RRT list with revision history 2.Approved program document with revision history 3.Operator validation of RRT list

8. Electric System Financial Results Financial Planning Budget and Rates Building Community Reliability Standard Advisory Service NERC Onsite Visit, Feb 2013 8 RSA Exercises, PER-005-1 Risk and IC Exercise Example R1.3 Each Reliability Coordinator, Balancing Authority and Transmission Operator shall deliver the training established in R1.2. RiskFailure to deliver learning objectives and training materials for the Reliability Related Task (RRT) list. IC DesignOwner – Joe Smith Determine type of control – Preventive and detective Control – Identify operators to be trained (preventive), reconcile training records with training plan (detective) and evaluation of trainer/instructor (detective) Ensure E 2, internal control is efficient & effective IC MonitoringAttribute (how test the control) – Training plan & training documents Frequency – Annual (preventive) and quarterly (detective) Method – Document review Sampling – N/A Output1.Training plan & training schedule, includes list of operators that require training 2.Training records 3.Reconciliation/mitigation plan

9. Electric System Financial Results Financial Planning Budget and Rates Building Community How Tests of Internal Controls Could Work? 9 A look forward Document internal control processes Use documentation to understand the control Are controls sound based on COSO? Is internal control designed appropriately? NERC Rewriting RSAWs to include elements of IC Apply audit procedures to identified controls Provides registered entities with incentives to reduce their Control Risk Strong Preventative, Detective and Corrective controls Equals reduced scope of audits, less frequent audits