1. Compliance Monitoring Strategy/Schedule Kim Israelsson Manager, Compliance Program Coordination and Process Integration

2. Overview What is the Compliance Monitoring Strategy? Will WECC require Inherent Risk Assessments (IRA) for all 2016 on-site audits? Will WECC continue to conduct Internal Controls Evaluation (ICE) in conjunction with 2016 on-site audits? What does the implementation of the Risk-Based Concepts mean to my Entity? How and when will my Entity be notified of upcoming monitoring activities? 2 W ESTERN E LECTRICITY C OORDINATING C OUNCIL

3. Compliance Monitoring Strategy What is the Compliance Monitoring Strategy (CMS)? – Process by which WECC develops the strategy and schedule using the Risk-Based Concepts to the Compliance Monitoring Schedule: Registration Compliance History Assets Events Geography Interconnectivity 3 W ESTERN E LECTRICITY C OORDINATING C OUNCIL

4. Compliance Monitoring Schedule WECC will identify which Registered Entities are subject to compliance monitoring activities (including Inherent Risk Assessment ) in a given year based on NERC IRA Guidance : Provides flexibility to address – Changes in Risk to the BPS – New Risk to the BPS – Changes in Registration – New Registration(s) 4 W ESTERN E LECTRICITY C OORDINATING C OUNCIL

5. Inherent Risk Assessment (IRA) Will WECC require Inherent Risk Assessments for all 2016 on-site audits? – Yes, however WECC may extend requests to entities outside the audit schedule to participate in an IRA 5 W ESTERN E LECTRICITY C OORDINATING C OUNCIL

6. Internal Control Evaluation (ICE) Will WECC continue to conduct Internal Controls Evaluation (ICE) in conjunction with 2016 on-site audits – No, starting in 2016 the ICE process will be independent of the audit schedule 6 W ESTERN E LECTRICITY C OORDINATING C OUNCIL

7. What does this mean to my Entity? WECC will use the Risk-Based concepts to develop a monitoring plan specific to your entity Provides a platform for WECC to fully understand your entity and your operation Increased transparency Provides opportunity to engage in meaningful dialogue 7 W ESTERN E LECTRICITY C OORDINATING C OUNCIL

8. How/when will my Entity be notified of an upcoming monitoring activities? WECC will post the Annual Audit Schedule the first business day in August – Entities identified in the Annual Audit Schedule will be notified of impending IRA and/or audit deadlines approximately 280 days prior to start of audit engagement 8 W ESTERN E LECTRICITY C OORDINATING C OUNCIL

9. References WECC encourages Registered Entities to review the following NERC Guidance materials: ERO Enterprise Inherent Risk Assessment Guide – http://www.nerc.com/pa/comp/Reliability%20Assurance%20Initiative/ERO_E nterprise_Inherent_Risk_Assessment_Guide_20141010.pdf http://www.nerc.com/pa/comp/Reliability%20Assurance%20Initiative/ERO_E nterprise_Inherent_Risk_Assessment_Guide_20141010.pdf Overview of ERO Enterprise’s Risk-Based Compliance Monitoring and Enforcement Program – http://www.nerc.com/pa/comp/Reliability%20Assurance%20Initiative/Overvie w%20of%20the%20ERO%20Enterprise%E2%80%99s%20Risk- Based%20CMEP.pdf http://www.nerc.com/pa/comp/Reliability%20Assurance%20Initiative/Overvie w%20of%20the%20ERO%20Enterprise%E2%80%99s%20Risk- Based%20CMEP.pdf 2015 ERO Compliance Monitoring and Enforcement Implementation Plan – http://www.nerc.com/pa/comp/Reliability%20Assurance%20Initiative/Final_2 015%20CMEP%20IP_V_1.1%20%28Posted_05052015%29.pdf http://www.nerc.com/pa/comp/Reliability%20Assurance%20Initiative/Final_2 015%20CMEP%20IP_V_1.1%20%28Posted_05052015%29.pdf 9 W ESTERN E LECTRICITY C OORDINATING C OUNCIL

10. Questions W ESTERN E LECTRICITY C OORDINATING C OUNCIL 10 Kim Israelsson 801.819.7613 kisraelsson@wecc.biz REoversight@wecc.biz