A Registered Entities View of an Internal Controls Evaluation › KnowledgeCenter › Workshops ›...
Transcript of A Registered Entities View of an Internal Controls Evaluation › KnowledgeCenter › Workshops ›...
A Registered Entities View of an
Internal Controls Evaluation
STEVEN HUBER
PSEG SERVICES CORPORATION
April 15, 2015
Agenda• Background
• PSEG NERC Compliance Program
• Overview of PSEG Internal Control Program
• Preparation for RF Internal Control Evaluation Program
• Lessons Learned
• Overall Impressions
2
Background• PSEG has a centralized NERC Compliance Organization (NCO)
responsible for the governance and oversight of all PSEG NERC-registered entities (PSE&G, PSEG Fossil, PSEG Nuclear, PSEG Power
Connecticut, PSEG New Haven, and PSEG Power NY)
• The NCO initiated an effort to develop a NERC internal controls program in 2013. At that time, NERC began issuing “White Papers” on the matter, but no formalized internal controls program (ICP) guidance was in place.
• Since NERC did not have any formal guidance at the time, and it was unclear how the Reliability Assurance Initiative (RAI) would progress, PSEG’s developed its (ICP) program to incorporate some basic principals: risk assessment, clear lines of accountability, process adequacy, evidence retention.
• PSE&G volunteered to participate in a ReliabilityFirst (RF) Internal Controls Evaluation in order to assess the strengths and weakness of our ICP.
3
PSEG NERC Compliance Organization
4
PSEG Internal Controls Framework• Includes principals from other internal
control program frameworks (e.g., COSO), but does not strictly adhere to any particular framework. Includes preventive and detective controls, accountability, best practice identification, and documentation adequacy components.
• Rigor is scaled to risk profile. Risk assessment based on factors including:• Inherent risk to BES from system or process
failure.
• Complexity of Standard or compliance processes.
• Extent of documentation required to demonstrate compliance.
• PSEG Internal Assessment Document:• One Page summary for each standard &
requirement
• Used at audit to provide up to date RSAW & evidence
• Internal, management & process controls are listed.
• Sign off after bi-annual assessment by accountable SME and manager.
5
Sample Compliance Documents
6
PSEG NERC SELF - REPORT STATUS
Registered Entity Reporting Date Docket Number/ Password Region Violation ID Standard Discovery Method Brief Description Violation Status NOPV Mitigation Plan Notice of FFT Settlement/Payment Date & Amt.
Date of
last assessment Standard
Date of
last RSAW Req't # Ref # Evidence Document Page # Section #
Document
Date Version
Owner of
Evidence
IRO-001-1.1 R3 3 Delegation of Authority Letter N/A N/A 12/10/2012 N/A Wharton
IRO-001-1.1 R3 4 PJM Manual 1 30 4.2.4 10/12/2011 20 Wharton
IRO-001-1.1 R3 5 PJM Manual 3 7 1.2 12/1/2012 41 Wharton
IRO-001-1.1 R3 6 PJM Manual 37 4 1 6/1/2011 7 Wharton
IRO-001-1.1 R3 7 PJM Operating Agreement 90 11.3 2/6/2012 N/A Wharton
StandardEnforcement
DateActively
MonitoredDescription Function
RSAWdate
Self-certDate
Reporting Period
Periodic Data Submittal
AssessmentDue Date
Self-assessmentCompleted?
AssessmentReceived
LastAudited
CommentsAccountable SME
Owner
Communications
COM-001-1.1 5/13/2009 N TelecommunicationsTOP
*PJM TO/TOP Matrix
Ramtin PourmandJeff Mueller
9/2012 2/28/2013 Y 2/26/201310/2012(TO/LCC)
COM-002-2 6/18/2007 N Communications and CoordinationTOP
*PJM TO/TOP Matrix
Bob GreenRon WhartonJeff Mueller
9/2012 2/28/2013 Y 2/26/201310/2012(TO/LCC)
Critical Infrastructure Protection
CIP-001-2a 10/1/2011 Y Sabotage Reporting TO, LSELeslie MortonJeff Mueller
8/15/2013
Emergency Preparedness and Operations
EOP-001-2.1b 7/1/2013 N Emergency Operations PlanningTOP
*PJM TO/TOP Matrix
Ron WhartonJeff Mueller
2/28/2013 Y 1/30/201310/2012EOP-001-0(TO/LCC)
- RSAW form for v2.1 was not available at time of assessment- v5.1 of PJM TO/TOP was not complete at time of assessment; assigned tasks for new version of standard unknown at time of assessment
Accountability Matrix
Evidence Tracker
Self Report Status
• PSE&G was very interested in participating in an assessment to evaluate how the ICP we developed integrated with the NERC Internal Controls Evaluation Framework.
• We reached out to RF in the late summer of 2014.
• The assessment was conducted during the fall, with and on-site evaluation in early December.
• The process started with a selection of key standards to be evaluated, which we felt had higher risk. We agreed upon 7. (PRC-004, 005, 008,017,023, and FAC-
003, FAC-008).
• At that time we began the process of evaluating our ICP in the context of the GRIPM framework.
7
PSE&G Experience with RF Internal Controls Evaluation
• At first we were
overwhelmed by the
GRIPM framework.
• There was very little
alignment with our ICP.
• RF clarified that we would
be evaluated under four of
the GRIPM elements:• Asset Configuration and
Management
• Grid Maintenance
• Risk Management
• Reliability Quality Management
8
First Impression of the Grid Reliability Improvement and
Performance Model (GRIPM) Framework
Mapping
• Mapped all of GRIPM attribute
areas with existing process
documentation.
• Created spreadsheets with Q&A
sections to provide additional details
on compliance processes for
integration into submittal packages.
• NERC issued RAI guidance in
October 2014, which RF
incorporated into the review. This
was something of a curveball, and
resulted in some additional inquires.
• In order to address those inquires,
PSE&G reassessed some responses
and provided some alternative
compliance artifacts.
Project Management
• Managed ICE as if it were an audit.
• Identified subject matter experts.
• Assigned tasks and deadlines.
• Some SMEs identified outside
normal NERC universe (e.g. Vice
President and Chief Risk Officer for
some Corporate level risk
management processes.
• Created submittal packages
including documentation such as
processes, flow charts and
evidentiary-type compliance artifacts.
9
Preparation for PSE&G’s Internal Control Evaluation
PSE&G prepared for the ICE by developing a project plan while simultaneously mapping the GRIPM elements to elements within PSE&G’s control processes.
Example Mapping Document
10
Observations and Recommendations• PSE&G’s experience with the ReliabilityFirst Internal Controls
Evaluation was extremely positive.
• The process was collaborative and cooperative.
• The GRIPM framework has some valuable attributes, but not all of the elements apply to all of the standards. • Consider using it as something of a tool box. Depending upon the situation and
standard, certain tools (objective and activities in the GRIPM) should be applied. They will vary by standard, and even by registered entity.
• The 5 point assessment scale is good, but could be improved. • During our review, we didn’t get any recommendations on control improvements,
but we did get some overall recommendations.
• NERC might want to separate the assessment of controls from the assessment of some of the other elements of a compliance program (e.g. bench strength for critical positions, clear and unambiguous procedures, etc.)
11
Lessons Learned
• Preparation time was substantial, but not of the magnitude
required for a standard 693-audit.
• Needed to consider “best practices” and other processes which
are outside the “four corners” of our compliance program.
• Since the ICE was voluntary, convincing the subject matter
experts and Line-of-Business management that the time required
to prepare for the endeavor took some effort.
• PSE&G feels that the process was extremely valuable, and we
would recommend it to others.
• It provided us with insight into how RF views the control environment and gave
us some ideas on how to improve our ICP.
• It was a factor in the scoping of our upcoming 693 audit, and resulted in a
significant reduction in audit scope.
• It has provided us with an opportunity to obtain self-logging privileges.
12
13