Spot Check Procedure

Transcription

1 August 16, 2017 Version 4.0 MON Bayport Drive, Suite 600 Tampa, Florida (813) Phone (813) Fax

2

3 Page 2 of 10 TITLE NAME DATE Procedure Writer Manager CIP Monitoring Renny Ramai 8/16/17 Approval Authority VP of Compliance, Enforcement & Reliability Performance Linda Campbell Date Version Number MODIFICATION LOG Description of Change Originator Pages Affected 12/30/10 0 New Document J. Dodge All Change to section and Reference Section J. Dodge 8/12/ and /15/ Re-write to meet current CMEP J. Dodge All 1/23/ Annual review minor edits made J. Dodge All 10/15/ Annual review R.Ramai All 02/22/ Annual review added COPs R.Ramai All 8/16/ Review Added internal controls and general edits R Ramai All Effective Date August 16, 2017 Responsible Department - Compliance Next Periodic Review Date 8/2020 Classification - Public

4 Table of Contents Page 3 of 10 Page 1.0 PURPOSE Purpose Definitions Scope Responsibilities FRCC Compliance Staff Spot Check Observers (NERC/FERC) and Other Attendees Procedure Steps Spot Check - Planning/Scheduling Entity Evidence Return Notice period Review Exit Presentation: Spot Check Report Recordkeeping Spot Check Evidence Retention Post Spot Check Feedback and Lessons Learned Post Spot Check Feedback Lessons Learned Reference Section NERC Compliance Monitoring and Enforcement Program document ERO NERC Annual Implementation Plan, FRCC Appendix A... 10

5 1.0 PURPOSE 1.1 Purpose Page 4 of 10 The purpose of this procedure is to define the steps required to plan and execute a Spot Check (scheduled and unscheduled). All Registered Entities (Entities) in the Florida Reliability Coordinating Council, Inc. (FRCC) footprint may be subject to a Spot Check for compliance with all Federal Energy Regulatory Commission (FERC) approved mandatory and enforceable Reliability Standards applicable to the functions for which the Registered Entity is registered. [This procedure augments Section 3.3 of the North American Electric Reliability Corporation (NERC) Appendix 4C to the Rules of Procedure (RoP), Compliance Monitoring and Enforcement Program (CMEP)] effective May 4, Definitions Capitalized terms used in this procedure shall have the meanings set forth in Appendix 2 of the NERC Rules of Procedure. 1.3 Scope Spot Checks will be conducted by the FRCC Monitoring staff. A Spot Check may be initiated at the discretion of the FRCC Compliance Staff or as directed by NERC at any time to verify or confirm Self-Certifications, Self-Reports or Periodic Data Submittals. In addition, a Spot Check may be random or may be initiated in response to events, as described in the Reliability Standards, or to operating problems, system events, or as identified in Entity s Compliance Oversight Plan (COP). Based on the facts and circumstances, Spot Checks may be limited in scope and can be a single requirement or a few related requirements. The Spot Check may be included in the annual schedule and may not include an on-site visit. A Spot Check may be used as part of a more comprehensive COP based on the results of an Inherent Risk Assessment (IRA), Internals Controls Evaluation (ICE) or after completion of the Compliance Assessment related to an event. 2.0 Responsibilities 2.1 FRCC Compliance Staff The VP of Compliance, Enforcement & Reliability Performance is responsible for ensuring this procedure is updated to the current CMEP Appendix 4C Rules of Procedure The FRCC Managers of Critical Infrastructure Protection (CIP) and Operations and Planning (O&P) Monitoring are collectively referred to in this procedure as Managers of Compliance Monitoring (MCM).

6 The MCM has the overall responsibility to: Page 5 of 10 Maintain this procedure with current NERC RoP CMEP Appendix 4C and established FRCC procedures Review document at least once every three (3) years from the last update Ensure the steps of this procedure are followed, and determine when a Spot Check is required Spot Check Team Lead (SCTL) Ensure the steps of this procedure are followed for his/her assigned Spot Check Ensure the professional behavior of compliance auditors, the effective evaluation of the facts and circumstances and the preparation of the Spot Check report Seek administrative resources, for audit efficiency, prior to and during the Spot Check from the respective MCM Ensure all forms, letters and presentations are customized, prepared and created prior to the first day of the Spot Check Spot Check Team Member Adhere to this Spot Check procedure Be free of any conflict of interests Comply with the NERC Antitrust Compliance Guidelines and sign confidentiality agreement or acknowledgement that the confidentiality agreement signed by the Compliance Enforcement Authority is applicable Complete all required NERC or NERC-approved Regional Entity auditor training 2.2 Spot Check Observers (NERC/FERC) Any member of NERC staff, Regional Entity Compliance Staff, Compliance Staff of other Regional Entity or representative of FERC who are not Spot Check team members identified in pursuant to Section of the NERC CMEP are considered an observer

7 Page 6 of 10 Must comply with the NERC Antitrust Compliance Guidelines and shall have signed confidentiality agreement or acknowledgement that the confidentiality agreement signed by the Compliance Enforcement Authority is applicable FERC staff observers may be present to assess the performance of the FRCC Compliance Staff and evaluate NERC s oversight role Observers can discuss with the SCTL issues arising during the Spot Check that are within the scope of the Spot Check. They do not participate in making Spot Check findings and determinations 3.0 Procedure Steps 3.1 Spot Check - Planning/Scheduling Once a Spot Check has been identified as described in Section 1.3, the FRCC Compliance Program Administrator (Administrator) and the SCTL will prepare and send a Spot Check notification letter and data request to the Entity as well as the scope of the Spot Check including the Reliability Standard Requirement(s) that will be covered The Spot Check data request will consist of requests for information that specifically apply to the Reliability Standard Requirement(s) selected. If the Reliability Standard Requirement does not specify any notice period, any information request made by the FRCC will allow at least twenty (20) days for the information to be available for review. 3.2 Entity Evidence Return The Entity will need to return the requested information in the format indicated by the required date If documents, data, information or other reports to determine compliance requested from an Entity are not received by the required date, the FRCC Compliance Staff may execute the steps described in Attachment 1, Process of Non-Submittal of Requested Data of the CMEP. 3.3 Notice period FRCC will notify the Registered Entity of the names and employment histories of the persons who will be conducting the Spot Check, such as the SCTL, the team members and any observers The Registered Entity may object to the inclusion of any individual on the Spot Check team in accordance with Section of the CMEP.

8 Page 7 of Review Any such objections must be submitted to the FRCC by the later of (i) five (5) business days before the information being requested by the FRCC is submitted and (ii) five (5) business days after the Registered Entity is notified of the persons on the Spot Check team Nothing in this procedure shall be read to limit the participation of NERC or FERC staff in a Spot Check of an Entity, or involving a portion of the Bulk Power System, over which FERC has jurisdiction The Spot Check Team will review the information submitted to determine compliance with the Reliability Standard Requirement(s) and may request additional data The team will utilize the NERC Reliability Standard Audit Worksheet(s) (RSAWs) for documenting any findings and any internal controls observed during the spot check. The RSAW documentation for all potential noncompliance shall include: Condition: The situation that exits degree and extent of compliance with the Criteria Cause: Reason or explanation for the condition Effect or potential effect: Clear logical link to establish impact actual potential risk to BPS because of Condition A synopsis of the relevance of the evidence reviewed The RSAW may also include internal controls documentation such as, but not limited to the following: Description of the type of controls in place Evaluation of the effectiveness of the internal control design to achieve the goals of the function and the control objectives Is the control functioning as intended? Testing whether control activities are being followed Is the control able to support reliability and maintain sustainable compliance?

9 3.5 Exit Presentation: Page 8 of 10 The SCTL shall: Conduct an exit presentation using the FRCC approved template Enter any potential non-compliance into the FRCC Compliance Issues Tracking System (CITS) within two (2) days of the Exit Presentation Conduct a meeting with Risk Assessment and Mitigation and Enforcement staff to review potential noncompliance and any additional relevant information that substantiates the basis for the potential noncompliance and explains the risk to the BPS. 3.6 Spot Check Report The Spot Check team member which is assigned the responsibility of drafting the Spot Check report will draft the report, provide to the Spot Check team members for their review and comment and submit the final draft to the SCTL The SCTL will submit the final draft Spot Check report to the respective MCM for a consistency review The SCTL notifies the Administrator that the final draft report has been approved by the MCM and is ready for posting to the Entities secure transfer folder The Administrator notifies the Entity of the posted final draft Spot Check report and advises the Entity of their ten (10) business days to comment on the draft report (Section of CMEP dated May 4, 2016). The findings of the Spot Check will not be changed or modified The Spot Check team considers any corrections based on the Entity s comments, finalizes the Spot Check report and submits the final Spot Check report to the MCM for final review and approval The Administrator provides the final non-public report to the Entity via their secure transfer folder and to NERC via their secure folder. NERC will provide the report to FERC; however, it will not be publicly posted If FRCC Compliance staff concludes that a reasonable basis exists for a possible noncompliance of a Reliability Standard Requirement has occurred, it shall conduct a Preliminary Screen pursuant to Section 3.8 of the CMEP.

10 Page 9 of Recordkeeping FRCC will notify NERC of any possible noncompliance as required by Section 8.0 of the CMEP. 4.1 Spot Check Evidence Retention FRCC will maintain all relevant Spot Check information and Entity evidence, in electronic format, if possible, for a period of five (5) years from the commencement of the Spot Check process that produces the data or information as required by Section 9.2 of the CMEP. 5.0 Post Spot Check Feedback and Lessons Learned 5.1 Post Spot Check Feedback NERC has automated its post-audit/spot check-feedback survey response and analysis using vendor software called Survey Monkey and has centralized the feedback process to enhance survey data collection. NERC will use the data to conduct analyses on satisfaction level of the Entity, usability of risk-based CMEP approach and to generate NERC Compliance Assurance quarterly metrics. Effective June 8, 2015, during the Exit Briefing, the SCTL will provide the following survey link to the Entity s primary compliance contact: There are four sections of the survey: Audit/Spot Check Information (Mandatory Information) Pre-Audit (Audit Planning Stage) Audit Implementation (Fieldwork Stage) Post-Audit (Reporting Stage) The MCM will be able to view the survey responses and export the results to other formats such as excel and word, (pdf is currently not available through the shared link). The MCM will provide a snapshot of the survey results to the SCTL and Spot Check Team The MCM will review the comments provided on the survey and will discuss with the Spot Check Team of any improvements required and follow-up activities.

11 5.2 Lessons Learned Page 10 of The SCTL is responsible for collecting and obtaining any lessons learned comments from the Spot Check Team members The SCTL will schedule a meeting with all Team members and the MCMs to discuss any lessons learned to be evaluated for improvements to the FRCC Spot Check process The MCM is responsible for assigning staff to implement any identified improvements to the FRCC Spot Check procedure or processes The MCM is responsible for verifying that any identified improvements to the FRCC Spot Check procedure or processes have been implemented. 6.0 Reference Section NERC Compliance Monitoring and Enforcement Program document. ERO NERC Annual Implementation Plan, FRCC Appendix A