Self-Logging Minimal Risk Instances of Noncompliance

Transcription

1 Minimal Risk Instances of Noncompliance October 1, 2017 Version 1 RAM Bayport Drive, Suite 600 Tampa, Florida (813) Phone (813) Fax

2

3 Table of Contents Page 3 of 13 Page 1.0 Purpose and Scope Purpose Scope Responsibilities Procedure Owner Procedure Entity Request for Entry into Program Determining an Entity s Eligibility for the Program Required Training for the Program Process at the Entity Creation and Maintenance of the Logs and Evidence Supporting Mitigation Appropriate Candidates for the Logs: Minimal Risk Noncompliances Submittal of the Logs and Logging Procedure to FRCC FRCC Evaluation of the Log FRCC s Treatment of Logged Instances of Noncompliance Revocation of Privileges Annual Review of Privileges Reference Section NERC Rules of Procedure - Appendix 4C Compliance Monitoring and Enforcement Program document NERC Rules of Procedure document Appendix A High Level Process Overview... 13

4 1.0 Purpose and Scope 1.1 Purpose Page 4 of This document establishes the procedure that FRCC will follow to implement its self-logging program for minimal risk instances of noncompliance This procedure includes the following four key components: Establishes the criteria for determining a Registered Entity s (Entity s) eligibility for the self-logging program. Establishes the training requirements for an Entity that has qualified for the self-logging program. Establishes the procedure for an Entity to self-log minimal risk instances of noncompliance with an approved set of selected Reliability Standards and requirements. Establishes how FRCC will review an Entity s self-logging process and how FRCC will review and treat logged instances of noncompliance. 1.2 Scope This procedure identifies the Risk Assessment and Mitigation (RAM) Staff process for granting self-logging privileges to Entities within the Region and RAM Staff s processing of minimal risk noncompliance identified through entity self-logging programs. 2.0 Responsibilities 2.1 Procedure Owner This procedure is the responsibility of the FRCC Manager of Risk Assessment and Mitigation (RAM) to maintain as necessary to keep the procedure current with the latest North American Electric Reliability Corporation (NERC) Rules of Procedure - Compliance Monitoring and Enforcement Program Appendix 4C and established FRCC procedures The review of this procedure will be performed when changes to departmental or NERC Rules of Procedure occur and have a potential impact to this processing. In addition, a review will be performed at least once every three (3) years from the last update. The review shall be documented in the Review/Modification section of this document.

5 Page 5 of The FRCC Manager of Risk Assessment and Mitigation is responsible for assigning related activities to the RAM Staff. RAM Staff will involve other FRCC Compliance groups in all activities referenced in this procedure This procedure will be approved by the FRCC Manager of Risk Assessment and Mitigation, the FRCC Director of Enforcement, Risk Assessment and Mitigation, and the Vice President of Compliance, Enforcement and Reliability Performance.

6 3.0 Procedure Page 6 of Entity Request for Entry into Program is a process whereby Entities may aggregate recurring minimal risk violations of the NERC Reliability Standards and report them to the FRCC on a quarterly basis An Entity may obtain the FRCC Request to Participate in the Program form from the FRCC website The Entity shall complete the contact information on the form and provide details regarding the standards requested. The choices include all applicable standards, all CIP standards, all O&P standards, or a set of specific standards Within thirty days after receiving the Entity s Request to Participate in the Program form, a member of the RAM Staff will provide the Entity with the Program Eligibility Determination form (eligibility form). This completed form will aid the RAM Staff in evaluating the registered Entity s ability to identify, assess and correct noncompliances and the consideration of other factors The RAM Staff will analyze the data, provide professional judgement, and develop a preliminary determination to present to the FRCC Enforcement, Risk Assessment and Mitigation group for a final determination of the Entity s eligibility for self-logging privileges. 3.2 Determining an Entity s Eligibility for the Program Evaluation Within sixty days of receiving the completed eligibility form and supporting data, the evaluation for privileges will be conducted through the review of information related to the processes the Entity has in place to identify, assess, and correct noncompliance(s). In order for the RAM Staff to ensure that it has a sufficient basis upon which to grant the presumption of compliance exception treatment for self-logged minimal risk noncompliances, an Entity must demonstrate that it has sufficiently institutionalized processes in place to identify, categorize, prioritize and mitigate risks to reliability and perform corrective and preventative actions (including root cause analyses and problem solving), and has demonstrated the ability to correctly determine risk level of a noncompliance.

7 Page 7 of Inquiry The inquiry into these processes is scaled by an Entity s risk profile. The evaluation will include document and data review and interviews with Entity management and staff, as necessary Relevant Factors RAM Staff will also consider other relevant factors when determining an Entity s eligibility for self-logging, including, but not limited to: The Entity s compliance history; The Entity s history of self-assessment and self-reporting possible violations; The Entity s history of mitigating noncompliance in a timely and thorough manner; The Entity s level of cooperation with FRCC in prior compliance matters; The quality of the Entity s internal compliance program; Internal controls evaluations, while not a prerequisite for eligibility, may help to inform RAM Staff s decision; and Whether the Entity has ever intentionally violated a Reliability Standard, failed to comply with a compliance directive or attempted to conceal a violation Notice Within fifteen days of the completion of the evaluation outlined above, RAM Staff will call the Entity to explain the results of the analysis and then issue written notice regarding: whether the Entity qualifies for self-logging privileges; the basis for RAM Staff s decision; and the Reliability Standard requirements for which the Entity has been granted self-logging privileges.

8 3.2.5 Future Qualification Page 8 of 13 If the Entity does not qualify for self-logging privileges for all or part of the Reliability Standards, RAM Staff will provide the Entity with recommendations for how to achieve eligibility in the future. 3.3 Required Training for the Program Training Once an Entity has been approved to participate in the Program, RAM Staff will provide training on the self-logging program that will aid in understanding and selecting the appropriate risk category, and in the development of risk statements appropriately describing the noncompliance and its associated risk to the Bulk Electric System (BES). RAM Staff may choose to conduct the training at the Entity s facility, use WebEx or some other agreed upon method before the agreed upon start date for. 3.4 Process at the Entity Creation of a Procedure RAM Staff will ensure the Entity has developed a self-logging procedure to govern the creation, maintenance and submittal of logs. This procedure will include, at a minimum: The process to identify and assess noncompliances that are eligible for self-logging; The process to obtain, record, update and review information regarding the logged noncompliances; The process to ensure the prompt mitigation of all instances of noncompliance and that the actions are properly recorded on the logs; The process to maintain evidence supporting mitigation of the logged noncompliances; and The process to submit the log(s) to FRCC. 3.5 Creation and Maintenance of the Logs and Evidence Supporting Mitigation RAM Staff will provide the Entity with a spreadsheet template to log the appropriate minimal risk noncompliances. If an Entity has been granted

9 Page 9 of 13 self-logging privileges for both O&P and CIP Reliability Standards, it will be instructed to keep separate logs for each The information the Entity will record on the log is the same information it would record in a Self-Report (Name, NERC Compliance Registry (NCR) number, Method of Discovery, Standard and Requirement, Description of the Noncompliance, Description of the Risk Assessment, and Description and Status of Mitigation Activities) The Entity will maintain evidence to support its completion of mitigating activities for each instance of noncompliance recorded on the log for 18 months from the date the Notice of Compliance Exception treatment for the noncompliance is sent or until FRCC verifies completion of the mitigating activities, whichever is later. 3.6 Appropriate Candidates for the Logs: Minimal Risk Noncompliances Instances of noncompliance that pose a minimal risk to the reliability of the BES are appropriate candidates for self-logging. The Entity s risk determination must consider, when applicable: The timeliness of detection; The method of detection (e.g., whether detection is the result of effective execution of internal controls); Actions or processes in place during the instance of noncompliance that mitigated or aggravated the risk; The timeliness and effectiveness of mitigation; Whether there are additional potential instances of noncompliance related to or indicative of the same or similar root cause underlying the instance of noncompliance; Whether the noncompliance is limited to an administrative or documentation error; The size and interconnectedness of the Entity; The location or asset implicated by the noncompliance; and The occurrence and/or likelihood of occurrence of any harm to the BES.

10 Page 10 of Submittal of the Logs and Logging Procedure to FRCC Every three (3) months from when self-logging privileges begin (i.e., three months after the Entity has completed the requisite training described in Section 3.3), the Entity will submit a copy of the log to FRCC for review and approval via the FRCC secure data transfer process. The Entity shall submit a log even if there are no instances of noncomplinance during the quarter. 3.8 FRCC Evaluation of the Log Evaluation RAM Staff will evaluate the submitted log for clarity and sufficiency to ensure that it contains the attributes described in Section 3.6. If RAM Staff determines that the log data is insufficient, RAM Staff will work with the Entity to address any deficiencies. RAM Staff s evaluation will include a determination of whether: The logged noncompliance is sufficiently described; The minimal risk determination is justified and reasonable; and The mitigating activities for the noncompliance are appropriate and adequate. RAM Staff will evaluate the Entity s risk assessment for each logged instance of noncompliance to ensure that there are no instances of noncompliance on the logs that pose a moderate or serious and substantial risk to reliability. RAM Staff will verify that the Entity has mitigated or will mitigate all logged instances of noncompliance through periodic random sampling or spot check of evidence supporting mitigation. If there is a question or deficiency with the Entity s self-log information or the Entity s risk assessment or mitigation activities, the RAM Staff will contact the Entity for additional information and advise of required change of Entity s approach as appropriate. 3.9 FRCC s Treatment of Logged Instances of Noncompliance When the Log Submission is Deemed Sufficient If RAM Staff concludes that the Entity s logged instances of noncompliance are sufficiently described, reasonably and justifiably assessed as minimal risk, RAM Staff will collaborate with FRCC Enforcement to process the logged instances of noncompliance as Compliance Exceptions into the

11 Page 11 of 13 FRCC Compliance Information Tracking System (CITS) database and notify the Entity of the associated identification number for each of the logged instances of noncompliance. The Entity will then record that number in a corresponding column on their copy of the log When the Log Submission is Deemed Insufficient If RAM Staff, in collaboration with Enforcement, concludes that any of the Entity s logged instances of noncompliance are insufficient due to unclear or missing information, inappropriate risk determinations, or inadequate mitigation (e.g., recurring instances of noncompliance stemming from the same or substantially similar root cause), RAM Staff may, at its discretion: Work with the Entity to correct the unsatisfactory log entries prospectively, and/or Modify or revoke self-logging privileges going forward, depending on the facts and circumstances Written notice to entity The FRCC Enforcement Staff will send written notice to the Entity that their self-log of noncompliance has been reviewed and advise the Entity as to which disposition method will be pursued by FRCC Revocation of Privileges Where there is evidence that the Entity failed to make a good faith effort to accurately record logged instances of noncompliance, then FRCC may revoke self-logging privileges, and may process the logged instance(s) of noncompliance as formal Enforcement actions. For example, the Entity knew or should have known that it mischaracterized a logged instance of noncompliance as posing a lesser risk in order to qualify it for selflogging If the Entity knew or should have known that it approved clearly inadequate mitigating activities that could not reasonably be expected to correct and/or prevent recurrence of the logged instance of noncompliance, the FRCC may revoke self-logging privileges, and may process the logged instance(s) of noncompliance as formal Enforcement actions If a monitoring engagement discovers instances of noncompliance for an approved self-logging requirement, FRCC may revoke self-logging privileges If FRCC revokes self-logging privileges, RAM Staff will inform the Entity of the basis for that decision and what actions, if any, the Entity must take in order to have self-logging privileges reinstated.

12 Page 12 of Annual Review of Privileges On the Entity s self-logging anniversary date, RAM Staff will assess the Entity s eligibility to continue self-logging minimal risk instances of noncompliance. 4.0 Reference Section 4.1 NERC Rules of Procedure - Appendix 4C Compliance Monitoring and Enforcement Program document. 4.2 NERC Rules of Procedure document.

13 FRCC-RAM-200 Possible Noncompliance Review Processing Page 13 of Appendix A High Level Process Overview FRCC Self Logging Program Process Flow Entity Submits Request to Participate in the Self Logging Program form Stop RAM Registered Entity Registered entity completes Self Logging Eligibility Determination form and returns to RAM SPOC RAM SPOC provides registered entity with Self Logging program Eligibility Determination form RAM SPOC evaluates registered entity s responses. RAM Group may have face to face meeting for better clarification Eligible? YES YES NO Future Qualification RAM SPOC prepares eligibility acceptance letter and sends to entity 3.3 Registered Entity completes Self Logging Training 3.3 RAM Group provides Self Logging Training to registered entity Registered entity creates Self Logging Procedure Registered entity submits Logs to FRCC 3.8 RAM SPOC evaluates Logs for pertinent detail RAM SPOC will work with registered entity to correct unsatisfactory log(s) RAM SPOC contacts registered entity to discuss insufficient logs Registered entity records FRCC/ NERC violation Id into corresponding column in log. STOP YES RAM and Enforcement Teams pre screen registered entity for viable candidacy into program NO RAM SPOC notifies registered entity of ineligibility NO RAM SPOC prepares Non eligibility letter and sends to entity RAM SPOC enters log information into CTS as Self Report NO 3.11 Annual Review on Entity s selflogging anniversary date, RAM & Enforcement staff will assess Entity s eligibility to continue selflogging. Enforcement Enforcement and RAM groups consult to determine registered entity s eligibility Enforcement group evaluates violations and provides entity with disposition Logs Sufficient YES