2012 SERC CMEP Implementation Plan - SERC Home Page

Section 5: 2012 CMEP Discovery Methods2012 CMEP Discovery Methods1. Compliance Auditsa. Audit ScopeAll FERC-approved Reliability Standards applicable to the Registered Entity based onregistered functions are subject to audit. The default scope of review for compliance auditsconducted by SERC in 2012 will consist of the Tier 1 requirements plus the Modeling, Data, andAnalysis (MOD) Reliability Standards (MOD-001-1, 004-1, 008-1, 028-1, 029-1, and 030-2) forapplicable Registered Entities, pursuant to the requirement from FERC that this set ofStandards be audited during the first cycle of three-year audits following the effective date of theMOD Standards. In addition, for any Registered Entity that has not been previously audited bySERC, the scope will be expanded to include the Tier 2 requirements. Evidence supportingcompliance with Tier 2 or Tier 3 requirements may be needed to support evidence ofcompliance with a Tier 1 requirement (e.g., an audit of PRC-005-1 R2 will necessitate theauditor’s review of the Registered Entity’s program document required under PRC-005-1 R1 inorder to determine if the Registered Entity has met the requirements of PRC-005-1 R2.) Seethe NERC 2012 Actively Monitored Reliability Standards spreadsheet for the breakdown byrequirement of the scope for audits. SERC will provide to the Registered Entity the scope of thecompliance audit with the audit detail letter.Regional Entity audit teams are authorized and obligated to expand the scope of a complianceaudit to include Tier 2 and Tier 3 requirements and any other requirements they may deemnecessary based on the results of the Registered Entity Profile Assessment or the audit team’scollective professional judgment. Audit scope expansion can occur at any point during theprocess, from the initial review of the Registered Entity Profile Assessment through the close ofthe audit.In addition, the scope of compliance audits will include a review of all Mitigation Plans that areopen during the on-site audit, as discussed in the CMEP. Registered Entities must provide thecompliance audit team with the status, documentation, and evidence for all mitigation plans thatare to be reviewed. If a Registered Entity has certified a Mitigation Plan as being completedwithin 90 days of the audit start date, the audit team may verify satisfactory completion of theMitigation Plan during the compliance audit.To increase the efficiency of compliance audits in 2012, Regional Entity audit teams will havethe option of limiting the review of processes and procedures to the Registered Entity’s current,in-force documentation, and to the implementation of the Registered Entity’s internal complianceprogram. This approach allows the audit team to focus on the current reliability risk anddetermining compliance. In the event a finding of a Possible Violation is determined basedupon the current, in-force documents, the audit team will review previous versions of theprocess and procedure documentation to determine the full extent of the Possible Violation.Audit teams will have the flexibility to review historical information of the implementation ofactivities required by Reliability Standards, such as maintenance and testing records or operatorlogs/recordings, on an as needed basis.b. Annual Audit Plan and Long-Range Audit PlanThe schedule of audits for 2012 is attached as Appendix 1. A long range [eight (8) year] auditplan was developed to ensure that each entity registered within the SERC region receives acompliance audit on a prescribed schedule. Registered Entities that perform ReliabilityCoordinator (RC), Balancing Authority (BA), or Transmission Operator (TOP) functions will beSERC Compliance Monitoring and Enforcement Program2012 CMEP Implementation PlanNovember 1, 2011 8