Supporting document – Presentation on Self-Reports - March 17, 2016 Self-Report Presentation Supporting document March 17, 2016 1. The Self-Report in the QCMEP ................................................................................................ 2 2. The Self-Report form ............................................................................................................... 2 2.1. Finding the form .............................................................................................................. 2 2.2. Completing the form ....................................................................................................... 2 2.3. Submitting the form ........................................................................................................ 4 3. The process after a submission ............................................................................................... 4 4. The Mitigation Plan ................................................................................................................. 7 5. Communications between NPCC and entities......................................................................... 7 6. References ............................................................................................................................... 8 Régie de l’énergie – Équipe - Surveillance de la fiabilité des réseaux 1/8 Supporting document – Presentation on Self-Reports - March 17, 2016 1. The Self-Report in the QCMEP The self-report is one of the 8 monitoring processes identified in the QCMEP. Registered Entities are strongly encouraged to self-report non-compliances with Reliability Standards. The discovery of non-compliances through self-reports rather than audits, investigations or spot checks is a favorable indicator of an entity’s compliance culture. Also, the discovery of a non-compliance through a self-report is identified in the Sanction Guide as a possible adjustment factor that the Régie can take into consideration in adjusting the sanction for a violation. 2. The Self-Report form 2.1. Finding the form The Régie is having a software repository developed for the filing of confidential documents by NPCC, NERC, the Régie and Quebec’s Demo Registered Entities. During development, it is Where to find the form on the website? called the Système de Surveillance de la What does the form looks like? conformité au Québec (SSCQ). What will the form look like in the new repository? Until the SSCQ is ready, the Régie has put in place a temporary solution using its existing document repository, the SDÉ. This system is the SDÉ-Surveillance des normes, SDÉ-SN1. To fill out a self-report for submission into the SDÉ-SN, an entity representative must complete the form, located on the following webpage: http://www.regieenergie.qc.ca/en/audiences/NormesFiabiliteTransportElectricite/documents.html 2.2. Completing the form Risk versus Impact – Risk assessments assess the likelihood of relevant possible impacts. Together, the impacts and likelihoods provide an estimation of the risk. Potential Impact versus Actual Impact – The evaluation of potential impact is the identification, with the facts available at the beginning of the non-compliance, of all possible outcomes. The actual impact is that particular scenario that Demo “actually” happened. In particular, the actual Review of the fields impact could be nil in many cases, since 1 The internal name, used in the guide, is Temporary Solution Version 2 (TSV2). Régie de l’énergie – Équipe - Surveillance de la fiabilité des réseaux 2/8 Supporting document – Presentation on Self-Reports - March 17, 2016 many non-compliances do not cause a harm prior to their discovery and reporting. For noncompliances that are not mitigated at the time of reporting, it is possible for Actual Impact to evolve after reporting. Once the mitigation is complete, no more harm due to the noncompliance should occur and Actual Impact cannot longer change. At a given moment or for a momentary non-compliance, like a single event, actual impact should be less than or equal to potential impact. Since the Self-Report’s evaluation of potential impact is determined by facts and circumstances at the beginning of the non-compliance, it is possible, if facts and circumstances evolve during the period of non-compliance, for actual impact to exceed potential impact. Potential Risk versus Actual Risk – Starting from a definition of risk as a concept that combines impacts with their likelihoods, “potential risk” is the risk of the potential impacts and their likelihoods evaluated at the moment of non-compliance or at the beginning of the noncompliance, based on the facts at that time. Actual risk, though, is not based on actual impacts. While the Régie has no jurisprudence for assessment of reliability risks, the monitors in Québec, NPCC and l’équipe SFR, agree with FERC’s argument that “actual risk” must not be based on “after-the-fact” harm or “no-harm, no-foul” considerations that would follow 2 from using actual impacts. Hypothetical example: The following example is not realistic and its only purpose is to illustrate differences between potential and actual risk and potential and actual impacts. An entity has failed to identify and maintain a key major Protection System. The system should have been maintained on May 1. The entity discovered the error on June 1, self-reported it June 10 and got a crew to maintain it and be compliant again on August 1. The entity evaluates the potential risks of this lack of maintenance as follows: No impact, 95%; Local outage, 4%; Local outage that cascades to a major subregional outage requiring SPS, 1%. Under potential risk, the entity could write the above or summarize with “Possibility of a local outage, with a small probability of cascading to a major subregional outage”. Potential impact could be “local outage that could cascade to a significant outage”. On June 10, no outage has occurred.Therefore, actual impact would be nil thus far. The entity discusses with its operators and arranges a reduction of flow on June 5 which removes the possibility of a cascade. Then, the Actual risk field could say “Steps taken on June 5 to reduce the risk of a cascade. Risk of a local outage remains until mitigation is complete.” Instead, the actual risk field allows the entity to present how the risk has evolved since the beginning of the non-compliance. Facts and circumstances could have evolved since the beginning of the non-compliance, increasing or decreasing the risks. In particular, entities may, after discovery and while self-reporting, have taken actions to reduce the risk. The actual risk allows 2 138 FERC ¶ 61,193 (Docket No. RC11-6-000), p. 18 Régie de l’énergie – Équipe - Surveillance de la fiabilité des réseaux 3/8 Supporting document – Presentation on Self-Reports - March 17, 2016 the entity to indicate that at the moment of Self-Report, the risk is reduced with respect to its potential. In its final risk evaluation, NPCC will evaluate the actual risk based on the possible impacts and likelihoods throughout the duration of the violation. A useful reference is the NERC Self-Report guide, currently available at the following link: http://www.nerc.com/pa/comp/Reliability%20Assurance%20Initiative/ERO%20SelfReport%20User%20Guide%20(April%202014).pdf 2.3. Submitting the form Within the SSCQ, there will be a submit button on the form. Until the SSCQ is ready, entities, NPCC and the Régie must file in the SDÉ-SN. The Régie recommends that you proceed as follows: 1. Inform the Régie that you would like to file a Self-Report A designated contact person for the entity can call the secretary of the Régie to inform the Régie that the entity intends to file a Self-Report. Alternatively, that person can send an email to secretariat-pscaq. The email should not explicitly mention the Self-Report. It should simply state that that person wishes to communicate with the Régie regarding compliance matters for the entity and provide names, emails and phone numbers for the employees that require access to the SDÉ-SN. Contact information: 1 (888) 873-2452 or (514) 873-2452 secretariat-PSCAQ@regie-energie.qc.ca 2. The Régie will create a confidential folder for you in the SDÉ-SN. Thereupon, the Régie will send the people identified by the contact person usernames and a SDÉ-SN user guide. The guide will explain how to obtain your password. 3. Find your folder 4. File your form. You may also file supporting documents as required. Demo Navigating the SDÉSN The SDÉ-SN guide Filing a Self-Report 3. The process after the submission of a Self-Report Process flow summary 1. NPCC evaluation 2. Possibility of Simplified Identification, Correction and Mitigation (SICM) 3. Possibility of NPCC determination of a non-compliance Régie de l’énergie – Équipe - Surveillance de la fiabilité des réseaux 4/8 Supporting document – Presentation on Self-Reports - March 17, 2016 4. 5. 6. 7. Possibility of Settlement between NPCC and the registered entity (RE) Possibility of a Hearing Régie determination of a violation Possibility of a Mitigation Plan The following is detailed breakdown of the steps. Detailed steps of the process following a Self-Report 1 Evaluation: NPCC - Non-compliance or not? No – step 2; Yes – step 4. 2 Notice of No Non-Compliance (NNNC) (NPCC to the RE, ÉSFR) ÉSFR recommendation to Régie 3 Régie determination No – Process concludes Yes- step 4 4 Evaluation: NPCC – SICM or not? Yes – step 5; no – step 13 5 Recommendation for SICM treatment (NPCC to the ÉSFR) L’ÉSFR evaluates the recommendation and recommends to the Régie. If the Régie accepts the SICM treatment: ÉSFR requests comments 6 from RE if the entity disagrees on SICM and go to step 7. If the Régie refuses SICM treatment: either step 13 or end of process (step 2 except the ÉSFR will issue the NNNC), depending on the facts and circumstances. RE files comments on SICM (disagreement) 7 RE disagrees - step 8 RE agrees or has no comments – step 9 SICM discussion between NPCC and RE 8 RE and NPCC come to agreement on SICM – step 9 RE and NPCC do not agree on SICM – step 19 9 NPCC informs ÉSFR that the Entity agrees with SICM treatment 10 Régie determination SICM treatment - yes - step 11; no -step 13 Order - SICM treatment 11 Order is confidential (Régie to RE, cc to NPCC) 12 Notice SICM (NPCC to the RE) Régie de l’énergie – Équipe - Surveillance de la fiabilité des réseaux 5/8 Supporting document – Presentation on Self-Reports - March 17, 2016 Notice of Non-Compliance (NNC) (NPCC to the RE) 13 Docket R-7131-5XXX is opened and a commissioner is assigned (not chair or vice-chair) R-7131 dockets are confidential. 14 Recommendation to the ÉSFR following NNC (NPCC to ÉSFR) Possibility – Settlement Discussions 15 If Entity contacts NPCC, step 16; If not and delays expire, step 24; Notice of start of discussions for Settlement Agreement (SA) 16 (NPCC to the ÉSFR) 17 Possibility – Settlement is reached If yes – step 18; no – step 24 18 Notice of Settlement Agreement (recommendation) (NPCC to ÉSFR) 19 Settlement Agreement Recommendation (ÉSFR to Régie) Régie Determination on SA 20 Accept SA - step 21 Refuse SA - step 23 Order and publication ÉSFR publishes the summary of the order determining the violation 21 and settlement agreement (public version) on Régie website per the order instructions. (Régie to the ÉSFR, RE, NPCC) NPCC final recommendation 22 (If delays expire and/or agreement between NPCC and RE are not reached in SA) Entity Comment Period 23 ÉSFR tells entity it has 10 days to comment or request a hearing (ÉSFR to RE) 24 Entity Comments (RE to ÉSFR) Request for hearing 25 (RE to ÉSFR) If Yes, step 26; if no, step 31. Request for hearing availability and hearing planning info (Régie to RE, ÉSFR and NPCC) 26 Info includes number of witnesses, estimated time, supporting evidence 27 NPCC hearing availability and info (NPCC to Régie) 28 Entity hearing availability and info (RE to Régie) Régie de l’énergie – Équipe - Surveillance de la fiabilité des réseaux 6/8 Supporting document – Presentation on Self-Reports - March 17, 2016 29 Procedural order establishing hearing date Hearing ÉSFR vs. RE. 30 NPCC as expert witness. Go to Step 31a If the RE’s comments do not contest the NPCC recommendation, the 31 RE must submit a Mitigation Plan within 30 days of the NPCC determination of a non-compliance. Régie decision (Régie to ÉSFR, RE with cc to NPCC) Régie decision is copied into RE monitoring area and NPCC is notified 31a by ÉSFR. Violation is not found step 32 Violation is found: step 33 32 End of process. Publication of an order (possibly redacted), a summary and certain 33 aspects of evidence. Under some circumstances, publication could be delayed until completion of the Mitigation Plan. If a Mitigation Plan has been submitted by the RE, it is ordered. 34 If the RE has not submitted a Mitigation Plan, it now has 10 days to do so. Upon submission, the same commissioner will order the Mitigation 35 Plan be executed. RE begins executing Mitigation Plan with reporting to NPCC as 36 required by the Mitigation Plan. (RE to NPCC) RE completes Mitigation Plan, according to NPCC/ÉSFR, step 38; 37 RE does not complete Mitigation Plan, according to NPCC/ÉSFR, step 39. Notification by the monitor (NPCC/ÉSFR) to the Régie. Docket is 38 closed. 39 Processing continues. 4. The Mitigation Plan There is a Mitigation Plan form to fill-out. The Régie will post it on its website shortly. To obtain it more quickly, please contact the Régie at secretariat-PSCAQ@regie-energie.qc.ca using the procedure described in section 2 of this document. An RE may submit a Mitigation Plan at anytime, but must submit a Mitigation Plan within 30 days of an uncontested NPCC determination of a non-compliance and within 10 days of a Régie determination of a violation. 5. Communications between NPCC and entities Régie personnel, specifically staff in the Équipe - Surveillance de la fiabilité des réseaux, will participate as observers in meetings between NPCC and an entity. Entities can, however, contact NPCC to discuss administrative arrangements and to seek clarifications without informing the ÉSFR. Régie de l’énergie – Équipe - Surveillance de la fiabilité des réseaux 7/8 Supporting document – Presentation on Self-Reports - March 17, 2016 All filings by all parties must be to a Régie platform, either SDÉ-SN or, in future, SSCQ. Communications between NPCC and entities are in French. However, NPCC may file its original English versions of documents for reference purposes. Translation is assured either by NPCC or the Régie. When the SSCQ is complete, it will have a translation workflow built-in to accelerate formal communications between entities and NPCC. 6. References Self-Report form: on this page http://www.regieenergie.qc.ca/en/audiences/NormesFiabiliteTransportElectricite/documents.html QCMEP – On this page http://www.regieenergie.qc.ca/en/audiences/NormesFiabiliteTransportElectricite/EncadrementSurveillance.html SDÉ-SN guide – Available upon request in French only at this time. The guide will be sent to any user that is added to the SDÉ-SN. Mitigation Plan form – Available upon request in English only at this time. A French version will be available upon request shortly. NERC Self-Report guide, currently available at the following link: http://www.nerc.com/pa/comp/Reliability%20Assurance%20Initiative/ERO%20SelfReport%20User%20Guide%20(April%202014).pdf Régie de l’énergie – Équipe - Surveillance de la fiabilité des réseaux 8/8