2015 Internal Compliance Program Assessment – ICPA
Version 5.0
February 2, 2015
CONTACT INFORMATION
Entity Name:
NERC # Registry ID:
Primary Compliance Contact Name:
Primary Contact Title:
Office Phone:
Cell Phone:
Email:
Click here to enter text.
Click here to enter text.
Click here to enter text.
Click here to enter text.
Click here to enter text.
Click here to enter text.
Click here to enter text.
Alternate Compliance Contact Name:
Alternate Compliance Contact Title:
Office Phone:
Cell Phone:
Email:
Click here to enter text.
Click here to enter text.
Click here to enter text.
Click here to enter text.
Click here to enter text.
Authorizing Entity Officer Name:
Authorizing Entity Officer Title:
Mailing address (Not a P.O. Box):
Telephone:
Email:
Click here to enter text.
Click here to enter text.
Click here to enter text.
Click here to enter text.
Click here to enter text.
W E S T E R N E L E C T R I C I T Y C O O R D I N A T I N G C O U N C I L • W W W . W E C C . B I Z
155 NORTH 400 WEST • SUITE 200 • SALT LAKE CITY • UTAH • 84103 -1114 • PH 801.582.0353 • FX 801.582.3918
Internal Compliance Program Assessment
TABLE OF CONTENTS
PURPOSE ................................................................................................................................ i
INSTRUCTIONS ....................................................................................................................... i
SURVEY QUESTIONS .............................................................................................................. 1
1.
ICP ....................................................................................................................................... 1
2.
Identify and Update Requirements .................................................................................... 2
3.
Risk Assessment .................................................................................................................. 3
4.
Officers/Personnel .............................................................................................................. 4
5.
Independent Access to Executives...................................................................................... 5
6.
Independently Managed ..................................................................................................... 6
7.
Resources ............................................................................................................................ 7
8.
Leadership Support ............................................................................................................. 8
9.
Measurable Compliance Performance Targets .................................................................. 9
10. Compliance Training ......................................................................................................... 10
11. Compliance Communications ........................................................................................... 11
12. Program Implementation ................................................................................................. 12
13. Promoting Compliance through Employee Incentives ..................................................... 13
14. Enforcement ..................................................................................................................... 14
15. Self-Audit........................................................................................................................... 15
16. Self-Reporting ................................................................................................................... 16
17. Program Evaluation and Modification .............................................................................. 17
18. Internal Controls ............................................................................................................... 18
19. External Industry Participation ......................................................................................... 19
AUTHORIZATION ................................................................................................................. 20
APPENDIX A: Overview of FERC Statements by Question ..................................................... 21
APPENDIX B: Selected Example ICP Practices....................................................................... 23
W E S T E R N E L E C T R I C I T Y C O O R D I N A T I N G C O U N C I L • W W W . W E C C . B I Z
155 NORTH 400 WEST • SUITE 200 • SALT LAKE CITY • UTAH • 84103 -1114 • PH 801.582.0353 • FX 801.582.3918
Internal Compliance Program Assessment
PURPOSE
The WECC Internal Compliance Program Assessment (ICPA) is a tool to help entities
assess their internal compliance programs. The ICPA will assist WECC in its review and
understanding of the programs that entities have implemented to ensure compliance
with the NERC Reliability Standards. The ICPA is:

Based on relevant FERC orders, FERC direction, and WECC and NERC experience
related to robust internal compliance programs. The ICPA includes an Appendix A
containing referenced or supporting FERC documents.

Composed of nineteen questions designed to focus on various aspects of an entity’s
program.

Designed to prompt an entity to identify and gather specific, relevant information related
to its internal compliance program.

Adaptable to allow for the unique constraints of smaller entities as well as flexible
enough to recognize distinct characteristics across the variety of programs.
INSTRUCTIONS
1. For each question below, choose the statement that best describes the
responsible entity’s current status.
2. Please attach supporting documentation or provide associated page numbers
and paragraph references within the ICP, and submit this completed package to
WECC.
For example, this documentation package may include, but not be limited to:







Organizational charts
Internal plans, policies, processes and/or procedures
Emails
Training manuals
PowerPoint presentations with associated attendance rosters
ICP workshops; and/or
CBT modules.
Note: For the purposes of this document, “compliance program(s)” refers to
programs concerned with compliance with NERC Reliability Standards.
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
i
Internal Compliance Program Assessment
SURVEY QUESTIONS
1. ICP
Is the ICP an established, formal program? For example, does the ICP contain fully
documented plans, policies, processes and/or procedures, internal controls, and
other systematic preventive measures for the governance and management of
compliance with NERC Reliability Standards?
Note: See Appendix B for example practices.
Choose the statement that best describes the ICP:
☐
☐
☐
NO
PARTIAL
YES
The ICP does not have any documented plans, policies, processes and/or
procedures, internal controls, and other systematic preventive measures.
The ICP has some documented plans, policies, processes and/or
procedures, internal controls, and other systematic preventive measures, but
does not address all.
The ICP has well documented plans, policies, processes and/or procedures,
internal controls, and other systematic preventative measures.
Describe, in narrative form, how the entity documents its ICP:
Click here to enter text.
Please provide supporting evidence. Examples of supporting evidence may
include one or more of the following or equivalent:



The entity’s ICP document(s)
Plans, policies, processes and/or procedures, internal controls, and other systematic preventive
measures associated with the entity’s governance and management of compliance with NERC
Reliability Standards
Other documented processes and/or procedures as applicable
Applicable Document(s), Page and Section
Click here to enter text.
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
1
Date and/or Version
Click here to enter text.
Internal Compliance Program Assessment
2. Identify and Update Requirements
Does the ICP identify and list all NERC Reliability Standards applicable to the entity?
Does the ICP contain a process and/or procedure for updating this list as Standards
change?
Note: See Appendix B for example practices.
Choose the statement that best describes the ICP:
☐
☐
☐
NO
The ICP does not have a process and/or procedure for identifying and
updating the NERC Reliability Standards applicable to the entity.
The ICP identifies all or some of the NERC Reliability Standards applicable
PARTIAL to the entity, but does not contain a process and/or procedure for updating
this list as Standards change.
YES
The ICP identifies all NERC Reliability Standards applicable to the entity
and contains a process and/or procedure for updating this list as Standards
change.
Describe, in narrative form, how the entity identifies and lists the applicable
NERC Reliability Standards in its ICP:
Click here to enter text.
Please provide supporting evidence. Examples of supporting evidence may
include one or more of the following or equivalent:



A plan or other document that lists NERC Reliability Standards that apply to the entity
A description of the process and/or procedure the entity follows to update this list when
Standards change, as applicable
Version control records of the entity’s Reliability Standards lists
Applicable Document(s), Page and Section
Click here to enter text.
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
2
Date and/or Version
Click here to enter text.
Internal Compliance Program Assessment
3. Risk Assessment
Does the ICP include processes and/or procedures to assess compliance and
reliability risks related to the NERC Reliability Standards on an annual basis?
Note: See Appendix B for example practices.
Choose the statement that best describes the ICP:
☐
☐
☐
NO
The ICP does not document how compliance and reliability risk is
assessed.
PARTIAL
Although the ICP includes processes and/or procedures to assess
compliance and reliability risks, the entity does not assess risk on an
annual basis.
YES
The entity assesses its compliance and reliability risks, and the ICP
includes processes and/or procedures to assess compliance and reliability
risks at least annually.
Describe, in narrative form, how the entity assesses compliance and reliability
risks:
Click here to enter text.
Please provide supporting evidence. Examples of supporting evidence may
include one or more of the following or equivalent:


The entity’s compliance and reliability risk assessment processes and/or procedures
Final risk assessment reports
Applicable Document(s), Page and Section
Click here to enter text.
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
3
Date and/or Version
Click here to enter text.
Internal Compliance Program Assessment
4. Officers/Personnel
Has the entity named and staffed a Compliance Officer, FERC/NERC Director, or
additional FERC/NERC personnel as required to support its ICP?
Smaller Entities: A smaller entity may not have sufficient staff to dedicate
one employee as a full-time Compliance Officer or FERC/NERC Director. In
such cases, has the entity assigned one person the responsibility to
coordinate or monitor the entity’s compliance responsibilities?
Choose the statement that best describes the ICP:
☐
☐
☐
The entity has not identified or assigned compliance responsibility and
accountability to a Compliance Officer, FERC/NERC Director/Manager, or
other high-ranking official.
NO
PARTIAL
YES
Name(s):
The entity has identified and assigned responsibility for some compliance
activities to various employees throughout the organization.
The entity has identified and assigned responsibility and accountability to
a Compliance Officer or other high-ranking official, FERC/NERC
Director/Manager, and additional personnel as required. For larger
organizations, at least one position is fully dedicated to FERC/NERC
compliance. For smaller organizations, at least one position is partially
dedicated to FERC/NERC compliance. Below, provide the name(s) and
title(s) of the employee(s) currently staffing this/these position(s).
Click here to enter text.
Describe, in narrative form, how the entity has assigned compliance
responsibility in the organization:
Click here to enter text.
Please provide supporting evidence. Examples of supporting evidence may
include one or more of the following or equivalent:


Compliance Organizational Chart
Defined Roles and Responsibilities assigned to entity personnel for each NERC Reliability
Standard identified in Item 2 above
Applicable Document(s), Page and Section
Click here to enter text.
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
4
Date and/or Version
Click here to enter text.
Internal Compliance Program Assessment
5. Independent Access to Executives
Does the assigned compliance official(s) have independent access to the CEO or
equivalent and/or Board of Directors?
Note: If your entity does not currently have an assigned compliance official, please
answer “NO” to this question.
Choose the statement that best describes the ICP:
☐
☐
NO
The entity’s assigned compliance official does not have independent
access to the CEO or equivalent and/or Board of Directors.
YES
The entity’s assigned compliance official has independent access to the
CEO and/or Board of Directors.
Describe, in narrative form, how the entity provides independent access to the
CEO or equivalent and/or Board of Directors for its employee(s) responsible for
compliance:
Click here to enter text.
Please provide supporting evidence. Examples of supporting evidence may
include one or more of the following or equivalent:


Organizational chart or plan showing independent access
Sample meeting minutes, notes, agendas, emails, etc., showing independent access to senior
management
Applicable Document(s), Page and Section
Click here to enter text.
Date and/or Version
Click here to enter text.
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
5
Internal Compliance Program Assessment
6. Independently Managed
Is the ICP operated and managed so it is independent of those responsible for
compliance with the NERC Reliability Standards?
Smaller Entities: A smaller entity may not have the available personnel to
manage its ICP separately from the work groups that are responsible for
complying with NERC Reliability Standards. In such cases, those personnel
responsible for compliance should at minimum have independent access to the
company’s assigned compliance official, the CEO or equivalent, and/or the Board
of Directors (see item 5 above).
Choose the statement that best describes the ICP:
☐
☐
☐
NO
PARTIAL
YES
The ICP is not managed or operated independently of the work groups
that are responsible for complying with NERC Reliability Standards.
The ICP is managed by the work groups that are responsible for
complying with NERC Reliability Standards, but it is managed
independently.
The ICP is managed and operated independently of the work groups that
are responsible for complying with NERC Reliability Standards.
Describe, in narrative form, how the entity independently manages its ICP:
Click here to enter text.
Please provide supporting evidence. Examples of supporting evidence may
include the following document or equivalent:


Organizational chart or plan which shows how the program is independently managed
For smaller entities, please provide applicable documentation
Applicable Document(s), Page and Section
Click here to enter text.
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
6
Date and/or Version
Click here to enter text.
Internal Compliance Program Assessment
7. Resources
Has the entity dedicated resources (staff and budget) to support its ICP?
Choose the statement that best describes the ICP:
☐
☐
☐
NO
The entity’s budget does not provide for any staff resources to work on
compliance with NERC Reliability Standards.
PARTIAL
The entity has provided for staff resources within its budget but cannot
demonstrate that staff resources were allocated to compliance with NERC
Reliability Standards.
YES
The ICP is fully budgeted and fully or partially staffed (relative to the
number of full time equivalent staff that implements the Reliability
Standards) on a year-round basis.
Describe, in narrative form, the support the entity allocates to its ICP:
Click here to enter text.
Please provide supporting evidence. Examples of supporting evidence may
include the following document or equivalent:

Organizational chart or plan which shows compliance roles and responsibilities and how they
are staffed
Applicable Document(s), Page and Section
Click here to enter text.
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
7
Date and/or Version
Click here to enter text.
Internal Compliance Program Assessment
8. Leadership Support
Does the ICP have the support and participation of senior management (Officer
Level)? This includes reviewing compliance reports, participating in compliance
meetings, and communicating the importance of compliance to entity personnel on a
regular basis.
Choose the statement that best describes the ICP:
☐
☐
☐
NO
PARTIAL
YES
Senior management does not actively support or routinely participate in
the ICP.
Senior management reviews compliance reports, participates in
compliance meetings, and communicates to employees their commitment
to compliance at least semi-annually.
Senior management is actively involved in compliance efforts, reviews
compliance reports, participates in compliance meetings, and
communicates to employees its commitment to compliance frequently,
both formally and informally. Compliance activities occur at least quarterly.
Describe, in narrative form, the support the ICP receives from the entity’s Officer
Level leadership:
Click here to enter text.
Please provide supporting evidence. Examples of supporting evidence may
include one or more of the following or equivalent:





Samples of Senior Management Communications for the past 12 months
Samples of Compliance meeting agendas for the past 12 months
Samples of Compliance committee meeting minutes for the past 12 months
Samples of relevant e-mail memos, newsletters, etc. for the past 12 months
Description of management review/approval process and/or procedure
Applicable Document(s), Page and Section
Click here to enter text.
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
8
Date and/or Version
Click here to enter text.
Internal Compliance Program Assessment
9. Measurable Compliance Performance Targets
Does the entity promote compliance by including measurable compliance
performance targets in the ICP? For example, the entity might use an Excel
spreadsheet to list all requirements, who is responsible for each requirement, target
dates, and status of compliance with each. Additional targets might include, but are
not limited to, completing self-certifications on time, achieving “full compliance”
following a mock audit, completing mitigation plans on time, or other relevant goals.
Note: See Appendix B for example practices.
Choose the statement that best describes the ICP:
☐
☐
☐
The ICP does not identify measureable compliance performance targets.
NO
PARTIAL
YES
The ICP contains general compliance performance targets, but the
performance targets are not specific or measureable.
The ICP includes measureable, specific compliance performance targets
for employees. These targets might include, but are not limited to, full
compliance for each requirement, timely self-certification submittals,
mitigation plan target dates, successful mock audits, etc.
Describe, in narrative form, how the entity measures its compliance performance:
Click here to enter text.
Please provide supporting evidence. Examples of supporting evidence may
include one or more of the following or equivalent:


Specific NERC compliance performance targets and goals and how they are measured
Sample results
Applicable Document(s), Page and Section
Click here to enter text.
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
9
Date and/or Version
Click here to enter text.
Internal Compliance Program Assessment
10. Compliance Training
Does the ICP require compliance training for all entity staff, contractors and vendors
who have direct responsibility for the implementation of the processes and/or
procedures that demonstrate compliance with the NERC Reliability Standards?
Relevant personnel may include but are not limited to: Subject Matter Experts
(SMEs), Engineers, Technicians, Vegetation Management implementers and
System Operators (as applicable). Does this training measure understanding
through quizzes, exams, surveys, etc. consistent with a Registered Entity’s collective
bargaining agreements?
Note: See Appendix B for example practices.
Choose the statement that best describes the ICP:
☐
☐
☐
The ICP does not require training for relevant personnel.
NO
PARTIAL
YES
The ICP requires training for personnel that have a direct responsibility for
compliance with NERC Reliability Standards.
The ICP includes detailed training for personnel, including contractors and
vendors that have a direct responsibility for compliance with NERC
Reliability Standards, including assisting personnel who must keep
professional credentials up-to-date. Training also includes overview
compliance awareness training for other employees that do not have a
direct responsibility for compliance with NERC Reliability Standards. All
training includes processes and/or procedures that measure the degree of
understanding and comprehension of such Standards (quizzes, etc.),
consistent with a Registered Entity’s collective bargaining agreements.
Describe, in narrative form, how the entity provides compliance training to all
personnel, including contractors and vendors (see above):
Click here to enter text.
Please provide supporting evidence. Examples of supporting evidence may
include one or more of the following or equivalent:




Compliance Training Program
Compliance Communications Program
Samples of training modules
Attendance records
Applicable Document(s), Page and Section
Click here to enter text.
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
10
Date and/or Version
Click here to enter text.
Internal Compliance Program Assessment
11. Compliance Communications
Does the ICP require communication to all employees, including contractors and
vendors, etc.? Has the ICP, (i.e. all plans, policies, processes and/or procedures)
been widely disseminated throughout the entity?
Choose the statement that best describes the ICP:
☐
☐
☐
☐
The ICP has not been distributed.
NO
PARTIAL
The ICP has been distributed only to the employees that are involved in
the development and implementation of the ICP.
PARTIAL
The ICP has been distributed only to the employees that have a direct
responsibility for compliance with the NERC Reliability Standards.
YES
The ICP has been distributed to all employees, and, if applicable, to
contractors and vendors.
Describe, in narrative form, how the entity disseminates the ICP to all appropriate
relevant employees, including contractors and vendors:
Click here to enter text.
Please provide supporting evidence. Examples of supporting evidence may
include one or more of the following or equivalent:




Compliance Training Program
Compliance Communications Program
Website samples
Sample e-mail memos, newsletters, etc.
Applicable Document(s), Page and Section
Click here to enter text.
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
11
Date and/or Version
Click here to enter text.
Internal Compliance Program Assessment
12. Program Implementation
For the purposes of this question the word implement means, “actual fulfillment by
concrete measures.” Has the entity implemented its ICP; i.e. all plans, policies,
processes and/or procedures? Are logs, meeting minutes, forms, agendas, and
other records being kept to show compliance plans, policies, processes and/or
procedures are being followed and are operating as intended?
Choose the statement that best describes the ICP:
☐
☐
☐
The entity has not implemented its ICP.
NO
PARTIAL
The entity has partially implemented its ICP and is continuing to work on
full implementation. The entity has evidence of an implementation plan
with set milestone and completion dates.
YES
The entity has fully implemented its ICP. Entity is currently following all
processes and/or procedures detailed in the ICP and can provide records
as evidence.
Describe, in narrative form, how the entity implements and documents its ICP:
Click here to enter text.
Please provide supporting evidence. Examples of supporting evidence may
include one of more of the following or equivalent:


Samples from each plan, policy, process and/or procedure of the entity’s ICP (including
measurements in item 9 above, Measurable Compliance Performance Targets.)
Logs, meeting minutes, forms, agendas, and other records used to support “proof of
performance” of items 1-11 and 13-19 in this self-assessment.
Applicable Document(s), Page and Section
Click here to enter text.
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
12
Date and/or Version
Click here to enter text.
Internal Compliance Program Assessment
13. Promoting Compliance through Employee Incentives
Does the entity’s ICP include provisions for compensation, awards, employee
recognition, or other monetary and/or non-monetary incentives to encourage the
relevant employees’ compliance with the NERC Reliability Standards? Is
compliance with NERC Reliability Standards a performance factor on job
descriptions and performance evaluations?
Note: See Appendix B for non-monetary example practices.
Choose the statement that best describes the ICP:
☐
NO
☐
PARTIAL
☐
YES
The ICP does not provide any form of monetary and/or non-monetary
incentives and/or recognition to encourage accountability for employee
compliance with the NERC Reliability Standards.
Entity has monetary and/or non-monetary incentives and/or recognition to
encourage employee compliance with NERC Reliability Standards;
however, the ICP or any other document specific to compliance does not
detail a formal monetary and/or non-monetary incentive and/or recognition
structure.
The ICP includes provisions for, and details of, monetary and/or nonmonetary incentives and/or recognition to encourage employee
compliance with the NERC Reliability Standards and accountability for
compliance. Compliance with NERC Reliability Standards is a
performance factor on job descriptions and performance evaluations.
Describe, in narrative form, how the entity promotes compliance through
incentives:
Click here to enter text.
Please provide supporting evidence. Examples of supporting evidence may
include one or more of the following or equivalent:




Company programs relating to compensation, awards, employee recognition, or other monetary
and/or non-monetary incentives relating to compliance
Samples of non-confidential information related to actual awards or other incentives
Job Descriptions
Other examples of programs or policies entity uses to promote a culture of compliance
Applicable Document(s), Page and Section
Click here to enter text.
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
13
Date and/or Version
Click here to enter text.
Internal Compliance Program Assessment
14. Enforcement
Does the ICP include processes and/or procedures for disciplinary action for
employees involved in violations of the Reliability Standards? Are available Human
Resources (HR) disciplinary programs utilized as necessary? Is Senior Leadership
or the Board involved as necessary?
Choose the statement that best describes the ICP:
☐
☐
☐
NO
PARTIAL
YES
The entity’s ICP does not include disciplinary action for employees who
are responsible for violations of NERC Reliability Standards.
The entity takes disciplinary action for employees responsible for
violations of NERC Reliability Standards; however, the entity does not
have a formal documented disciplinary action process and/or procedure.
The entity’s ICP includes detailed disciplinary action processes and/or
procedures for employees involved in NERC Reliability Standard
violations, including involving HR, Senior Leadership, and/or the Board as
necessary. The entity has administered disciplinary action when
appropriate.
Describe, in narrative form, the entity’s disciplinary action for employees that are
responsible for violations of NERC Reliability Standards:
Click here to enter text.
Please provide supporting evidence. Examples of supporting evidence may
include:


Company policies relating to disciplinary actions for compliance violations
Samples of any recent disciplinary actions (past 12-24 months) – redacted if necessary
Applicable Document(s), Page and Section
Click here to enter text.
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
14
Date and/or Version
Click here to enter text.
Internal Compliance Program Assessment
15. Self-Audit
Does the ICP include a formal, internal self-auditing process and/or procedure for
compliance with all applicable NERC Reliability Standards on an annual basis? Are
results reported internally?
Choose the statement that best describes the ICP:
☐
☐
☐
NO
The ICP does not include an internal self-auditing and reporting process
and/or procedure.
PARTIAL
Although the ICP includes a process and/or procedure for internal selfauditing and reporting, the entity does not self-audit and report on at least
an annual basis.
YES
The ICP includes internal self auditing and reporting for compliance on an
annual basis for full compliance with all applicable NERC Reliability
Standards. Audit results are reported and reviewed internally.
Describe, in narrative form, how the entity self-audits its ICP:
Click here to enter text.
Please provide supporting evidence. Examples of supporting evidence may
include one of more of the following or equivalent:


ICP self-audit program
Sample of the audit reports or other results (past 12-24 months) – redacted if necessary
Applicable Document(s), Page and Section
Click here to enter text.
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
15
Date and/or Version
Click here to enter text.
Internal Compliance Program Assessment
16. Self-Reporting
Does the ICP include specific processes and/or procedures to promote prompt
detection and self-reporting of possible violations to the Regional Entity (WECC)?
Choose the statement that best describes the ICP:
☐
☐
☐
NO
PARTIAL
YES
The ICP does not include processes and/or procedures for self-reporting
possible violations of applicable NERC Reliability Standards.
The ICP does not include processes and/or procedures for self-reporting
possible violations of applicable NERC Reliability Standards, but the entity
has self-reported violations to WECC since the entity was registered.
The ICP includes processes and/or procedures for self-reporting possible
violations of applicable NERC Reliability Standards. In addition, entity has
followed these processes and/or procedures and, if a violation was found,
promptly self-reported the violation to WECC.
Describe, in narrative form, how the entity encourages timely self-reporting in its
ICP:
Click here to enter text.
Please provide supporting evidence. Examples of supporting evidence may
include one or more of the following or equivalent:



Processes and/or procedure for self-reporting
A sample of recent self-reports
A list of the entity’s self-reports for the past 12 months
Applicable Document(s), Page and Section
Click here to enter text.
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
16
Date and/or Version
Click here to enter text.
Internal Compliance Program Assessment
17. Program Evaluation and Modification
Does the entity regularly review and modify its ICP? This includes a process and/or
procedure to trigger a review of the ICP either following a violation or following
changes to NERC Reliability Standards, and modifying the ICP, if necessary.
Choose the statement that best describes the ICP:
☐
☐
☐
NO
PARTIAL
YES
The ICP does not have an identified review cycle or a process and/or
procedure to trigger a review.
The ICP does not specify a review cycle; however, the entity has a process
and/or procedure to trigger a review, or has reviewed and modified its ICP
since the entity was registered.
The ICP is reviewed on at least an annual cycle. In addition, the entity has a
process and/or procedure to trigger a review either following a violation or
following changes to NERC Reliability Standards. The ICP is modified as
necessary.
Describe, in narrative form, how the entity reviews and modifies its ICP:
Click here to enter text.
Please provide supporting evidence. Examples of supporting evidence may
include one or more of the following or equivalent:


ICP review and modification process and/or procedure
A sample of recent ICP reviews, including version control records
Applicable Document(s), Page and Section
Click here to enter text.
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
17
Date and/or Version
Click here to enter text.
Internal Compliance Program Assessment
18. Internal Controls
Does the ICP include a process and/or procedure to implement internal controls to
prevent, detect and/or correct possible violations of NERC Reliability Standards?
This includes assessing the effectiveness of internal controls.
See Appendix B for internal controls description and generic examples of internal
control activities.
Choose the statement that best describes the ICP:
☐
NO
The ICP does not include a process and/or procedure to put into place and
assess the effectiveness of internal controls. The entity has not implemented
any internal controls.
☐
PARTIAL
The ICP does not have a process and/or procedure to implement and assess
the effectiveness of internal controls. However, the entity has implemented
some internal controls.
☐
YES
The ICP contains a process and/or procedure to implement and assess the
effectiveness of internal controls. The entity has also implemented robust
internal controls to prevent, detect and/or correct possible violations of NERC
Reliability Standards.
Describe, in narrative form, how the entity uses internal controls to prevent,
detect and/or correct the possible violation of NERC Reliability Standards, and
how the entity assesses the effectiveness of those controls:
Click here to enter text.
Please provide supporting evidence. Examples of supporting evidence may
include one or more of the following or equivalent:



Process and/or procedure for establishing and assessing internal controls
Examples of internal controls implemented (See Appendix B for generic examples of internal
control activities)
Assessments and/or reviews completed by the entity to determine the effective ness of internal
controls (i.e. in terms of high-risk Reliability Standards; in terms of preventative, detective, or
corrective; etc.)
Applicable Document(s), Page and Section
Click here to enter text.
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
18
Date and/or Version
Click here to enter text.
Internal Compliance Program Assessment
19. External Industry Participation
Has the entity participated in outreach activities to share compliance program
activities with other entities, adjacent utilities, local organizations, etc.? Does the
entity participate in WECC-related conferences and user meetings such as CUG,
CIPUG, Open Webinar, WICF, etc.?
Choose the statement that best describes the ICP:
☐
☐
☐
The entity has not participated in compliance outreach activities.
NO
PARTIAL
YES
The entity has participated occasionally in compliance outreach activities
since June 18, 2007.
The entity regularly participates in outreach activities to share compliance
program activities with other entities, adjacent utilities, and/or local
organizations. The entity also attends WECC-related conferences and user
meetings such as CUG, CIPUG, Open Webinar, WICF, etc.
Describe, in narrative form, the entity’s external industry participation:
Click here to enter text.
Please provide supporting evidence. Examples of supporting evidence may
include some or all of the following or equivalent:



Sample presentations made to professional organizations
Names of persons participating on regional or national compliance committees, does not include
participation in Standards Development processes and/or procedures.
Attendance records for technical conferences, industry webinars, etc.
Applicable Document(s), Page and Section
Click here to enter text.
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
19
Date and/or Version
Click here to enter text.
Internal Compliance Program Assessment
AUTHORIZATION
An authorized individual must sign and date this Internal Compliance Program
Assessment. By doing so, this individual, on behalf of the entity’s organization, certifies
that the information submitted herein is accurate.
1. This certifies that I am
(Officer’s Name)
of
(RE)
.
2. I am an officer, employee, attorney or other person authorized to sign this
Internal Compliance Program Assessment on behalf of (RE) .
3. I have read and am familiar with the contents of the Internal Compliance Program
Assessment and related documents submitted herein.
4. I understand that based on the answers herein, WECC may request more
information specific to
(RE) ‘s ICP.
5. To the best of my knowledge, the information provided in this response is correct.
Authorized Signature: Click here to enter text.
Name (Print):
Click here to enter text.
Title:
Click here to enter text.
Date:
Click here to enter text.
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
20
Internal Compliance Program Assessment
APPENDIX A: Overview of FERC Statements by Question
For purposes of this document, the following acronyms apply:
SOE= FERC Revised Policy Statement on Enforcement dated May 15, 2008
http://www.ferc.gov/whats-new/comm-meet/2008/051508/M-1.pdf
SOC= FERC Policy Statement on Compliance dated October 16, 2008
http://www.ferc.gov/whats-new/comm-meet/2008/101608/M-3.pdf
P=Paragraph Number
Risk Assessment/Identify Requirements (#2, #3)
 Prepare an inventory of current compliance risks (SOE, P59)
o (Note: This will result in a list of current program requirements)
 Companies are in the best position to determine the risks their activities entail and how
best to assure compliance (SOC, P9 and 17)
Establish/Modify Compliance Organization (#4, #5, #6)
 Create an independent Compliance Officer who reports to the Chief Executive Officer
and the Board, or to a committee thereof (SOE, P59)
 The program is supervised by an officer or other high-ranking official; this official has
independent access to the board and/or CEO (SOE, P58)
 Senior management may designate compliance officials within the company; This may
be a position devoted exclusively to compliance matters or may be an assigned duty of
an employee (SOC, P13 and P15)
Document Standards, Policies, and Procedures (#1, #9)
 Company has in place rigorous procedures and processes (SOC, P4)
 Companies should invest in systematic preventive measures to keep the company in
compliance with the Commission’s statutes, regulations and orders (SOC, P16)
 The company has an established, formal program (i.e. plans, policies, and procedures)
for internal compliance. It is well documented (SOE P58)
 An inventory of compliance practices (SOE, P59)
 Promote compliance by identifying measurable performance targets (SOE, P59)

Communicate Standards, Policies, and Procedures (#10, #11)
 The ICP is widely disseminated within the company (SOE, P58)
 These factors include … the scope and depth of employee training (SOC, P5)
 The importance [of] tools and training sufficient to enable employees to comply with
Commission requirements (SOC, P6 and SOE, P59)
 Systematic and effective preventive measures (such as careful hiring, training,
accountability, and supervision), are fundamental to an effective compliance program
(SOC, P16)
 The company frequently provides training to all relevant employees; the training is
sufficiently detailed and thorough to instill an understanding of relevant rules and the
importance of compliance (SOE, P58)
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
21
Internal Compliance Program Assessment
Implement, Promote, and Enforce (#12, #13, #14)




It is not enough to create a good compliance program on paper; the company must carry
through to implement the program (SOC, P16)
A company has rigorous procedures and processes that provide effective accountability
for compliance (SOC, P4 and SOE, P58)
The company responds to wrongdoing (SOE, P58)
Steps taken by a company to end violations and remedy the misconduct (SOC, P21)
Monitor, Audit, and Report (#15, #16, #17)
Auditing and Reporting
 Systematic internal auditing (SOC, P19)
 The company has an ongoing process for auditing compliance with Commission
regulations (SOE, P58)
 The importance on good-faith self-reporting (SOE, P62)
 The compliance plan can call for the company to hire an independent third party auditor
to review its business practices in order to ensure compliance (SOE, P45)
ICP Review
 Periodic review and evaluation of the effectiveness of the program (SOC, P16)
 The company frequently reviews and modifies its compliance program (SOE, P58)
Continuous Improvement (#17, #19)
 Are new or modified prospective controls needed to prevent a recurrence? (SOC, P21)
 Ensure that steps are taken within the company to improve compliance practices (SOE,
P44)
 Describe measures taken by the company to end the practices that led to the violations
(SOE, P45)
 Work with industry associations to develop compliance best practices (SOC, P7);
encourage the continuing exchange of ideas and best practices among regulated
companies (SOC, P7)
Leadership/Corporate Culture (#7, #8)
 The responsibility for a culture of compliance rests squarely on the shoulders of senior
management (SOC, P13)
 Senior management actively involved in compliance efforts (SOE, P58)
 Senior management provides adequate resources for the compliance program to
operate adequately (SOC, P14 and SOE, P58)
 These factors include the active support of senior management (SOC, P5)
 Senior management should communicate to employees its commitment to compliance
frequently, both formally and informally (SOC, P14)
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
22
Internal Compliance Program Assessment
APPENDIX B: Selected Example ICP Practices
Internal Compliance Program
1. Outline and describe the elements of the ICP in an overview document that
includes the following sections:
a. Purpose, Background, and Program Overview
b. Senior Management, Compliance Officer and Internal Compliance
Program Core Members (including roles and responsibilities)
c. Risk Assessment
d. Internal Controls
e. Measurable Compliance Performance Targets
f. Compliance Communication and Training
g. Self-Audit and Self-Certification
h. Self-Reporting
i. Documentation and Record Keeping
j. Version History
k. Attachments/Links
i. Applicable Reliability Standards
ii. Organizational Chart
iii. Terms and Definitions
2. Outline and describe the elements of ICP in an overview document that includes
the following:
a. Compliance Culture including organization, senior management
commitment, funding, staffing, communication and ICP dissemination.
b. Control Environment including monitoring, tracking, control,
documentation, data retention, reporting, remediation, risk assessment.
c. Continual Improvement including internal auditing, education and training.
3. Along with the ICP overview document, develop an “ICP Handbook” companion
document that includes specific ICP “plans” associated with the ICP. These
plans are detailed processes and/or procedures, which also include the purpose,
objective, responsibilities, reference documents and revision history for each
plan.
Identify and Update Requirements
1. Create a list (in a database, in spreadsheet form, or as a word document) which
clearly identifies all applicable NERC and WECC Reliability Standards. The list
should:
a. Be updated on at least an annual basis, but more frequently as
appropriate.
b. Contain information as to where NERC and WECC Reliability Standards
may be found.
2. On the list of applicable NERC and WECC Reliability Standards, assign specific
Standard Requirements to certain employees, e.g. Subject Matter Experts
(SMEs) or Reliability Standard Owners.
a. The employees would be obligated to continuously monitor and track
compliance with assigned NERC Reliability Standards.
i. List any specific tasks required for compliance
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
23
Internal Compliance Program Assessment
ii. List any measureable compliance performance targets associated
with tasks required for compliance
3. Ensure new or modified Reliability Standards are promptly identified and
communicated to those required to comply with the standards.
a. Conduct regular (e.g. quarterly) reviews of applicable NERC and WECC
Reliability Standards to ensure that:
i. All applicable Standards are being addressed;
ii. Any changes to Standards are being incorporated into the entity’s
ICP; and
iii. Entity personnel remain aware of any updates, additions, or
modifications to the Standards.
b. Review ICP following NERC or WECC information release, e.g.,
Compliance Application Notices, Updates on Audit Approach
(presentations at the CUG meetings), Reliability Standard Interpretations,
et cetera.
4. Develop or implement a comprehensive compliance tracking solution, beyond a
spreadsheet, (e.g. specialized third-party software) which includes all applicable
NERC and WECC Reliability Standards and Requirements down to the subrequirement level.
a. Document a process for updating all reliability standards on a frequent
basis while allowing multiple groups to track their compliance activities.
b. Leverage the compliance tracking solution as a depository for
documenting evidence, gap analysis records and other data related to
entity’s compliance with the Reliability Standards.
5. Convert the text of the individual Reliability Standards into hyperlinks which point
to the respective standards on the NERC website. Users of the lists can then
easily access the details of the Reliability Standards at the source.
Risk Assessment
1. At a high level, adopt a strategic risk management approach, which incorporates
the following:
a. Anticipate the Risk
i. Assume the worst can happen at any time.
ii. Anticipate the next happening.
iii. Play it out. Think it through.
iv. Figure out what you do not know.
b. Assess the Risk
i. What is the likelihood of the event?
ii. What is the magnitude?
c. Act Against the Risk
i. Establish a strategy to mitigate the risk.
ii. Maintain a holistic view of the risk and solution.
d. Adopt a Plan
i. Develop processes and procedures (specific to risk management).
ii. Identify roles and responsibilities.
2. At a high level, and with a focus on compliance and reliability risk, adopt an
Enterprise Risk Management (ERM) approach, which incorporates the following:
a. Identify Risks
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
24
Internal Compliance Program Assessment
b. Assess and Evaluate Risks
c. Integrate Risks
d. Respond to Risks
e. Design, Implement and Test Controls
f. Monitor, Assure and Escalate
3. At a high level, and with a focus on compliance and reliability risk, adopt a
strategic risk management approach, which incorporates the following:
a. Anticipate the Risk
i. Assume the worst can happen at any time.
ii. Anticipate the next happening.
iii. Play it out. Think it through.
iv. Figure out what you do not know.
b. Assess the Risk
i. What is the likelihood of the event?
ii. What is the magnitude?
c. Act Against the Risk
i. Establish a strategy to mitigate the risk.
ii. Maintain a holistic view of the risk and solution.
d. Adopt a Plan
i. Develop processes and procedures (specific to risk management).
ii. Identify roles and responsibilities.
4. Uses a point system to compile a compliance and reliability risk index score for
all entity applicable Reliability Standard Requirements and sub-requirements.
a. The score could incorporate several risk factors, including:
i. Violation Risk Factor (VRF)
ii. Actively Monitored List (AML) or equivalent list
iii. Entity violation history, (taking into account Standard Requirements
violated, Violation Impact, Violation Severity Level (VSL), and
mitigation status)
iv. WECC/NERC Most Violated Reliability Standards Reports
v. Requirements that have annual, event driven or periodic activity,
likelihood of occurrence
vi. New versions of Reliability Standards
vii. Changes in key personnel (e.g. SMEs)
b. Quantify and score the risk for each applicable Reliability Standard
Requirement.
i. Develop a method to quantify and evaluate the risk for each risk
factor and each applicable Reliability Standard Requirement, e.g.
create a risk assessment matrix listing each applicable Reliability
Standard Requirement and each risk factor.
ii. Develop a scale, e.g. a numeric scale from 1 to 5, or scale of
High/Medium/Low, and quantify the level of risk for each risk factor
for each Reliability Standard Requirement. Includes the weighting
of risk based on likelihood and magnitude factors.
iii. Aggregate the risk factor valuations into a risk index score for each
Reliability Standard Requirement.
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
25
Internal Compliance Program Assessment
c. Use the point system above to determine, based on criteria established by
the entity, which Standard Requirements pose the greatest compliance
and reliability risk.
d. Based on the risk-assessment results, the entity may choose to focus
more attention on the higher-risk Standard Requirements.
e. Clearly document the risk assessment results by Reliability Standard
Requirement:
i. Create a spreadsheet or word document with a list of applicable
Reliability Standard Requirements.
ii. Flag or otherwise identify higher-risk Requirements.
iii. List the key control(s) for each identified risk.
5. Use a more basic risk-assessment approach which assesses all entity applicable
Reliability Standard Requirements and sub-requirements and simply flags or
highlights Requirements based on risk factors. (See risk factors listed under 1.a.
above.)
6. Conduct risk assessments on a regular basis, i.e., annually, or more frequently
based on the level of risk.
7. Group or categorize related risks together to reduce management and resource
needs for mitigation activities and controls.
8. Integrate internal controls with the risk assessment, i.e., each identified risk
should have at least one key control. These key controls should be reassessed
periodically and could fall under one or more of the following general categories:
a. Preventative Controls
b. Detective Controls
c. Corrective Controls
9. Annually distribute a risk-assessment questionnaire to managers who have
compliance oversight responsibilities and employees who have direct
responsibility for compliance with Reliability Standards to help evaluate any
changes in known risks and help detect any new risks that might otherwise go
unidentified. Incorporate review of the questionnaire results into the riskassessment process.
10. Incorporate the assessment of risk associated with significant change by
anticipating and monitoring change in the following areas:
a. External Environment (regulatory/compliance, social, political,
technological, etc.)
b. Strategic Planning (business model, regulatory/compliance, services,
neighboring entities, etc.)
c. Succession Planning (executives, key employees, etc.)
Measurable Compliance Performance Targets
1. Apply the concept of "SMART" objective-setting criteria to setting and evaluating
measureable compliance performance targets. (Google for more details.)
a. Specific
b. Measureable
c. Achievable
d. Relevant
e. Time-bound
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
26
Internal Compliance Program Assessment
2. Adopt a Measurement and Analysis approach designed to develop and sustain a
measurement capability used to support management information needs.
a. Align Measurement and Analysis Activities for each high-risk Reliability
Standard Requirement:
i. Establish Measurement Objectives
ii. Specify Measures
iii. Specify Data Collection and Storage Procedures
iv. Specify Analysis Procedures
b. Provide Measurement Results to management:
i. Obtain Measurement Data
ii. Analyze Measurement Data
iii. Store Data and Results
iv. Communicate Results
3. On the list of applicable NERC and WECC Reliability Standards, list: (1) the
employees responsible for compliance; (2) any specific tasks required for
compliance; and (3) any measureable compliance performance targets
associated with those tasks.
4. Create a proactive, time-based goal for the internal investigation and evaluation
of the potential violation of a Reliability Standard Requirement. For example:
a. Define a period of time (e.g. five business days or 10 business days, etc.)
to determine whether or not a possible violation exists following the initial
internal report of a potential violation.
5. Create proactive, time-based goals for submission of Compliance documents to
WECC, including Self-Reports, Mitigation Plans, Data Requests, etc. For
example:
a. Define a period of time to promptly submit Self-Reports following the
internal determination of possible violations.
b. Define a period of time to promptly submit Mitigation Plans following SelfReport filings.
6. Set specific time-based targets (e.g. X number of days, weeks, months) to help
ensure timely completion of the following:
a. Investigation of possible violations
b. Submission of Self-Reports
c. Submission of Mitigation Plans
7. Specifically reference measureable compliance performance targets in the ICP.
Compliance Training
1. Ensure all employees and contractors receive an appropriate level training on the
ICP and NERC Reliability Standards each year or at the initiation of the business
relationship.
2. Incorporate in the training, and/or follow-up the training with a survey or
examination to measure understanding of the training material.
a. Based on the survey or examination results, make changes to the training
program as necessary.
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
27
Internal Compliance Program Assessment
Promoting Compliance through Employee Incentives
1. Non-Monetary Ideas –
a. Certificates of exceptional performance
b. Letters acknowledging an employee’s activities
c. Recognition at staff meetings
d. Congratulatory communications copied to all employees
e. Reserve a premium parking space for an employee of the month
f. Adopt an annual compliance and reliability award, and give it to the
individual that has exhibited the strongest commitment to compliance and
reliability
Internal Controls
Note: In terms of Bulk Power System (BPS) reliability, an internal control program is a
process that helps provide a Registered Entity with reasonable assurance it complies
with the Reliability Standard(s) or the operating function(s) and processes that the
Reliability Standard(s) require. Below are generic examples of control activities in
consideration of Reliability Standards.1
1. Preventive Control Activities
a. Automated compliance work management system
b. Documented NERC compliance responsibilities
c. Training regarding the policies and procedures used to ensure compliance
with the Reliability Standards
d. Use of colored lanyards or other overt identification methods to identify
escorted visitors in NERC CIP Physical Security Perimeters
e. Restricting access to assets
f. Documented configuration management program
g. Documented change management program
h. Records management system
2. Detective Control Activities
a. Automated systems that check and identify compliance discrepancies
b. Periodic review of control center communications, e.g., listening to a
prescribed number of voice recordings for each period
c. Quarterly self assessments used to identify individual who gained access
to CIP cyber areas without the proper training or background
investigations
d. Review by responsible management of compliance documentation
e. Reviews of performance against defined criteria
3. Corrective Control Activities
a. Root Cause Analysis Program
b. Event Analysis
c. Business Continuity and Recovery Plans – returns an operation to a
normal operating state after a failure or interruption
1
RAI Internal Controls Working Guide V1; Initial Version July 9, 2013
WECC Compliance Monitoring and Enforcement Program
Internal Compliance Program Assessment Version 5.0 2/2/2015
28