Do Not Be Afraid How Auditing and Monitoring Can Make Your Compliance and Ethics Program Stronger. Overview

Transcription

1 Do Not Be Afraid How Auditing and Monitoring Can Make Your Compliance and Ethics Program Stronger Helen A. Goodwin, CCEP, Ethics Program Manager Sheree Tanner, CPA, Internal Audit Jenifur Rancourt, Manager, FERC Compliance Bonneville Power Administration Portland, Oregon The Society of Corporate Compliance and Ethics 2013 Utilities and Energy Compliance and Ethics Conference Overview Celebrating 75 Years Operational Excellence A BPA Core Value Building a Successful Compliance & Ethics Program How to Use Program Review/Internal Audits to Make Your Program Stronger The Benefits of Comparing Your Program to Industry Best Practices Engaging Executive Management to Implement Program Change 2 1

2 BPA s Public Mission Assure economical and reliable power supply Ensure access to safe and reliable transmission Public preference and regional preference Environmental stewardship: Mitigate impacts of our operations on environment, fish and wildlife Provide regional leadership in conservation and renewable resource development Preserve and balance the benefits of the Federal Columbia River Power System 3 BPA s Core Values In carrying out our public mission, BPA is guided by three core values. Trustworthy Stewardship Collaborative Relationships Operational Excellence: Operational excellence is continuously improving the way we do business to produce more efficient and effective ways of delivering on BPA s mission and vision. Achieving operational excellence will place us among the best electric utilities in the nation. 4 2

3 BPA -- Celebrating 75 Years Established in 1937 Markets power at cost from 31 federal dams and 1 nuclear plant over one-third of electricity used in PNW Markets transmission services owns 75% (15,000 miles) of the high-voltage lines in PNW Protects, mitigates & enhances fish & wildlife in the Columbia River Basin 300,000 square mile service area includes WA, OR, ID, and Western MT Self-funded federal agency. Sets rates to recover costs. $3.5 billion in annual revenues 3000 employees Headquarters in Portland, OR Dexter Hills Creek California Washington Chief Joseph Chandler Ice Harbor The Dalles McNary Bonneville John Day Big Cliff Foster Detroit Green Peter Cougar Lookout Point Lost Creek Green Springs Mica Keenleyside Oregon Revelstroke Duncan Wells Rocky Grand Reach Coulee Rock Island Lower Lower Wanapum Rosa Monumental Granite Priest Rapids Little Goose Albeni Falls Libby Dworshak Hells Canyon Oxbow Brownlee Black Canyon Boise Diversion Swan Falls Anderson Ranch American Falls C J Strike Bliss Minidoka Upper Salmon Falls Nevada Hungry Horse Idaho Columbia Basin BPA Service Area BPA Transmission Grid Federal Dams: Corps of Engineers Bureau of Reclamation Non-Federal Dams Canadian Dams Canada U.S.A. Palisades Utah 5 Montana Wyoming BPA -- Eyes on the Future 6 3

4 Compliance & Governance Program Structure BPA Administrator & CEO Chief Operating Officer Deputy Administrator Audit and Internal Controls Committee Internal Audit Compliance & Governance EEO & Civil Rights Ethics FERC Compliance Governance & Internal Controls Purchasing & Property Governance 7 Approach to Building a Successful Compliance & Ethics Program The U.S. Federal Sentencing Guidelines Leadership, Oversight & Chain of Command Process & Procedures/Written Standards Communication & Training Monitoring & Auditing Reporting/Investigation Enforcement & Discipline Response & Prevention Evaluation Risk Assessment 8 4

5 BPA s Ethics Program 9 BPA s Award Winning Ethics Program BPA s ethics program has received awards from the Office of Government Ethics and 2011 award for BPA s creative, interactive webbased training programs award for Code of Conduct, surveys, communication campaign, etc blue ribbon for BPA s display at the OGE conference. How did BPA get there? This session will focus on BPA s commitment to monitoring/auditing, risk management and evaluation and program the journey from a basic, requirements driven program to an integrated, enhanced ethics program. 10 5

6 Pre-2006 Following the Legal Requirements Employees required to follow the Standards of Ethical Conduct for Employees of the Executive Branch/Hatch Act. Gifts Conflict of Interest/Appearance of a Conflict of Interest Post-Employment Political Activities Ethics attorneys in Office of General Counsel focused on meeting the intent of the law. Review/Approval of Financial Disclosure Forms Ethics Advice Post-Employment Ethics Training 11 Post 2006 Taking BPA s Ethics Program to the Next Level Event triggered focus on ethics risks. Strong message from the top that this won t happen again. BPA s commitment to go beyond the basic Federal requirements by: Risk Assessment: Identifying ethics as a top tier enterprise risk. Monitoring/Auditing: General and specific ethics surveys. Monitoring/Auditing: Internal Audit review of BPA s Ethics Program. Evaluation: Compare to industry best practices. 12 6

7 Make Your Program Stronger BPA s Ethics Program Monitoring/Auditing Risk Assessment Program Evaluation General Surveys Specific Surveys Program Review Ethics Program Top Tier Enterprise Risk Risk Refresh Compare to Industry Best Practices (2013) 13 Compliance & Governance Ethics Risk Assessments 14 7

8 Ethics Risk Assessment Active use of risk management is the key to early detection of possible events and mitigation. Risk based program goals/ objectives are developed annually to: Meet internal and external requirements Identify gaps against regulatory requirements Prioritize significant ethical risks Anticipate future risks and risk trends Identify events that can derail program objectives Identify events that can harm reputation Analyze frequency and severity 15 Ethics Risk Assessment In 2007 The Enterprise Risk Management Committee identified fraud and unethical behavior as a top tier enterprise risk. A treatment plan was developed and approved including: Ethics Program Manager BPA Code of Conduct 3 rd Party Operated Ethics Hotline Ethics Survey Ethics Training Communication 16 8

9 Ethics Risk Assessment Two follow up risk assessments were conducted in 2010 and The results were presented to executive management. A new risk identified in the 2010 risk refresh revolved around changes in the economy and employee behavior as a result of those changes. The 2012 risk refresh showed the risk identified in 2010 to be without merit. It also recommended continuing to perform risk assessments as an industry best practice. The next risk refresh is scheduled for Monitoring and Auditing BPA Defines Monitoring and Auditing as: Regular and random review of records. Data collection and tracking provide trend analysis and measure progress. Monitoring Success of BPA s Ethics Program Through Surveys: General: Pre/post implementation of the BPA Code of Conduct and Ethics Hotline. Specific: Use of time, supplies and equipment. Review of BPA s Ethics Program through Internal Audit. 18 9

10 Compliance & Governance Ethics Surveys 19 BPA s Ethics Survey Baseline, random sample ethics survey conducted in June 2009 Determine employees awareness of BPA ethics rules, policies and available resources In early 2010 BPA implemented its enhanced ethics program. BPA Code of Conduct Ethics Hotline In the fall of 2010 BPA repeated the ethics survey to evaluate progress & employee understanding of the rules and available resources

11 BPA s Ethics Survey Results Of the employees who believed they observed an ethics violation, fewer stated they did not report the observed violation in 2010 than in Further the majority of respondents in 2010 said: There are established rules of conduct They can see the rules demonstrated in the workplace BPA make an effort to inform employees of the Code of Conduct BPA ethics training helps employees handle ethically challenging situations. BPA is effective in communicating ethics responsibilities to employees. 21 Use of Time Supplies and Equipment Surveys 22 11

12 Use of Time Supplies and Equipment Surveys To measure success, a random sample survey was ed and evaluated in late A stretch goal was to set and approved by executive management: 80% of employees agree they had a better understanding in 2012 than in After the results were evaluated a communication strategy was developed and implemented. A second random sample survey was developed and implemented at the end of More (5 percentage points) in 2012 agree that they had a better understand of the rules than last year. 23 Internal Audit Ethics Program Review 24 12

13 Internal Audit: Ethics Program Review Background - Stakeholders have responsibility to monitor, audit, and evaluate effectiveness of ethics program. Objective of audit To determine whether implementation was consistent with the original plan. Scope of audit Key program design elements, roles and responsibilities. 25 Ethics Program: Design Elements Program manager hired completed Code of conduct completed Training gap for Ethics for New Managers Metrics completed Hotline completed Ethics in performance reviews completed Communication - completed 26 13

14 Ethics Program Federal Sentencing Guidelines Seven program components. Show due diligence in preventing and detecting violations. Promote an organizational culture that encourages ethical conduct and a commitment to compliance with the law. Effective compliance and ethics program which is best practice. 27 BPA Ethics Program Improvements from Internal Audit Recommendations Strategy and vision for ethics program. Annual communication plan for ethics program. Plan to address issues and trends from ethical investigations. Periodic risk assessments of ethical behavior

15 Federal Sentencing Guidelines See handout. 29 Do Not Be Afraid: Internal Audit 1. Make your program stronger. 2. Compare to best practices (FSG). 3. Engage management in program change (audit recommendations)

16 B R E A K 31 Compliance and Governance Reliability Compliance 32 16

17 BPA s Reliability Compliance Program BPA Administrator & CEO Chief Operating Officer Deputy Administrator Audit and Internal Controls Committee Internal Audit Compliance & Governance FERC Compliance EEO & Civil Rights Ethics Reliability Compliance Tariff Compliance Governance & Internal Controls Purchasing & Property Governance Standards of Conduct 33 An Analogy Matures 34 17

18 Regulatory Changes 35 Changing Compliance Framework NERC Rules of Procedure WECC Compliance Monitoring and Enforcement Program NERC Actively Monitored Standards List (AML) NERC & WECC Compliance Bulletins NERC Compliance Application Notices NERC Compliance Analysis Reports FERC reports WECC ad hoc processes WECC Guidance at industry meetings And a FERC reliability audit! 36 18

19 37 Impacts of Instability Frustration Confusion Missed deadlines Never enough resources No chance to get ahead of obligations Always in the 100 space (damage control) Always putting out fires 38 19

20 Fitting in Monitoring and Auditing Start with the basics Annual internal evidence reviews Enhance the basics Review 100% of evidence for all standards every year Automate the process Assures readiness for unexpected spot checks, regional investigations, etc. 39 The Basics: BPA Examples Reliability Compliance staff perform formal annual evidence review Takes several months each year Involves intense collaboration with SMEs Preparation for self-certification and regional audits Enhancements Executives decision: include all NERC reliability standards, not just the AML Uses automated GRC software Includes internal certification by every manager associated with each SME Results Minimal effort to respond to a recent NUC spot check Ready and able to respond to audit scope increases 40 20

21 Fitting in Monitoring and Auditing Gradually add more tasks Mid-term spot checks Review data or investigate incidents Add periodic and event monitoring Tap into existing data streams Daily, weekly, monthly reports s to alert operational staff to events 41 Add More Tasks: BPA Examples BPA compliance manager contracts & organizational performance targets require increased monitoring 2 spot checks completed FY10, vs. 4 FY13 to date Maintenance and inspection work order progress MOD-001 calculations/number of hours missed CIP access revocations following separation Some workload is shared through partnerships with Internal Audit 1 event-triggered subscription in FY08, vs. 3 in FY13 to date Suspected misoperations Suspected vegetation-related outages 42 21

22 Add More Tasks: BPA Examples Continued BPA compliance manager contracts & organizational performance targets require increased monitoring 2 data streams monitored in FY11, vs. 6 in FY13 to date Daily dispatch log Outage log Weekly patrol progress reports Results Increased operational awareness Early detection of problems prior to violation 43 Fitting in Monitoring and Auditing Monitor framework changes Watch for opportunities to comment on proposed document revisions Check the regional, NERC, and FERC websites Comment on CANs, CARs, and FERC reports Analyze & act on final versions 44 22

23 Monitor the Framework: BPA Examples Program staff included on internal requests for comments on WECC/NERC/FERC drafting projects Program staff assigned as SMEs for compliance framework drafting projects Must pick our battles; not enough time to comment on everything Regulatory websites monitored for new CANs, CARs, reports Results Contribute to clear, effective regulations and framework documents Ensure the agency assesses response actions following reports and analyses 45 A Stronger Program Workload is an ongoing challenge, but Detect problems before they lead to violations Better understand how compliance ties into operations See and prepare for changes before they occur Have a solid baseline from which to respond to unexpected events 46 23

24 A Smoother Ride 47 Do Not Be Afraid Conclusions Monitoring and Auditing Can Make Your Program Stronger 48 24

25 Do Not Be Afraid: Continuous Improvement BPA is committed to continuous improvement. Benchmarking and adopting best practices is key. Continue to conduct general and specific random sample surveys. Risk assessments at agency, group and program level. Engage executive management at all levels. First line supervisor is key to program success. BPA s program includes all nine elements from the Sentencing Guidelines; is active and making a difference. 49 Do Not Be Afraid: BPA s Next Steps Focus measurement less on activities and looking back. Instead, develop program elements that will get out in front of potential issues and problems. Actively enlist the support and active involvement of leaders and business partners across BPA. Communicate results and plans for improvement

26 Do Not Be Afraid: Words of Advice Build your auditing and monitoring program around your mission. Engage & involve executive management often. Leverage your culture, people, traditions and history. Involve the right people and strive for continuous improvement. There is no one-size-fits-all monitoring and auditing model or framework. 51 Do Not Be Afraid Auditing & Monitoring Can Make your Ethics and Compliance Program Stronger Questions? 52 26

27 Contacts for Additional Information Helen Goodwin, CCEP, Ethics Program Manager, Sheree Tanner, CPA, Internal Auditor Jenifur Rancourt, Manager, FERC Compliance