Possible Noncompliance Review Processing

Transcription

1 Possible Noncompliance Review Processing October 31, 2018 RAM Bayport Drive, Suite 600 Tampa, Florida (813) Phone (813) Fax

2

3 Table of Contents Page 3 of 16 Page 1.0 Purpose and Scope Purpose Scope Responsibilities Procedure Owner Procedure Overview Screening Review Notice of Data Hold for Possible Violation Preliminary Violation Risk, Disposition, and Mitigation Plan Review PNC Review Reviewing Feedback on PNC Review Completing Preliminary Violation Risk, Disposition, and Mitigation Plan Review Manager of RAM Preliminary Review Approval Enforcement Director Preliminary Review Approval for Dismissal Reference Section Appendix A High Level Process Overview... 16

4 Page 4 of Purpose and Scope 1.1 Purpose This procedure outlines the steps to be taken by the Florida Reliability Coordinating Council, Inc. (FRCC) Compliance Staff regarding the review of possible noncompliance cases entered into CTS/CITS. 1.2 Scope This procedure applies to all Registered Entity (Entity) possible noncompliance cases received by FRCC Compliance Staff regardless of the discovery method. 2.0 Responsibilities 2.1 Procedure Owner This procedure is the responsibility of the FRCC Manager of Risk Assessment and Mitigation (RAM) to maintain as necessary to keep the procedure current with the latest North American Electric Reliability Corporation (NERC) Rules of Procedure - Compliance Monitoring and Enforcement Program Appendix 4C and established FRCC procedures The review of this procedure will be performed when changes to departmental or NERC Rules of Procedure occur and have a potential impact to this processing. In addition, a review will be performed at least once every three (3) years from the last update. The review shall be documented in the Review/Modification section of this document The FRCC Manager of Risk Assessment and Mitigation is responsible for assigning related activities to the RAM Staff. RAM Staff will involve other FRCC Compliance groups in all activities referenced in this procedure This procedure will be approved by the FRCC Manager of Risk Assessment and Mitigation, the FRCC Director of Enforcement, Risk Assessment and Mitigation, and the VP Compliance, Enforcement and Reliability Performance.

5 3.0 Procedure 3.1 Overview Page 5 of Entities may submit cases of possible noncompliance or possible noncompliance cases may be received as a result of FRCC Monitoring activity (e.g., Audit, Spot-Check, Self-Certification). Based on these submissions, RAM Staff will begin this Possible Noncompliance Review processing, track, and update the RAM Active Violation and Mitigation Plan Status workbook to ensure all are processed within the required timelines In general, spreadsheets, and computer programs or other tools may be used to assist in the review of possible noncompliance cases, but all actions will be recorded in the Compliance Information Tracking System (CITS). Designated information will be available to the Entity through the FRCC Compliance Tracking System (CTS) Portal. notifications may be used to advise the Entity on some aspects of the Possible Noncompliance Review processing including the need to extend the review periods or obtain additional information In order to facilitate oversight, FRCC reporting to NERC of possible noncompliance cases will be thorough and in sufficient detail such that NERC can understand and reasonably accept the outcome reached Refer to the diagram in Appendix A for a high-level overview of the process flow. 3.2 Screening Review RAM Staff will be notified via (automatic notification from CITS) when a new potential noncompliance has been reported (e.g., Self-Report from Entity, Audit Finding from Auditor) The designated RAM Staff member will perform an initial review (screen) within five (5) business days of the potential noncompliance being identified, except for those identified during a Compliance Audit which will be screened immediately following the exit briefing with the Entity. The screening will evaluate the potential noncompliance to determine the applicability and enforceability, and the RAM Staff member will: Review the Screening tab in CITS and resolve any discrepancies with applicable functions, appropriate contact information, Standard Requirement reference information, and

6 Page 6 of 16 any other incomplete information. Complete the following fields and ensure all others have valid information: Self-Log Normally No unless this noncompliance case was entered as a result of a Self-Logging turned in by an Entity. Violation Risk Factor (VRF) Ensure value entered by the Entity is valid and correct if necessary. Use the current VRF Matrix provide on the NERC website under the Standards web page. Violation Severity Level (VSL) Review Initial Violation Description to determine magnitude of reported noncompliance and set the VSL according to the current VSL Matrix provide on the NERC website under the Standards web page. Violation End Date If this date is not known at the time of this Screening, leave blank. Note: It may be necessary for mitigating activities to be completed before the correct violation end date can be determined Complete the following fields on the Review tab: Regional Violation Description: Use the information from the Screening tab to develop the first two statements as described in the PNCR Form. Regional Reliability Impact Statement: This potential noncompliance is under review Check the Screening is Complete and the Sent to NERC checkboxes after completing the initial Screening tab. Click the Save button to save the record in CITS. Once the CITS sync to NERC has been completed, a NERC ID should be assigned to the record. If you have any sync errors and/or do not get a NERC ID assigned, open a ticket to IT to resolve Forward the original identifying the report of the possible noncompliance to frccenf@frcc.com adding the NERC ID to the end of the subject line and a brief message in the body such as Screening is complete for the referenced noncompliance to inform Enforcement that screening has been completed. Once the NERC ID has been assigned and the screening has been completed, the noncompliance case should be in the Review in Progress state.

7 Page 7 of Notice of Data Hold for Possible Violation Once notified via of the completed Screening Complete, FRCC Enforcement will then issue the Data Hold letter within seven (7) business days after the date reported. 3.4 Preliminary Violation Risk, Disposition, and Mitigation Plan Review The designated RAM Staff member will begin a review of all information provided in CITS and prepare the initial Possible NonCompliance Review (PNCR) Form using the template in SharePoint and store in the appropriate document set for that Entity. The initial form should be completed within 14 days from the initial report of the possible noncompliance and scheduled for review as noted further in this section The RAM Staff member will gather pertinent noncompliance facts as the PNCR Form is being prepared and complete all available information within the form including: The underlying facts and circumstances, including what happened, why, where, when (relevant dates), and appropriate counts of devices, types, and population sizes to assess overall impact; The Reliability Standard at issue; The applicable Violation Risk Factor (VRF) and Violation Severity Level (VSL); Root cause or contributing causes; Extent of condition; The Entity s description of the potential and actual level of risk to reliability, including mitigation factors during pendency of the noncompliance including controls in place at the entity during the issue/violation; The Entity s supplied mitigating activities for preventative and corrective processes and procedures, including internal controls; and Identify appropriate Monitoring Team Lead and Enforcement Specialist The RAM Staff member will send Data Requests to the Entity as needed to obtain sufficient information to determine risk and make a preliminary determination within 30 days of the report date of the noncompliance. The request will require that responses are uploaded to the FRCC Entity Security File Transfer location or FRCC Evidence Vault, as appropriate. All Data Requests will be uploaded to the violation record in CITS as a document type Request for Additional Information with an event Region

8 Page 8 of 16 Sent Document to Registered Entity with the date the request was sent to the Entity. When a response to the Data Request is received from the Entity, the event Region Received Document from Registered Entity will be added to the appropriate document type with the date the information was received (Note: Do not load the document(s) received from the Entity into CITS). The Data Requests may require the following information including, but not limited to: The underlying facts and circumstances, including what happened, why, where, when, and appropriate counts of devices, types, and population sizes to assess overall impact; The Reliability Standard at issue; The applicable VRF and VSL; The Entity s description of the potential and actual level of risk to reliability, assessment of extent of condition, any root cause analysis performed, and mitigation factors during pendency of the noncompliance; and The Entity s preventative and corrective processes and procedures, and internal controls; Once the basic information in the PNCR Form along with Entity provided information from the CITS Screening tab has been populated on the form, the assigned RAM Staff member will review the Entity s related compliance history and complete the appropriate section in the form. The review will include: An assessment of relevance will be made for all prior compliance history related to the same Standard/Requirement An assessment of the previous mitigation plan and evaluate why a plan was not successful in preventing this possible noncompliance to ensure the mitigation plan for the current noncompliance does not contain the same weakness. Identified issues must be reviewed with mitigating activities to ensure corrective actions are being taken as needed Professional judgement will be used to provide a conclusion in the PNCR Form regarding the impact of the compliance history and whether or not it should be considered an aggravating factor in the processing of this noncompliance. If no related compliance history is available, a summary statement will be provided indicating no compliance history was available.

9 Page 9 of The assigned RAM Staff member will then prepare the Regional Violation Description and Regional Reliability Impact Statement in the PNCR Form. They will also document any questions for a potential Data Request to the Entity to clarify the facts and circumstances of the reported possible noncompliance as well as considerations for inclusion in the Entity s mitigating activities in the PNCR Form. If the Preliminary Filing Mechanism to be recommended is an FFT, a statement explaining why this noncompliance is appropriate for FFT handling must be included in the Regional Reliability Impact Statement The assigned RAM Staff member will then use professional judgement to populate an initial recommendation on the Recommended Disposition, Preliminary Filing Mechanism, Region Reliability Impact, Mitigation Plan Type (Formal or Informal), and need to Perform Verification of Completion in the PNCR Form. Note: If mitigating activities will exceed 1 year before being completed, the Mitigation Plan Type must be Formal and the Preliminary Filing Mechanism must be SNOP or higher (cannot be CE or FFT). To ensure an appropriate number of mitigation plans are selected to be reviewed for verification of completion the assigned RAM Staff member will consider the following guidelines: 1. All formal mitigation plans will be verified regardless of disposition. 2. Informal mitigation plans will be selected for verification based on risk using the professional judgment of the assigned RAM Staff member with input from the PNCR team. At least 50% of all informal mitigation plans shall be selected for verification Mitigating activities supplied by the Entity should be reviewed by the RAM Staff member for completeness to ensure they address the following items: Mitigating activities necessary to correct identified noncompliance bringing Entity back into compliance; Extent of condition review to ensure any other related instances of a similar noncompliance are identified; Mitigating activities necessary to correct additional extent of condition identified noncompliances bringing Entity back into compliance; Root cause analysis to identify contributing causes of the noncompliance instances including those originally identified as well as those identified under the extent of condition review; Mitigating activities to address all causes identified and prevent recurrence of noncompliance including training and communication to affected Entity personnel.

10 Page 10 of When the initial PNCR Form has been populated with the above information, a comment will be added to the FRCC Region ID / NERC ID field on the form with the following text: PNCR Team: Please review, comment accordingly, and reply to this comment when complete with an indication of agreement or dissent as appropriate The RAM Staff member will then enable track changes and save the form in SharePoint as noted above The RAM Staff member will then generate an to the identified Monitoring Team Lead, Enforcement Specialist, and RAM Staff with a copy to both Monitoring Managers and the Enforcement Director using the template in SharePoint PNC Review Request Template requesting the review to be completed within 14 days of the notification.

11 Page 11 of PNC Review Each recipient of a PNC Review Request will review the content of the completed form identified in the within the 14-day timeframe. Should the original reviewer be unavailable, their manager will be responsible for completing the review on their behalf or assigning it to another member of their team. Professional judgement will be used to: Ensure all facts and circumstances are clearly identified and understood; Risk has been appropriately identified; Noncompliance disposition is appropriate (Note: Enforcement will note any unique variance with an explanation); and Mitigation Plan handling is appropriate The reviewer will provide any required wording adjustments to add clarity to the Regional Violation Description and Regional Reliability Impact Statement in the PNCR Form The reviewer will add comments in the appropriate locations where questions or concerns arise during their review The reviewer will note any potential Data Request questions that may be necessary as well as mitigating activities that we will ensure the Entity addresses The reviewer will reply to the comment located at the top of the PNCR Form on the FRCC Region ID / NERC ID indicating their completion of the review and concurrence or disagreement with proceeding After completing their review, the reviewer will reply to the received with a brief note indicating they have completed their review. 3.6 Reviewing Feedback on PNC Review Once the period for review has passed or feedback has been received from all required members, the RAM Staff member will review and comment on the feedback provided The RAM Staff member will send Data Requests to the Entity as needed to obtain sufficient information to determine risk and make a preliminary determination within 30 days of the report date of the noncompliance. The request will require that responses are uploaded to the FRCC Entity Security File Transfer location or FRCC Evidence Vault, as appropriate. All Data Requests will be uploaded to the violation record in CITS as a

12 Page 12 of 16 document type Request for Additional Information with an event Region Sent Document to Registered Entity with the date the request was sent to the Entity. When a response to the Data Request is received from the Entity, the event Region Received Document from Registered Entity will be added to the appropriate document type with the date the information was received (Note: Do not load the document(s) received from the Entity into CITS). The Data Requests may require the following information including, but not limited to: The underlying facts and circumstances, including what happened, why, where, and when; The Reliability Standard at issue; The applicable VRF and VSL; The Entity s description of the potential and actual level of risk to reliability, assessment of extent of condition, any root cause analysis performed, and mitigation factors during pendency of the noncompliance; and The Entity s preventative and corrective processes and procedures, and internal controls; The RAM Staff member will document the data request responses received from the Entity in the PNCR Form and advise the team members of such response The RAM Staff member will directly contact any team member with significant questions or concerns to resolve. If necessary, the RAM Staff member will immediately schedule and coordinate any required meeting Updates regarding these conversations and/or meetings should be noted in the PNCR Form If the extent of condition review is a part of the Entity s mitigating activities and not yet completed, the RAM Staff member will wait for that activity to be completed and update the PNCR Form with the results of that review before proceeding to complete the preliminary review in CITS Once concurrence with the description, risk, disposition, and mitigation plan handling has been obtained, the RAM Staff member will complete the preliminary review in CITS using the next section.

13 Page 13 of Completing Preliminary Violation Risk, Disposition, and Mitigation Plan Review The RAM Staff member will update the violation record Review Completion and Mitigation tabs within CITS for the possible noncompliance using the following steps Using the updated information in the PNCR Form, complete the Review Completion tab in CITS by filling in the Preliminary Filing Mechanism and Region Reliability Impact. Update the Region Violation Description and Region Reliability Impact Statement fields using the agreed wording in the PNCR Form. The first two sentences of the Region Violation Description field description must be formatted as shown in the PNCR Form to be used for the Notice of Possible Violation (NPV) letter The completed PNCR Form will be stored in SharePoint under the appropriate Entity document set, as well as attached in CITS with the document type of Potential Noncompliance Review and no event as evidence for the violation record The RAM Staff member will also add a review record on the same tab (i.e., Add Review button) indicating if it is a noncompliance or dismissal, and provide Reviewer Notes regarding the completion of the PNC Review (including date completed). The Review is complete and move to the FOLLOWING review radio button should be selected, and the Compliance Enforcement Manager (CEM) selected in the drop down. Click the Apply button Update the violation record in CITS, if necessary, to require or not require a Formal Mitigation Plan using the Is Formal Mitigation Plan Required radio button on the Mitigation tab. In the case that a noncompliance requires a Formal Mitigation Plan, the RAM Staff member will contact the Entity regarding submittal of a Formal Mitigation Plan in addition to the automated that will be generated by CITS when the flag is changed. With all the updates made, check the Send to NERC box, and Save the violation record. Note: Mitigation Plans for CE s or FFT s should be Informal Mitigation Plans unless extenuating circumstances exist which must be documented to support the request for a Formal Mitigation Plan The RAM Staff member will then forward the screening completed to the Manager of RAM that the Review Completion tab is ready for CEM review and copy frccenf@frcc.com. If the Recommended Disposition is to dismiss the noncompliance, forward instead to the Director of Enforcement that the Review Completion tab is ready for CEM review and copy frccenf@frcc.com.

14 Page 14 of Manager of RAM Preliminary Review Approval The Manager of RAM will review the noncompliance once the Review Completion tab in CITS has been completed and they have been notified via The Manager of RAM will accept or reject the preliminary determination by adding a review record on the same tab (i.e., Add Review button) indicating if it is a noncompliance or dismissal, and provide Reviewer Notes regarding their concurrence or disagreement. The Review is complete and this is the LAST review radio button should be selected. Click the Apply button and then confirm this is the last review. With the updates made, check the Send to NERC box, and Save the violation record Once the CEM review has been completed, the Manager of RAM will reply to the received notifying the RAM Staff member and Enforcement (copy reply to frccenf@frcc.com) the CEM review has been completed and noncompliance is ready for Enforcement determination processing The RAM Staff member will use the RAM-201 Mitigation Plan Processing procedure to continue Mitigation Plan processing If Enforcement determination processing provides feedback requiring a reassessment of the PNCR Form, the RAM Staff member will update the PNCR Form as needed. 3.9 Enforcement Director Preliminary Review Approval for Dismissal The Director of Enforcement will review the noncompliance once the Review Completion tab in CITS has been completed and they have been notified via The Director of Enforcement will accept or reject the preliminary dismissal determination by adding a review record on the same tab (i.e., Add Review button) indicating if it is a noncompliance or dismissal, and provide Reviewer Notes regarding their concurrence or disagreement. The Review is complete and this is the LAST review radio button should be selected. Click the Apply button and then confirm this is the last review. With the updates made, check the Send to NERC box, and Save the violation record Once the CEM review has been completed, the Director of Enforcement will reply to the received notifying the RAM Staff member and Enforcement (copy reply to frccenf@frcc.com) the CEM review has been completed and noncompliance is ready for Enforcement determination processing of the dismissal.

15 Page 15 of If Enforcement determination processing provides feedback requiring a reassessment of the PNCR Form, the RAM Staff member will update the PNCR Form as needed. 4.0 Reference Section NERC Rules of Procedure - Appendix 4C Compliance Monitoring and Enforcement Program document NERC Rules of Procedure - document.

16 Registered Entity Enforcement Risk Assessment and Mitigation Monitoring Page 16 of 16 Version Appendix A High Level Process Overview FRCC Possible Noncompliance Processing (Revised 06/14/2017) Audit & Spot Check Noncompliance Activity Possible Noncompliance Review Self-Logging & MRRE LRE Notifications of Noncompliance Activity CITS Initial Screening Possible Noncompliance Review CITS CEM Review Issues / Concerns? Notify Enforcement Mitigation Plan Processing Yes Possible Noncompliance Review Enforcement Processing Data Hold Notice Self-Report Noncompliance Activity Completed within 5 days of report Completed within 7 days of report Initial review start within 14 days of report Note: Data Request(s) during PNC Review may delay 30 day timeline. PNC Review completed within 30 days of report