How to Select a NERC Compliance Consultant

Foreword

Foreword

This professional reference is one of a series Energy Compliance, Inc. publishes for registered entities and the people who run their compliance programs.

I have worked on every side of the bulk electric system. I have operated control centers as a Reliability Coordinator, Transmission Operator, and Power System Operator. I have audited grid facilities and signed off on findings as a senior compliance auditor. I have worked enforcement matters from inside the regulator's process. For the last several years I have advised registered entities directly through the firm I founded.

The entities that do reliability well share a common habit. They take the standards seriously without confusing them with reliability itself. They know that a NERC Reliability Standard is a floor, not a ceiling. They know that compliance is something an auditor evaluates, while reliability is something a system either delivers or does not. They prepare for audits by building programs that survive real questions, not binders that look thick.

That is the perspective these references try to share, one topic at a time.

They are written for the compliance manager who wants to understand the system, not just memorize requirements. For the counsel who has to brief a board honestly. For the new compliance hire who was handed a binder and told good luck.

Energy Compliance exists because much of the consulting offered to registered entities today is structured for billable hours rather than for outcomes. Every engagement is overseen by a senior practitioner. We do not bring five people to a meeting that needs one. We automate the work that should be automated, and we apply senior judgment to the work that requires it. If that approach is what you are looking for in a compliance partner, the back of this reference has our contact information.

If not, the reference still belongs to you. Take what is useful. Apply it well. And remember the only test that ultimately matters: when the system needs to perform, does it?

Rob Smith

Founder and Principal, Energy Compliance, Inc.

Executive Summary

Executive Summary

Selecting a NERC compliance consultant is a risk decision dressed up as a procurement decision. The proposal stage looks like vendor selection. The two-year outcome looks like reliability exposure.

Entities that treat the choice as procurement evaluate scope, price, and headcount. Entities that treat it as risk management evaluate seniority, accountability, and whether the engagement reduces program complexity or adds to it. The first group ends up with bigger programs. The second ends up with smaller, defensible ones. Once you know what to look for, the patterns that separate strong consultants from weak ones are not subtle.

This reference walks through those patterns in eight chapters: why selection is a risk decision, how activity differs from value, why overstaffed models fail, how complexity gets manufactured, the markers of strong and weak consultants, how to evaluate an engagement after it ends, and the one question that settles most selections.

Key Takeaways

• A good consultant reduces your workload. A weak one increases it and calls the increase progress.
• Headcount on a proposal signals scope inflation, not depth.
• If the senior named on the contract is not the senior in the room, the engagement is already off track.
• Activity and value can look the same for months. By the next audit, in our view, they have diverged.
• Complexity that arrives during a consulting engagement rarely leaves with the consultant.
• The right consultant makes the program easier to explain, not harder.
• Judge the engagement by how it holds up at audit. The rest is process aesthetics.

Chapter 1

Selection Is a Risk Decision, Not a Procurement Exercise

Most entities source compliance support the way they source office furniture. The economics of that mistake show up two audits later.

1.1 Why the Procurement Frame Fails

Compliance consulting touches the same risk surface that Compliance Audits, enforcement actions, and Notices of Penalty operate on. The consultant the entity selects ends up shaping the documentation the auditor reads, the evidence the regulator reviews, and the answers the subject matter expert gives in the interview. None of that is a procurement outcome. It is a reliability and enforcement outcome that happens to be procured.

The procurement frame favors written scope, fixed price, headcount, and references over substance. It assumes consultants are interchangeable as long as the line items match. They are not. Two firms with identical proposals will run engagements that look nothing alike six months in. The seniority of the practitioner running the work, the discipline of the methodology, and the willingness to push back on bad ideas are not procurement variables.

1.2 The Questions Risk Management Asks

Treating the selection as risk management changes the questions. Who is actually doing the work, as opposed to who appears on the org chart? What will the deliverable look like at audit, not in the proposal? How does the engagement end, not how does it begin? Will the program be simpler or more complex when the engagement closes? Those are risk questions, and they predict outcomes the procurement frame cannot.

The cost of a bad selection is not the consulting fee. It is the audit finding that traces back to a documentation pattern the consultant introduced, the Mitigation Plan that takes twice as long because no one inside the entity owns the program, and the next consultant hired to fix what the previous one built. Whatever the procurement process saved on the original engagement disappears inside the first remediation cycle.

From the Field

If your selection criteria are scope, price, and headcount, you have already optimized for the wrong outcome.

Chapter 2

The Difference Between Activity and Value

Activity is visible immediately. Value shows up at audit. In our view, the two can look the same for months.

2.1 Two Different Measures

Activity is the visible work product of a consulting engagement. Meetings held. Documents drafted. Spreadsheets updated. Status reports issued. Activity is comforting because you can watch it happen, and because it generates artifacts the entity can point to when leadership asks what the consultant has been doing.

Value is different. Value is whether the program is more defensible than it was six months ago. It is whether the operators can explain the program in their own words, whether the subject matter expert interviews land cleanly, and whether the documentation reconciles with operational reality. Value shows up at audit, in mitigation timelines, in Self-Report rates, and in the absence of rework. It is rarely visible in real time.

2.2 Why the Gap Goes Unnoticed

The disconnect matters because the two measures can run in opposite directions for months without anyone noticing. A consultant generating high activity can be producing low value, and the entity may not see the gap until the next audit. By then the cost of the misalignment is locked in. Activity-focused consultants understand this and lean into it. The proposal emphasizes hours, deliverables, and meeting cadence. Outcomes go unmentioned until someone has to defend them.

Strong consultants invert the relationship. They produce less visible activity, with fewer status reports and fewer artifacts. They spend a disproportionate share of their effort on the small number of decisions that change audit outcomes. That makes them harder to evaluate by procurement metrics and easier to evaluate by the only metric that matters at audit: did the program survive the question?

From the Field

Activity is what the engagement looks like. Value is what the audit looks like. They are not the same number. If your consultant's status reports are dense and your audit posture has not changed, you are paying for activity. Less visible work, more defensible program. That is the trade strong consultants make.

Chapter 3

Why Overstaffed Models Fail

Bringing five people to a meeting that needs one is not depth. It is scope inflation in headcount form.

3.1 The Roster Signal and What Follows

Overstaffed engagements present as depth. The proposal lists a partner, a manager, two senior consultants, a junior, and a project coordinator. The roster looks reassuring because it suggests bench strength and the promise that no question will go unanswered. In my view, what the roster signals is that the firm needs to bill those hours to make the engagement profitable. By signing, the entity agrees to absorb that staffing model as a cost of doing business.

Once the engagement starts, the dysfunction becomes visible. Decisions take longer because they have to be socialized across the team. Deliverables go through internal review cycles that add weeks without adding substance. Communication channels multiply, and the entity ends up with three points of contact for what should be one conversation. The senior named in the proposal appears at the kickoff and the close. The work in between is run by people who are still learning the entity's program.

3.2 Accountability and Economics

The accountability picture is worse. When something goes sideways, no single person owns the outcome. The partner blames the manager, the manager blames the consultants, and the entity is left holding a finding that no one on the consulting team feels personally responsible for. Multi-headed engagements have a structural property: accountability thins out as the team gets bigger.

The economics do not work in the entity's favor either. Fewer senior hours and more junior hours tend to produce a deliverable that costs more to defend at audit, not less. The audit team tests the Registered Entity against the Reliability Standards for the functions it is registered for, in accordance with NERC guidance (Appendix 4C, Section 4.1). It does not adjust its scrutiny based on which consultant wrote which page. The entity pays for the original work and then pays again for the rework needed to make it defensible.

From the Field

Overstaffing is a billing model, not a depth signal. The senior on the proposal is rarely the senior in the room. Every additional consultant on an engagement adds coordination overhead that the entity pays for. When the team is large and the outcome is wrong, no one on that team owns the outcome.

Chapter 4

How Consultants Manufacture Complexity

Complexity is a defensible billing strategy. Once introduced, it rarely leaves with the consultant.

4.1 How Complexity Becomes Load-Bearing

Complexity does not always arrive by accident. In compliance engagements it is sometimes manufactured, because complex programs require ongoing consulting support and simple ones do not. The methodology grows. The documentation framework expands. The naming conventions get baroque. The internal control matrix multiplies categories. None of this is unethical on its face, and all of it generates billable work the entity then depends on.

The mechanism is straightforward. A consultant introduces a structure more elaborate than the standard requires. The structure is well documented. The entity adopts it because the consultant recommended it and the documentation looks professional. Six months later, the structure is embedded deeply enough that removing it feels destabilizing. The entity keeps engaging the consultant because the consultant is the only party who understands what they built. At that point the complexity is load-bearing.

4.2 What Strong Consultants Do Instead

Strong consultants do the opposite. They simplify. They cut documentation that does not change audit outcomes. They consolidate controls that are doing the same work. They push back on internal practices that have grown beyond what the standard requires. They leave the program smaller than they found it, even when that shortens the engagement.

The test for the entity is simple to apply. Six months into the engagement, ask three things. Is the program easier to explain than it was at kickoff? Are there fewer documents to maintain? Are decisions clearer? If the answer is no, the consultant is adding mass, not value.

From the Field

Complex programs require ongoing consulting support. Simple ones do not. The economics push consultants toward complexity. If the framework introduced is more elaborate than the standard requires, you are paying for retention, not protection. Strong consultants leave the program smaller than they found it. That is the leading indicator of value.

Chapter 5

The Markers of a Strong Consultant

Strong consultants share a small set of operating habits. They are visible early, and they predict outcomes.

5.1 They Have Sat on More Than One Side of the Table

Strong compliance consultants share a recognizable profile. They have been the operator, or the auditor, or both, before becoming the advisor. Their advice is not theoretical because their failures were not theoretical. They have watched programs come apart at audit and know which choices made earlier in the cycle produced the failure.

5.2 They Write Directly

The deliverables are short, grounded in evidence, and structured for the question the auditor will actually ask. Strong consultants do not pad. They do not hedge unless the standard requires hedging. They do not produce 40-page memoranda when 8 pages would do, and they do not bury the recommendation under qualifications.

5.3 They Push Back

When the entity proposes a control that does not match the operation, they say so. When a documentation pattern will not survive a subject matter expert interview, they raise it. When the entity wants to over-document for comfort, they decline to bill the hours. Strong consultants are willing to lose the next engagement to give an honest answer on the current one.

5.4 One Named Person Is Accountable

The senior on the proposal is the senior in the room. The escalation path is direct. The deliverable carries that person's name, and that person stands behind it at audit. There is no diffusion across a team that lets accountability evaporate when the audit goes sideways.

From the Field

Strong consultants have operated on more than one side of the table. Their advice is not theoretical because their failures were not. They write short, push back honestly, and bill less than the engagement could support if it were padded. Accountability is one named person, not a team. That is not a marketing line. It is how good engagements are structured.

Chapter 6

The Markers of a Weak Consultant

Weak consultants share recognizable patterns too. The patterns appear early if the entity knows where to look.

6.1 The Proposal and the Reports Tell You

Weak consultants are easier to identify than the industry pretends. The proposal is heavy on framework, methodology, and approach, and light on concrete deliverables. The team roster is large, with senior names at the top and execution names at the bottom that the entity will never meet again after kickoff. The pricing is built around hours rather than outcomes, which rewards an engagement that runs until the budget is exhausted, whatever the progress.

Communication is verbose and indirect. Status reports are long and light on substance. Recommendations come wrapped in qualification language designed to preserve the consultant's options. When something is wrong, the deliverable is structured so that no individual has to take responsibility, and the engagement quietly extends to address the newly discovered issue.

6.2 The Program Grows While Audit Posture Weakens

The work product expands the program rather than refining it. New documents appear and old ones are never retired. New controls arrive that the standard did not require. Naming conventions, classification schemes, and review cadences multiply in ways the entity cannot fully explain once the engagement ends. The program looks more impressive in slide form and more fragile in operation.

Audit posture is the leading indicator. Weak consultants produce engagements that look strong in the kickoff deck and weaker as the audit approaches. The deliverables get harder to defend the closer the entity gets to real scrutiny. Strong consultants produce the opposite trajectory: their deliverables get more defensible the more they are tested. In our view, an entity that is watching for it can see the difference well before the next audit.

From the Field

If the proposal is heavy on framework and light on deliverables, the engagement will follow the same pattern. Weak consultants pad documentation and qualify recommendations. Both are accountability avoidance in writing. Weak engagements look strongest at kickoff and weakest at audit. Strong engagements run the opposite trajectory.

Chapter 7

Evaluating Effectiveness After Engagement

Effectiveness is measured against the program, not against the contract. Most entities never run the comparison.

7.1 The Contract Scorecard Versus the Program Scorecard

Most entities evaluate consultant performance against the contract. Were the deliverables produced? Were the milestones met? Was the engagement on budget? These measures are easy to track and easy to defend internally. They tell the entity almost nothing about whether the engagement made the program better.

Effective evaluation asks different questions. Is the program easier to explain than it was? Are the operators more confident in subject matter expert interviews? Does the documentation reconcile with operational reality? Did Self-Report rates change? Did mitigation timelines compress? Did the next audit produce fewer findings, different findings, or findings that were cheaper to close? Those are program-level questions, and they isolate what the consultant actually contributed.

7.2 An Honest Evaluation

Running the evaluation honestly means admitting some uncomfortable possibilities. The engagement may have produced no measurable improvement. It may have introduced complexity that is now load-bearing. It may have generated documentation the entity has to maintain forever, even though no audit will ever read it. Honest evaluation surfaces these outcomes early enough to keep the next engagement from repeating the pattern.

The most useful evaluation is also the simplest. Six months after the engagement closes, ask whether the program is operating better, the same, or worse than it would have without the engagement. In my view the answer is rarely "better." When it is the same or worse, the entity has learned what to avoid in the next selection cycle. That lesson is the actual return on the previous engagement, whatever the contract said.

From the Field

If the program is no easier to explain than it was at kickoff, the engagement did not produce value. Honest post-engagement evaluation is the most reliable input to the next selection decision.

Chapter 8

The Question That Settles It

Most selection decisions come down to one question. Most entities never ask it.

8.1 When Every Proposal Looks Qualified

The proposals are read, the references are checked, and the rates are negotiated. The selection often still feels indeterminate. Several firms look qualified. The differences on paper are thin. The entity defaults to the largest name, the lowest price, or the best deck, and makes the decision without confidence.

8.2 The Question

One question resolves most of that ambiguity. Will the senior named on this proposal personally lead the work, every meeting and every deliverable, and stand behind the outcome at audit? Not nominally. Not at kickoff and close. Every meeting, every deliverable.

The question is uncomfortable to ask and uncomfortable to answer, which is why most procurement processes never surface it. In my view it also predicts engagement outcomes more reliably than any other question an entity can ask.

8.3 What the Answer Reveals

Firms that answer yes are organized around individual senior accountability. Their engagement model produces small teams, direct communication, deliverables that carry one signature, and programs the entity can defend without help once the engagement ends.

Firms that answer no, or that answer yes but cannot show it in how they operate, are organized around billable utilization. Their engagement model produces the patterns described in the earlier chapters, and in our view the entity will see them play out early in the engagement.

8.4 Questions to Put to Every Finalist

The chapters above reduce to a short list. Ask each finalist these before you sign:

1. Who, by name, will attend every meeting and write or sign every deliverable?
2. Which of your people have worked as operators or auditors, and which of them will work on our program?
3. What will our program look like at the end of the engagement: larger or smaller, and how will we measure it?
4. Show us a deliverable you produced that an auditor tested. How long was it?
5. Tell us about a time you advised a client to do less documentation than they wanted.
6. How is the engagement priced, by hours or by outcome, and what happens when the work finishes early?
7. Six months after you leave, who inside our organization will own the program, and how will you get them there?

8.5 The Markers Side by Side

8.6 Making the Decision

The decision is then simple. Award the work to the firm that can answer the question with structural integrity. Decline the firms that cannot, however attractive their proposals look on paper. In my view, over the life of the engagement the economics and the audit posture both come out ahead.

From the Field

One question resolves most selection decisions: will the senior named on the proposal personally lead the work? Firms organized around senior accountability operate differently from firms organized around billable utilization. Both are visible at the proposal stage. Put the answer in the contract. Name the senior, and make any change of lead something the entity has to approve.

Glossary

Glossary

Bulk Electric System (BES). Subject to listed inclusions and exclusions, all Transmission Elements operated at 100 kV or higher and Real Power and Reactive Power resources connected at 100 kV or higher, excluding local distribution facilities (NERC Rules of Procedure, Appendix 2).

Compliance Audit. A systematic, objective review and examination of records and activities to determine whether a Registered Entity meets the Requirements of applicable Reliability Standards (Appendix 2). FERC's rules require NERC and each Regional Entity to maintain a program of rigorous audits (18 C.F.R. § 39.7(a)).

Compliance Monitoring and Enforcement Program (CMEP). The NERC program, set out in Appendix 4C to the Rules of Procedure, or the Commission-approved program of a Regional Entity, under which compliance with Reliability Standards is monitored and enforced (Appendix 2).

Mitigation Plan. An action plan developed by the Registered Entity to correct a noncompliance with a Reliability Standard and prevent its recurrence (Appendix 2). Its required contents, including a knowledgeable point of contact at the entity, are set out in Appendix 4C, Section 6.2.

Notice of Penalty. A notice prepared by NERC and filed with FERC, following NERC approval of a notice of Confirmed Violation or a settlement agreement, stating the penalty or sanction imposed or agreed to (Appendix 2).

Registered Entity. An owner, operator, or user of the Bulk Power System, or the entity registered as its designee for compliance purposes, that is included in the NERC Compliance Registry (Appendix 2).

Regional Entity. An entity having enforcement authority under 18 C.F.R. § 39.8 (Appendix 2).

Reliability Standard. A requirement approved by FERC under Section 215 of the Federal Power Act, or approved or recognized by an applicable governmental authority in another jurisdiction, to provide for Reliable Operation of the Bulk Power System (Appendix 2).

Reliability Standard Audit Worksheet (RSAW). A NERC worksheet used to audit a specific Reliability Standard, posted on NERC's website (Appendix 4C, Section 4.1).

Self-Report. A report by a Registered Entity stating that it believes it has, or may have, violated a Reliability Standard (Appendix 2). NERC and the Regional Entities must have procedures to report self-reported violations promptly to FERC (18 C.F.R. § 39.7(b)).

How Energy Compliance Can Help

How Energy Compliance Can Help

This reference ends with a test, and it applies to us too. Every Energy Compliance engagement is overseen by a senior practitioner, who is the one in the room.

Three services fit the problems this reference describes:

• Regulator-perspective program reviews. A senior read of your program as an auditor would read it, including what a prior consultant left behind and what can be retired.
• Compliance program design and improvement. Simplifying the program so the people who run it can explain it and own it.
• Audit defense. Audit preparation, RSAW production, and data request strategy, delivered by the senior named on the engagement, with Notice of Penalty response and settlement posture if it comes to that.

Services Provided

Energy Compliance services include, but are not limited to:

• NERC reliability and compliance advisory support
• Reliability governance and program assessments
• Registration and applicability analysis
• Operational and engineering reliability alignment
• Compliance program design and improvement
• Audit and enforcement support (non-advocacy)
• Mitigation planning and Self-Report development
• Training and executive briefings on reliability frameworks
• Regulator-perspective program reviews

WattOps Compliance

WattOps Compliance is EC's NERC compliance evidence platform (wattopscompliance.com). It keeps the evidence behind the program in your hands, not in a consultant's files. EC will run one standard at one facility through WattOps at no cost (CIP standards excluded).

RenewOps

RenewOps is EC's renewable operations monitoring and analytics platform, with a Data Center module. For renewable and storage fleets, it puts the operations data behind the compliance program in front of the people who have to explain it.

If you are weighing proposals now, put the question in Chapter 8 to us first. Then call.

Website: energycomplianceinc.com · Email: [email protected]

Phone: 763.438.4427

About the Author

About the Author

Rob Smith is the Founder and Principal of Energy Compliance, Inc., with more than thirty years in the industry on every side of the system. He began in control-room operations as a Reliability Coordinator, Transmission Operator, and Power System Operator across RTO/ISO and utility control centers. On the regulator side, he was a senior compliance auditor and subject matter expert for NERC Reliability Standards. He audited grid facilities, evaluated mitigation adequacy, participated in risk-based oversight of utility mitigation activities, and supported the development of violation notifications and settlements in FERC-directed enforcement actions. He conducted a regulatory audit in the Sultanate of Oman against the Sultanate's Sector Law and Grid Code.

He founded Energy Compliance, Inc. to deliver senior regulator-side compliance authority without the layered staffing and billable-hour overhead of larger firms.

Education:

• MBA, Energy Management, University of Mary
• MSL, Compliance Law, Fordham Law University
• BAS, Energy Management, Bismarck State College
• BAS, Mechanical Engineering, Metallurgy minor, University of Florida
• BAS, Criminology, St. Petersburg College (State Law Enforcement Certification)
• AAS, Power Plant Technology, Bismarck State College
• AAS, Electrical Transmission System Technology, Bismarck State College

Certifications: NERC Lead Auditor training; previously NERC-certified at the Reliability Coordinator level; 1st Class A Boiler Engineer License, Minnesota.

About Energy Compliance, Inc.

About Energy Compliance, Inc.

Energy Compliance, Inc. is an independent consulting and advisory firm focused exclusively on electric reliability, cybersecurity reliability, and regulatory compliance for organizations connected to the North American Bulk Electric System. Our work supports registered entities, including Generator Owners and Operators, Transmission Owners and Operators, Reliability Coordinators, Balancing Authorities, and Distribution Providers. We work across NERC Reliability Standards, FERC orders, RTO/ISO market participation rules, Regional Entity oversight, and state regulatory frameworks.

We do this work differently than larger consulting firms. Engagements are overseen by a senior practitioner with regulator-side experience. We do not staff for billable hours. We staff for outcomes. Our deliverables are written to be operationally executable and audit-defensible, not to manufacture activity. Where automation can replace manual work, we build the automation. Where senior judgment is required, the senior is in the room.

The practice is organized around four areas: NERC Compliance (program support, interpretation, and audit preparation), Senior Advisory (direct engagement on complex reliability questions), Industry Engagement (standards development and working-group participation), and Audit Defense (Notice of Penalty response and settlement posture). Each engagement is scoped to the entity's role, function, and bulk system impact. Energy Compliance is not affiliated with, sponsored by, or endorsed by the North American Electric Reliability Corporation, the Federal Energy Regulatory Commission, or any Regional Entity. Learn more at energycomplianceinc.com.

Sources and Authorities

Sources and Authorities

• North American Electric Reliability Corporation, Rules of Procedure, Appendix 2, Definitions Used in the Rules of Procedure (effective June 27, 2024). https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/appendix-2.pdf
• North American Electric Reliability Corporation, Rules of Procedure, Appendix 4C, Compliance Monitoring and Enforcement Program (effective May 19, 2022), Sections 4.1 (Compliance Audits) and 6.0 to 6.2 (Mitigation of Noncompliance; Contents of Mitigation Plans). https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/appendix-4c.pdf
• North American Electric Reliability Corporation, Reliability Standard Audit Worksheets (RSAWs). https://www.nerc.com/programs/compliance/reliability-standard-audit-worksheets-rsaws
• 18 C.F.R. § 39.7, Enforcement of Reliability Standards (eCFR, current as of October 22, 2026). https://www.ecfr.gov/current/title-18/chapter-I/subchapter-B/part-39/section-39.7