What a Good Compliance Program Feels Like

Foreword

Foreword

This professional reference is one of a series Energy Compliance, Inc. publishes for registered entities and the people who run their compliance programs.

I have spent more than thirty years on every side of the bulk electric system. I have operated control centers as a Reliability Coordinator, Transmission Operator, and Power System Operator. I have audited grid facilities and signed off on findings as a senior compliance auditor. I have worked enforcement matters from inside the regulator's process. For the last several years I have advised registered entities directly through the firm I founded.

The entities that do reliability well share a habit. They take the standards seriously without confusing them with reliability itself. A NERC Reliability Standard is a floor, not a ceiling. Compliance is something an auditor evaluates; reliability is something a system either delivers or does not. These entities prepare for audits by building programs that survive real questions, not binders that look thick.

That is the perspective these references try to share. Each one takes a single topic, whether a standard family, an operational function, a regulatory framework, or an emerging industry challenge, and walks through how it actually works.

They are written for the compliance manager who wants to understand the system rather than memorize requirements. For the legal counsel who has to brief a board honestly. For the senior operator who has been told that compliance and reliability are the same thing and suspects they are not. And for the new compliance hire who was handed a binder and told good luck.

Energy Compliance exists because much of the consulting offered to registered entities today is structured for billable hours rather than outcomes. Every engagement is overseen by a senior practitioner. We do not bring five people to a meeting that needs one. We automate the work that should be automated and apply senior judgment to the work that requires it. If that is what you want in a compliance partner, the back of this reference has our contact information.

If not, the reference still belongs to you. Take what is useful and apply it well. And remember the only test that ultimately matters: when the system needs to perform, does it?

Rob Smith

Founder and Principal, Energy Compliance, Inc.

Executive Summary

Executive Summary

Compliance maturity is usually measured by artifacts: documents in the binder, controls in the matrix, findings in the last report. Those measures miss the most important indicator of program health, which is how the program feels to the people who run it day to day.

Calm, clear, predictable programs tend to produce strong audit outcomes. Reactive, anxious, opaque programs produce findings the operators usually saw coming and could not stop. In my view, you can read a program's feel within the first thirty days of working inside it. This reference describes the feel of a healthy program and explains why the absence of that feel is the loudest leading indicator most entities ignore.

• You should know your program without looking it up. If you cannot, the program is not yours yet.
• Calm during audit prep is a structural property, not a personality trait.
• Programs that operators can explain in their own words tend to pass audits. Programs they have to read off slides tend not to.
• Predictability is a leading indicator. If the program surprises its own operators, it will surprise the auditor.
• A healthy program produces confidence and an unhealthy one produces anxiety. Both are diagnostic.
• Audit anxiety is the program telling you it has been operating differently than it has been documenting.
• If your program does not feel right inside, the audit is going to make that visible outside.

Chapter 1

Why Feel Is a Leading Indicator

Feel gets dismissed as soft. This chapter shows why that dismissal is a mistake, how operators sense a program's gaps before the auditor names them, and what an entity can do with that signal.

1.1 The Case Against Dismissing It

Compliance professionals are conditioned to dismiss subjective indicators, because their world feels binary: the evidence exists or it does not, and the audit result settles the question. Against that backdrop, feel looks like an unserious metric that real compliance work can do without.

That dismissal is wrong. A program that feels chaotic is operating chaotically, even if the artifacts look clean. A program that feels calm is usually operating cleanly, even if the binder is thinner than the consultants would prefer. Artifacts lag the operational reality. Feel reports it as it happens.

1.2 Operators Sense the Gap First

A program that starts to feel anxious in the months before an audit has usually found the gaps the audit will surface, even if no one has named them yet. Operators sense the mismatch between what they document and what they do, and that sense is the anxiety. In my view, programs that fail audits often had operators who knew it was coming weeks or months before the auditor arrived, without being able to say exactly why.

1.3 Acting on the Signal

Treat feel as diagnostic information and the entity can intervene before the audit cycle confirms what the operators already sense. Treat it as soft data and the entity ends up reading the findings and recognizing them after the fact. The first posture builds stronger programs. The second builds case studies.

Key Takeaways

Feel is the operational signature of structural health, and it can be read in real time. Programs that feel anxious in the months before an audit are usually right. Operators sense the gap before the auditor names it. Treating feel as diagnostic lets you intervene early. Treating it as soft data produces case studies, not improvements.

Chapter 2

Clarity Over Confusion

A healthy program is clear to the people inside it. That clarity is not a luxury. Everything else depends on it.

2.1 What Internal Clarity Looks Like

The first quality of a healthy compliance program is internal clarity. The operators understand what the program does, why it does it, and how it traces to the standard it was built against. That understanding is not partial. It lives in the working memory of every person who touches the program, available without opening the binder.

Clarity has practical consequences. SME interviews go smoothly because the SME does not have to translate from documentation language to operating reality on the fly. Decisions come faster because the framework behind them is already understood. New people get up to speed sooner because senior staff can explain the program in their own words instead of handing over a stack of documents and walking away.

2.2 What Confusion Looks Like

Confusion is the opposite condition. Operators know parts of the program, and the parts do not always agree. The framework lives in different people's heads in slightly different forms. Decisions stall because no one is sure which interpretation applies. New hires spend months assembling a coherent picture and often never get there. The program runs, but it runs on partial understanding, and partial understanding eventually surfaces at audit.

2.3 The Fix Is Structural

More documentation will not cure confusion. Structural clarification will. Anyone with operational responsibility should be able to explain the framework end to end, in their own words, without consulting a document. If your people cannot meet that test, the program does not have clarity, and any improvement initiative should start there before it adds anything else.

Key Takeaways

Internal clarity is the precondition for good SME interviews, faster decisions, and real onboarding. If the framework lives in different heads in different forms, the program is running on partial understanding. Documentation does not produce clarity. Structural clarification does. Start there.

Chapter 3

Ownership Over Reliance

A healthy program is owned by the people who operate it. A program that depends on outsiders is borrowing the appearance of compliance.

3.1 What Ownership Means

Ownership has a specific operational meaning. The program is owned when the people inside the entity can defend every part of it without calling an outside advisor. They wrote the procedure. They understand the control. They can produce the evidence and explain the rationale. The program belongs to them in a way that survives any consulting engagement starting or ending.

3.2 What Reliance Looks Like

Reliance looks similar from the outside. Underneath, the program needs a consultant to defend any question that is not routine. The operator can run the daily work but cannot explain why the framework is built the way it is, because it was designed elsewhere and adopted without a full transfer of context. The audit eventually exposes that dependency.

3.3 Making the Transition

Moving from reliance to ownership is uncomfortable. The entity has to absorb context that used to sit outside it. In practice that means documentation rebuilt in operator language, internal walk-throughs that do not include the consultant, and explicit handoffs with named successors. Each of those steps moves context from the consultant to a named person inside the entity, and that transfer is what lets the entity defend the program on its own when the audit arrives.

Healthy programs run mainly on internal ownership and bring in outside advisors selectively, for specific specialties and bounded periods. Unhealthy programs run mainly on outside reliance and call it a partnership. The two look alike in the engagement deck. They behave very differently when an auditor asks a question the consultant did not anticipate.

Key Takeaways

Ownership means the operators can defend the program without an outside advisor. Anything less is reliance. Reliance survives day-to-day operation. It does not survive audit questions nobody anticipated. Use outside advisors selectively and for bounded periods. Depending on them is not a partnership.

Chapter 4

Predictability Over Reactivity

Healthy programs run on a predictable cadence. Reactive programs run on the latest emergency, and emergencies generate the findings the program was supposed to prevent.

4.1 A Program on a Known Cadence

After clarity, predictability matters most. Reviews happen on schedule. Evidence is generated as the work happens, not assembled after the fact. Possible violations get Self-Reported promptly. NERC's CMEP encourages a Self-Report when an entity becomes aware it has, or may have, violated a standard, and the Sanction Guidelines expect it as soon as practical, typically within three months of discovery. Audit responses come together fast because the artifacts already exist.

4.2 What Reactivity Costs

A reactive program runs on whichever emergency is loudest this week. Reviews slip, evidence gets compiled only when the regulator asks, and issues caught late become Self-Reports filed late. The next audit is treated as a project that starts when the notice letter arrives. Under the CMEP, that letter comes at least 90 days before a scheduled Compliance Audit, and under the Sanction Guidelines its arrival generally ends self-reporting credit for the requirements in scope until the engagement is over. A reactive program that starts looking when the letter lands has generally already lost that credit for the requirements in scope.

The deferred review becomes the gap the auditor finds. Evidence assembled after the fact does not reconcile cleanly. The rushed Self-Report carries language the entity would have phrased differently with more time. It all traces to one root: the program was not running on its own cadence, so the regulator's calendar became the cadence.

4.3 Publish the Rhythm

The fix is operational, not procedural. The program needs a published rhythm, a named owner for each cadence, and a senior leader who protects that rhythm when other priorities compete for it. Without it, the program is a collection of artifacts that happened to be assembled before someone arrived to ask questions.

Key Takeaways

Predictability is structural. Reactive programs do not become predictable by trying harder. They change how they run. Deferred reviews become findings. Late Self-Reports can cost mitigating credit. The cadence is the load-bearing structure. Without it the program is a pile of artifacts, not a running discipline.

Chapter 5

Audit Confidence Over Audit Anxiety

Confidence and anxiety are both diagnostic. The program tells you which one it is producing, if you listen.

5.1 Two Readouts

How operators feel about the next audit is a direct readout of program health. Confident operators expect the audit to go cleanly. They have been running the program continuously, the documentation matches the operation, the SMEs are prepared, and the evidence is current. For them the audit is an exam they have been studying for since the last one closed.

Anxious operators feel something different. They are not sure which procedures are still current. They suspect the evidence does not fully reconcile but have not had time to check. They worry about which SME will be interviewed and whether that person is ready. They cannot quite name the source of the worry, which makes it worse, because a gap nobody can name cannot be closed before the auditor arrives.

5.2 Treat Both as Data

My read is that confident programs are usually right that the audit will go well, and anxious programs are usually right that it will not. Writing either off as personality is a mistake. Both are saying something true about the program that the artifacts may not show yet.

5.3 Building Confidence Is Structural Work

Audit confidence comes from a program that produces continuous evidence of its own health. Internal walk-throughs and mock interviews belong in that program, along with quarterly reviews, published cadences, and named owners. The work is not glamorous and the deliverables do not photograph well. But the operators will tell you what is happening if anyone is listening. Listen before the audit confirms it.

Key Takeaways

Confidence and anxiety are readouts of program health, not personality traits. Both can run ahead of the artifacts. In my read, anxious operators are usually right. The audit tends to land the way they expected. Confidence is built structurally, through cadence and rehearsal, not through pep talks.

Chapter 6

The Explainability Test

If the operator cannot explain the program in their own words, no amount of documentation will save the entity at audit.

6.1 Running the Test

The best single test of program health is the explainability test. Pick an operator with responsibility inside the program. Put them in front of someone unfamiliar with it, and ask them to explain what the program does and why. The result is not ambiguous. Either they can do it or they cannot. If they can, that is a strong sign the program is healthy. If they cannot, the program is documented but not understood, and documentation alone does not survive an audit.

6.2 Why Auditors Apply It

The test is unforgiving because audits are. The auditor does not take the documentation's word for what the program does. Interviews are part of how the Regional Entity evaluates a program; WECC, for one, lists interview questions among the ways it reviews internal controls during monitoring engagements. In my experience on the audit side, when the operator cannot explain the program coherently, the auditor starts to question whether the documented program and the operated program are the same thing, and the rest of the engagement proceeds from that question. In my view, that impression is very hard to reverse before the engagement ends.

6.3 Passing and Failing Programs

Programs that pass invest in operator understanding rather than documentation density. Procedures are written in language operators recognize. The framework is walked through with operators on a regular cadence. The senior compliance leader treats operator understanding as a primary deliverable of the program, not a side effect of the paperwork. The program belongs to its operators, and they can prove it on demand.

Programs that fail usually have plenty of documentation. It looks professional and describes a coherent framework. But this is the reliance problem from Chapter 3. The operators run the daily work without having internalized it, and the audit surfaces the gap.

Key Takeaways

The best single test of program health is whether the operator can explain the program in their own words. If that test fails, expect the interviews to go badly. Documentation does not survive an interview that exposes the gap. The fix is not more documentation. It is the explainability work the program never did.

Chapter 7

The Rhythm of a Healthy Program

Healthy programs have an audible rhythm. Unhealthy ones improvise from emergency to emergency, and the difference is visible from outside.

7.1 What the Rhythm Sounds Like

Anyone who touches a healthy program can describe its rhythm. There is a quarterly review cycle and a monthly evidence check. Once a year, the procedures get walked through with the operating SMEs. A standing meeting keeps senior leadership current. None of this takes extraordinary discipline. It takes consistent discipline, which is harder, because it has to survive every other priority competing for the same hours.

7.2 Why the Rhythm Matters

The rhythm is what lets a program survive personnel change. When a compliance manager rotates out, the rhythm keeps going, and the new manager joins a running cadence instead of rebuilding one from scratch. When an audit approaches, the rhythm absorbs the extra load rather than buckling. When a finding is being closed, the rhythm keeps running while the mitigation work proceeds alongside it. The rhythm is the spine of the program.

Unhealthy programs have no audible rhythm. The work gets done, but in response to whatever happened most recently. There is no recurring review cycle. The walk-through happens when a finding triggers it, and the procedure gets updated when someone finally notices it no longer matches the work. Each response is reasonable on its own. Taken together, they are improvisation, and improvisation does not hold up across audit cycles.

7.3 Owning the Rhythm

Building the rhythm is uncomfortable in the short term and stabilizing over the long term. It takes senior commitment to cadences that produce no immediate visible value. It also takes an explicit owner for the rhythm itself, separate from the owners of the workstreams inside it. The payoff is audits the entity barely notices preparing for, because the preparation has been going on for years.

Key Takeaways

Anyone touching a healthy program can describe its rhythm. The rhythm is the spine. The rhythm survives personnel change. The new manager joins a running cadence instead of rebuilding one. Improvisation does not hold up across audit cycles. Cadence does.

Chapter 8

Building Toward the Feel You Want

Feel is the result of structure. If the program does not feel right, the structure is producing that feel, so change the structure.

8.1 Feel Is Structure, Expressed

The feel of a program is not separate from its structure. It is the structure showing up in the daily experience of the operators. The goal is not to make the operators feel differently. The goal is to change the structure that is producing the feel they have.

8.2 The Structural Moves

The changes are recognizable. Clarify the framework so operators can explain it in their own words. Establish ownership inside the entity, not with outside advisors. Build a rhythm that runs on its own cadence rather than in reaction to events. Cut documentation that does no real work. Each is its own piece of work, and each shifts how the program feels to the people running it.

8.3 Closing the Loop

The feedback loop closes when the operators report the change. A senior compliance leader who walks the floor and asks how the next audit feels is gathering primary data, and that answer arrives earlier than any artifact the program produces. If the answer is calm and confident, the structural work is on track. If it is anxious and uncertain, more structural work is needed, whatever the deliverables show.

8.4 The Patience Cost

Artifacts can be assembled in weeks. Feel takes years, and it lasts because the structure underneath stays consistent. That patience is the real cost of the work, and it is why the feel of a healthy program is rare. In my view most entities are not willing to pay it. The ones that do build the programs everyone else later points to as the example.

Key Takeaways

Feel is not separate from structure. It is structure showing up in the operators' daily experience. The leader who asks operators how the next audit feels is gathering primary data, and it arrives earlier than any artifact. Feel takes years to build and lasts because the structure underneath stays consistent. Patience is the cost.

Glossary

Glossary

Compliance Audit. A systematic, objective review and examination of records and activities to determine whether a Registered Entity meets the Requirements of applicable Reliability Standards (NERC Rules of Procedure, Appendix 2).

Compliance Enforcement Authority (CEA). NERC or the Regional Entity, in their respective roles of monitoring and enforcing compliance with the NERC Reliability Standards.

Compliance Monitoring and Enforcement Program (CMEP). The NERC program, set out in Appendix 4C to the Rules of Procedure, that governs Compliance Audits, Self-Certifications, Spot Checks, Self-Reports, and enforcement.

Explainability test. EC's term for asking an operator to explain, in their own words and without documents, what the program does and why.

Internal compliance program. An entity's own program for preventing and detecting violations. Under the NERC Sanction Guidelines, its presence and quality are a mitigating factor in setting a penalty.

Mitigation Plan. An action plan developed by the Registered Entity to correct a noncompliance with a Reliability Standard and prevent its recurrence.

Self-Logging. A process by which Registered Entities found eligible by the CEA, after a formal review of internal controls, record potential noncompliance on a log instead of submitting individual Self-Reports.

Self-Report. A report by a Registered Entity stating that it believes it has, or may have, violated a Reliability Standard.

SME. Subject matter expert: the person who does the work a requirement covers and who answers for it in an interview.

Spot Check. A process in which the CEA asks a Registered Entity for information to support a Self-Certification, Self-Report, or Periodic Data Submittal, as a random check, or in response to operating problems or system events.

How Energy Compliance Can Help

How Energy Compliance Can Help

Our work is built to leave a program clear, owned, and on a rhythm. Three services fit this paper most closely:

• Regulator-perspective program reviews. An auditor's-eye read, including whether your people can explain the program without the binder.
• Compliance program design and improvement. Restructuring the program so it runs on a published cadence with named owners, and so the people who run it own it.
• Training and executive briefings on reliability frameworks. Moving the framework into your operators' own words.

Services Provided

Energy Compliance services include, but are not limited to, the following. Every deliverable is operationally executable and audit-defensible, structured for the auditor's question rather than the consultant's binder.

• NERC reliability and compliance advisory support
• Reliability governance and program assessments
• Registration and applicability analysis
• Operational and engineering reliability alignment
• Compliance program design and improvement
• Audit and enforcement support (non-advocacy)
• Mitigation planning and Self-Report development
• Training and executive briefings on reliability frameworks
• Regulator-perspective program reviews

WattOps Compliance

WattOps Compliance is EC's NERC compliance evidence platform (wattopscompliance.com). It supports the continuous evidence this paper describes, held by your program rather than assembled when the notice letter arrives. EC will run one standard at one facility through WattOps at no cost (CIP standards excluded).

RenewOps

RenewOps is EC's renewable operations monitoring and analytics platform, with a Data Center module. It puts the operations data behind a renewable or storage program in front of the people who explain it.

Run the Chapter 6 explainability test this week. Then call us.

Website: energycomplianceinc.com · Email: [email protected]

Phone: 763.438.4427

About the Author

About the Author

Rob Smith is the Founder and Principal of Energy Compliance, Inc., with more than thirty years in the industry on every side of the system. He began in control-room operations as a Reliability Coordinator, Transmission Operator, and Power System Operator across RTO/ISO and utility control centers. On the regulator side, he was a senior compliance auditor and subject matter expert for NERC Reliability Standards. He audited grid facilities, evaluated mitigation adequacy, participated in risk-based oversight of utility mitigation activities, and supported the development of violation notifications and settlements in FERC-directed enforcement actions. He conducted a regulatory audit in the Sultanate of Oman against the Sultanate's Sector Law and Grid Code.

He founded Energy Compliance, Inc. to deliver senior regulator-side compliance authority without the layered staffing and billable-hour overhead of larger firms.

Education:

• MBA, Energy Management, University of Mary
• MSL, Compliance Law, Fordham Law University
• BAS, Energy Management, Bismarck State College
• BAS, Mechanical Engineering, Metallurgy minor, University of Florida
• BAS, Criminology, St. Petersburg College (State Law Enforcement Certification)
• AAS, Power Plant Technology, Bismarck State College
• AAS, Electrical Transmission System Technology, Bismarck State College

Certifications: NERC Lead Auditor training; previously NERC-certified at the Reliability Coordinator level; 1st Class A Boiler Engineer License, Minnesota.

About Energy Compliance, Inc.

About Energy Compliance, Inc.

Energy Compliance, Inc. is an independent consulting and advisory firm based in Bloomington, Minnesota, focused exclusively on electric reliability, cybersecurity reliability, and regulatory compliance for organizations connected to the North American Bulk Electric System. Our work supports registered entities, including Generator Owners and Operators, Transmission Owners and Operators, Reliability Coordinators, Balancing Authorities, and Distribution Providers. We work across NERC Reliability Standards, FERC orders, RTO/ISO market participation rules, Regional Entity oversight, and state regulatory frameworks.

Rob founded Energy Compliance, Inc. to bring senior, regulator-side compliance authority to registered entities directly, without layered staffing, billable-hour overhead, or generalist advice. Every Energy Compliance engagement is overseen by a senior practitioner. We do this work differently than larger consulting firms. Our deliverables are written to be operationally executable and audit-defensible, not to manufacture activity. Where automation can replace manual work, we build the automation. Where senior judgment is required, the senior is in the room.

The practice is organized around four areas: NERC Compliance (program support, interpretation, and audit preparation), Senior Advisory (direct engagement on complex reliability questions), Industry Engagement (standards development and working-group participation), and Audit Defense (Notice of Penalty response and settlement posture). Energy Compliance is not affiliated with, sponsored by, or endorsed by the North American Electric Reliability Corporation, the Federal Energy Regulatory Commission, or any Regional Entity. Learn more at energycomplianceinc.com.

Sources and Authorities

Sources and Authorities

• North American Electric Reliability Corporation, Rules of Procedure, Appendix 2, Definitions Used in the Rules of Procedure (effective June 27, 2024). https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/appendix-2.pdf
• North American Electric Reliability Corporation, Rules of Procedure, Appendix 4B, Sanction Guidelines of the North American Electric Reliability Corporation (effective January 19, 2021), Section 3.3 (Mitigating Factor: Presence and Quality of Entity's Internal Compliance Program; Mitigating Factor: Disclosure of the Violation Through Self-Reporting and Voluntary Mitigating Activities by the Entity, including footnotes 6 and 8). https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/appendix-4b.pdf
• North American Electric Reliability Corporation, Rules of Procedure, Appendix 4C, Compliance Monitoring and Enforcement Program (effective May 19, 2022), Sections 4.1 (Compliance Audits), 4.5 (Self-Reports), and 4.5A (Self-Logging). https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/appendix-4c.pdf
• Western Electricity Coordinating Council, "What to Expect During a Monitoring Activity" (presentation, March 18, 2026), Internal Controls slides. https://www.wecc.org/sites/default/files/documents/meeting/2026/WF3%20What%20to%20Expect%20During%20a%20Monitoring%20Activity.pdf