Compliance maturity is usually measured by artifacts. Documents in the binder. Controls in the matrix. Findings in the last report. Those metrics miss the most important indicator of program health, which is how the program feels to the people who run it day to day. Calm, clear, predictable programs produce strong audit outcomes. Reactive, anxious, opaque programs produce findings the operators usually saw coming and could not stop. Feel is not soft. It is the operational signature of structural health, and it is detectable inside thirty days of touching any program. This reference describes the feel of a healthy program and explains why the absence of that feel is the loudest leading indicator most entities ignore. — You should know your program without looking it up. If you cannot, the program is not yours yet. — Calm during audit prep is a structural property, not a personality trait. — Programs that operators can explain in their own words pass audits. Programs they have to read off slides do not. — Predictability is a leading indicator. If the program surprises its own operators, it will surprise the auditor. — Confidence is what a healthy program produces. Anxiety is what an unhealthy one produces. Both are diagnostic. — Audit anxiety is the program telling you it has been operating differently than it has been documenting.
Contents
Read offline
The complete reference is on this page. The PDF is for circulation inside your organization.
Download the PDFForeword
Foreword
This professional reference is one of a series Energy Compliance, Inc. publishes for registered entities and the people who run their compliance programs. I have spent more than thirty years on every side of the bulk electric system. I have operated control centers as a Reliability Coordinator, Transmission Operator, and Power System Operator. I have audited grid facilities and signed off on findings as a senior compliance auditor. I have worked enforcement matters from inside the regulator's process. For the last several years I have advised registered entities directly through the firm I founded. The entities that do reliability well share a common habit. They take the standards seriously without confusing them with reliability itself. They know that a NERC Reliability Standard is a floor, not a ceiling. They know that compliance is something an auditor evaluates, but reliability is something a system either delivers or does not. They prepare for audits by building programs that survive real questions, not binders that look thick. That is the perspective these references try to share. Each one focuses on a single topic. A standard family, an operational function, a regulatory framework, or an emerging industry challenge. Each one walks through how the topic actually works. These references are written for the compliance manager who wants to understand the system, not just memorize requirements. For the legal counsel who has to brief a board honestly. For the senior operator who has been told that compliance and reliability are the same thing and suspects they are not. For the new compliance hire who was handed a binder and told good luck. Energy Compliance exists because much of the consulting offered to registered entities today is structured for billable hours rather than for outcomes. We staff every engagement with one senior practitioner. We do not bring five people to a meeting that needs one. We automate the work that should be automated, and we apply senior judgment to the work that requires it. If that approach is what you are looking for in a compliance partner, the back of this reference has our contact information. If not, the reference still belongs to you. Take what is useful. Apply it well. And remember the only test that ultimately matters: when the system needs to perform, does it?
— Rob Smith Founder, Energy Compliance, Inc.
EC-WP-703 What a Good Compliance Program Should Feel Like
Why Feel Is a Leading Indicator
Why Feel Is a Leading Indicator
Feel is dismissed as soft. It is actually the operational signature of program health, detectable long before the audit cycle confirms it.
Compliance professionals are conditioned to dismiss subjective indicators. The program either has the documents or it does not. The controls either execute or they fail. The audit either passes or it generates findings. Feel is treated as an unserious metric that real compliance work does not depend on. That dismissal is wrong. Feel is the operational signature of structural health. A program that feels chaotic is operating chaotically, even if the artifacts look clean. A program that feels calm is operating cleanly, even if the binder is thinner than the consultants would prefer. The artifacts lag the operational reality. Feel reflects the operational reality in real time. Feel is also a leading indicator. A program that has begun to feel anxious in the months before an audit has usually identified the gaps the audit will eventually surface, even if no one has named them yet. Operators sense the misalignment between what they document and what they do, and the sense produces the anxiety. Programs that fail audits often had operators who knew they would, weeks or months before the auditor arrived, without being able to articulate why. Treating feel as diagnostic information lets the entity intervene before the audit cycle confirms what the operators already sense. Treating it as soft data leaves the entity reading the audit findings and recognizing them retroactively. The first posture produces stronger programs. The second produces case studies.
FROM THE FIELD Feel is not soft. It is the operational signature of structural health, and it is detectable in real time. Programs that feel anxious in the months before an audit are usually correct. Operators sense the gap before the auditor names it. Treating feel as diagnostic intervenes early. Treating it as soft data produces case studies, not improvements.
Clarity Over Confusion
Clarity Over Confusion
A healthy program is clear to the people inside it. Clarity is not a luxury. It is the precondition for everything else.
The first quality of a healthy compliance program is internal clarity. The operators understand what the program does, why it does what it does, and how it traces to the standard it is built against. The clarity is not partial. It is the working memory of every person who touches the program, available without reference to the binder. Internal clarity has practical consequences. SME interviews land cleanly because the SME does not have to translate from documentation language to operating reality on the fly. Decisions get made faster because the framework supporting the decision is already understood. New personnel onboard faster because the senior staff can explain the program in their own words rather than handing the new hire a stack of documents and walking away. Confusion is the opposite condition and is more common than the industry admits. Operators know parts of the program. The parts do not always agree with each other. The framework lives in different people's heads in slightly different forms. Decisions take longer because no one is sure which interpretation applies. New personnel struggle for months to assemble a coherent picture and often never quite get there. The program runs, but it runs on partial understanding, and the partial understanding eventually surfaces at audit. The intervention for confusion is not more documentation. It is structural clarification. The framework needs to be explainable end to end by anyone with operational responsibility, in their own words, without consulting a document. If that test cannot be met, the program does not have clarity, and any improvement initiative should start with that gap before adding anything else.
FROM THE FIELD Internal clarity is not a luxury. It is the precondition for SME interviews, decision speed, and onboarding. If the framework lives in different people's heads in slightly different forms, the program is operating on partial understanding. More documentation does not produce clarity. Structural clarification does. Start there before adding anything else.
Ownership Over Reliance
Ownership Over Reliance
A healthy program is owned by the people who operate it. A program that depends on outsiders is borrowing the appearance of compliance.
Ownership has a specific operational meaning in compliance. The program is owned when the operators inside the entity can defend every part of it without consulting an external advisor. They wrote the procedure, they understand the control, they can produce the evidence, they can explain the rationale. The program belongs to them in a way that survives any consulting engagement starting or ending. Reliance is the opposite condition. The program looks similar from the outside but depends on a consultant to defend any non-trivial question. The operator can run the day-to-day work but cannot explain why the framework is structured the way it is, because the framework was designed elsewhere and adopted without full transfer of context. The audit eventually exposes the dependency. The transition from reliance to ownership is uncomfortable. It requires the entity to absorb context that was previously held externally, often in the form of documentation rebuilt in operator language, internal walk-throughs that do not include the consultant, and explicit handoffs with named successors. None of this is glamorous. All of it produces a program the entity can defend on its own when the audit arrives. Healthy programs run primarily on internal ownership and use external advisors selectively, for specific specialties, for bounded periods. Unhealthy programs run primarily on external reliance and call it a partnership. The two structures look similar in the engagement deck and operate completely differently when an auditor asks a question the consultant did not anticipate.
FROM THE FIELD Ownership is when the operators can defend the program without consulting an external advisor. Anything less is reliance. Reliance survives day-to-day operation. It does not survive audit questions the consultant did not anticipate. Healthy programs use external advisors selectively, for bounded periods. Unhealthy programs depend on them and call it partnership.
Predictability Over Reactivity
Predictability Over Reactivity
Healthy programs run on a predictable cadence. Reactive programs run on the latest emergency, and emergencies generate the findings the program was supposed to prevent.
Predictability is the second-most-important property of a healthy program after clarity. The program operates on a known cadence. Reviews happen on schedule. Evidence is generated continuously, not assembled retroactively. Self-reports get filed inside the regulatory window, not at the edge of it. Audit responses come together quickly because they are drawing on artifacts that already exist. Reactivity is the opposite condition. The program runs on whichever emergency is loudest this week. Reviews get deferred because something more urgent arose. Evidence gets compiled when the regulator asks for it rather than maintained continuously. Self-reports get filed at the last possible moment because the program did not catch the issue early. The next audit is treated as a project that begins three months before kickoff rather than as a state the program is always in. Reactive programs produce predictable failure modes. The deferred review becomes the gap the auditor finds. The retroactively assembled evidence does not reconcile cleanly. The last-minute self-report carries language the entity would have phrased differently with more time. None of these are exotic. All of them trace to the same root: the program was not running on a cadence, so the cadence got imposed by the regulator instead. The intervention is operational, not procedural. The program needs a published rhythm, with named owners for each cadence, and a senior leader who treats the rhythm as load-bearing. The rhythm is not optional. It is the load-bearing structure that makes the program legible at audit. Without it, the program is a collection of artifacts that happened to be assembled before someone arrived to ask questions.
FROM THE FIELD Predictability is a structural property. Reactive programs do not become predictable by trying harder. They become predictable by changing how they run. Deferred reviews become audit findings. Retroactive evidence does not reconcile cleanly. Last-minute self-reports carry language the entity later regrets. The cadence is the load-bearing structure. Without it the program is a collection of artifacts rather than a running discipline.
Audit Confidence Over Audit Anxiety
Audit Confidence Over Audit Anxiety
Confidence and anxiety are both diagnostic. The program tells you which one it is producing if you listen.
The way operators feel about the next audit is a direct readout of program health. Confident operators expect the audit to land cleanly. They have been operating the program continuously, the documentation reconciles with the operation, the SMEs are prepared, and the evidence is current. The audit is an exam they have been studying for since the day the last one closed. Anxious operators feel something different. They are not sure which procedures are still current. They suspect the evidence does not fully reconcile but have not had time to verify. They worry about which SME will be interviewed and whether that SME has rehearsed. They cannot fully articulate the source of the anxiety, which makes it worse, because the inability to name the gap means the gap cannot be closed before the auditor arrives. Confidence and anxiety are both diagnostic, and the entity should treat them as such. Confident programs are usually right that the audit will land well. Anxious programs are usually right that it will not. Treating either as personality variation rather than as a structural readout is a mistake. Both are saying something true about the program that the artifacts may not be saying yet. Building toward audit confidence is structural work. It requires the program to operate in a way that produces continuous evidence of health. Internal walk-throughs. Mock interviews. Quarterly reviews. Published cadences. Named owners. The work is not glamorous and the deliverables do not photograph well, but the operators will tell the entity what is happening if anyone is listening to them. Listen to that signal before the audit confirms it.
FROM THE FIELD Confidence and anxiety are diagnostic, not personality. Both are accurate readouts of program health that artifacts may not yet show. Anxious operators are usually right. The audit lands the way the operators expected. Audit confidence is built structurally, not motivationally. The cadence and the rehearsal are the work.
The Explainability Test
The Explainability Test
If the operator cannot explain the program in their own words, no amount of documentation will save the entity at audit.
The single best test of program health is the explainability test. Pick an operator with responsibility inside the program, put them in front of someone who is not familiar with it, and ask them to explain what the program does and why. The result is unambiguous. They can do it, or they cannot. If they can, the program is healthy. If they cannot, the program is documented but not understood, and documentation alone does not survive audit. The test is unforgiving because audits are unforgiving. The auditor does not accept that the documentation describes what the program does. The auditor talks to the operator and forms an independent view. If the operator cannot explain the program coherently, the auditor concludes that the documented program does not match the operated program, and the rest of the audit proceeds from that conclusion. Few entities recover from that conclusion inside a single audit cycle. Programs that pass the test invest in operator understanding rather than in documentation density. The procedures are written in language operators recognize. The framework is walked through with operators on a regular cadence. The senior compliance leader treats operator understanding as a primary deliverable of the program, not a side effect of documentation. The program belongs to its operators, and the operators can prove it on demand. Programs that fail the test usually have plenty of documentation. The documentation looks professional. It describes a coherent framework. The framework was designed externally and never fully transferred internally. The operators run the day-to-day work without having internalized the framework, and the audit surfaces the gap. The fix is not more documentation. The fix is the explainability work the program never did.
FROM THE FIELD The single best test of program health is whether the operator can explain the program in their own words. If the test fails, the audit will fail. Documentation alone does not survive an SME interview that surfaces the gap. The fix is not more documentation. The fix is the explainability work the program never did.
The Rhythm of a Healthy Program
The Rhythm of a Healthy Program
Healthy programs have an audible rhythm. Unhealthy ones run on emergency improvisation. The difference is detectable from outside.
Healthy programs have a rhythm that anyone touching the program can describe. There is a quarterly review cycle. There is a monthly evidence audit. There is an annual procedure walk-through with the operating SMEs. There is a recurring meeting that keeps senior leadership current. None of this requires extraordinary discipline. All of it requires consistent discipline, which is harder than extraordinary discipline because it has to survive every other priority that competes for the same time. The rhythm is what makes the program survive personnel change. When a compliance manager rotates, the rhythm continues. The new manager joins an operating cadence rather than rebuilding one from scratch. When an audit cycle approaches, the rhythm absorbs the additional load rather than buckling under it. When a finding closes, the rhythm continues to operate while the mitigation work runs in parallel. The rhythm is the spine of the program. Unhealthy programs do not have an audible rhythm. The work happens, but it happens in response to whichever event arrived most recently. There is no recurring review cycle. The evidence audit happens when an external pressure forces it. The walk-through happens when a finding triggers it. Each individual response is reasonable. The aggregate is improvisation, and improvisation does not survive audit cycles consistently. Building the rhythm is uncomfortable in the short term and stabilizing in the long term. It requires senior commitment to maintain cadences that produce no immediate visible value. It requires an explicit owner for the rhythm itself, separate from the owners of the workstreams the rhythm contains. The investment pays off in audits the entity barely notices preparing for, because the preparation has been continuous for years.
FROM THE FIELD Healthy programs have a rhythm anyone touching the program can describe. The rhythm is the spine. The rhythm survives personnel change. The new manager joins a running cadence rather than rebuilding one from scratch. Improvisation does not survive audit cycles consistently. Cadence does. Choose accordingly.
Building Toward the Feel You Want
Building Toward the Feel You Want
Feel is the result of structure. If the program does not feel right, the structure is producing the feel. Change the structure.
The feel of a program is not a separate thing from its structure. The feel is the structure expressing itself in the daily experience of the operators. Programs that feel chaotic are structurally chaotic. Programs that feel calm are structurally calm. The intervention is not to make the operators feel differently. The intervention is to change the structure that is producing the feel they have. The structural changes are recognizable. Clarify the framework so that operators can explain it in their own words. Establish ownership inside the entity, not in external advisors. Build a rhythm that runs on its own cadence rather than in reaction to events. Cut documentation density that is not load-bearing. Reduce the team size that is creating coordination overhead. Each of these is the subject of its own work and each of them produces a measurable shift in how the program feels to its operators. The feedback loop closes when the operators report the change. The senior compliance leader who walks the floor and asks how the next audit feels is gathering primary data. The answer is more reliable than any artifact the program produces. If the answer is calm and confident, the structural work is on track. If the answer is anxious and uncertain, more structural work is required regardless of what the deliverables show. Building the feel takes longer than producing the artifacts. Artifacts can be assembled in weeks. Feel takes years to build and survives those years because the structure underneath has been consistent. That patience is the cost of the work, and it is also why the feel of a healthy program is rare. Most entities are not willing to pay the patience cost. The ones that are produce the programs everyone else later cites as the example.
FROM THE FIELD Feel is not separate from structure. Feel is structure expressing itself in the daily experience of the operators. The senior leader who asks operators how the next audit feels is gathering primary data. The answer is more reliable than any artifact. Feel takes years to build and survives those years because the structure underneath has been consistent. The patience is the cost.
About the Author
About the Author
Rob Smith is a senior electric industry professional with over thirty years of experience across every major function of the North American Bulk Electric System. His work spans reliability coordination, transmission operations, regulatory compliance, and cybersecurity reliability. Rob has worked directly in real-time grid operations as a Reliability Coordinator, Transmission Operator, and Power System Operator within RTO/ISO and utility control center environments. He has also held senior regulatory and oversight roles, including senior compliance auditor and subject matter expert for NERC Reliability Standards. In those roles he audited grid facilities for compliance with applicable standards, evaluated the adequacy of mitigation actions, supported the development of violation notifications and settlements as part of FERC-directed enforcement actions, and participated in risk-based oversight of utility mitigation activities. Rob founded Energy Compliance, Inc. to bring senior, regulator-side compliance authority to registered entities directly, without the layered staffing, billable-hour overhead, and generalist advice typical of larger consulting firms. Every Energy Compliance engagement is led by Rob personally.
About Energy Compliance, Inc.
About Energy Compliance, Inc.
Energy Compliance, Inc. is an independent consulting and advisory firm focused exclusively on electric reliability, cybersecurity reliability, and regulatory compliance for organizations connected to the North American Bulk Electric System. Our work supports registered entities, including Generator Owners and Operators, Transmission Owners and Operators, Reliability Coordinators, Balancing Authorities, and Distribution Providers. We work across NERC Reliability Standards, FERC orders, RTO/ISO market participation rules, Regional Entity oversight, and state regulatory frameworks. We do this work differently than larger consulting firms. Engagements are led by a single senior practitioner with regulator-side experience. We do not staff for billable hours. We staff for outcomes. Our deliverables are written to be operationally executable and audit-defensible, not to manufacture activity. Where automation can replace manual work, we build the automation. Where senior judgment is required, the senior is in the room. Energy Compliance is not affiliated with, sponsored by, or endorsed by the North American Electric Reliability Corporation, the Federal Energy Regulatory Commission, or any Regional Entity.
Services Provided Our services are written to be clearly defensible. Operationally executable in real time. Audit-defensible at compliance review. Every deliverable is structured for the auditor's question, not the consultant's binder.
Energy Compliance services include, but are not limited to:
- NERC reliability and compliance advisory support
- Reliability governance and program assessments
- Registration and applicability analysis
- Operational and engineering reliability alignment
- Compliance program design and improvement
- Audit and enforcement support (non-advocacy)
- Mitigation planning and Self-Report development
- Training and executive briefings on reliability frameworks
- Regulator-perspective program reviews
Each engagement is scoped to the entity's role, function, and bulk system impact.
ENERGY COMPLIANCE PROFESSIONAL REFERENCE
Rigorous Compliance. Defensible Programs. Energy Compliance, Inc. partners with registered entities on the institutional and technical questions that define strong reliability and cybersecurity programs, from classification through audit through enforcement response.
NERC COMPLIANCE SENIOR ADVISORY Program support, interpretation, and audit Direct engagement on complex reliability preparation. questions.
INDUSTRY ENGAGEMENT AUDIT DEFENSE Standards development and working-group Notice of Penalty response and settlement participation. posture.
CONNECT WITH US