Self-Reporting: Legal Considerations Before You File

Foreword

Foreword

This professional reference is part of the Legal Series published by Energy Compliance, Inc. in partnership with Stich Angell, P.A., for registered entities and the people who run their compliance and legal programs.

NERC enforcement is a civil enforcement regime that registered entities often treat as a compliance process. The framing matters. Decisions made early in an enforcement matter bind the entity through every later stage, and many of them call for legal judgment that compliance teams are not trained to make alone. Recognizing this late is expensive. The cost rarely shows at the moment it is incurred, and most of it can be avoided with the right operating framework in place.

Energy Compliance, Inc. partners with Stich Angell, P.A. to give registered entities integrated legal-compliance support across the full enforcement lifecycle. Rob Smith brings more than thirty years of operator and regulator-side compliance experience. Cara Passaro and the Stich Angell team bring civil litigation depth, appellate practice, and a growing focus on energy compliance representation. Together they offer an alternative to the usual model, where compliance consulting and legal counsel run as separate engagements and meet only after an enforcement matter has already arrived.

These references are written for the compliance manager who has to brief the general counsel honestly. For the in-house attorney who needs to understand how NERC enforcement actually proceeds. For the senior leader who has been told the enforcement matter is under control and suspects it is not. For the outside counsel asked to advise on a NERC matter for the first time, who needs a practitioner's view of the procedural reality.

The references do not substitute for engaged counsel, and they do not replace operational compliance judgment. They describe how the system works, in the voice we use in front of regulators and in the courtroom, so registered entities can make the decisions in front of them with the information practitioners would want them to have.

If the integrated legal-compliance approach we describe is what your entity needs, the back of this reference has our contact information. If not, the reference still belongs to you. Take what is useful and apply it well. And remember that the structural decisions made before an enforcement matter arrives are almost always worth more than the ones made after.

Cara C. Passaro and Rob Smith

Stich Angell, P.A. · Energy Compliance, Inc.

Executive Summary

Executive Summary

A Self-Report is a signed submission to the regulator. Appendix 4C of the NERC Rules of Procedure requires it to be signed by an officer, employee, attorney, or other authorized representative of the registered entity, and it binds the entity through every later stage of the enforcement lifecycle. Registered entities still tend to treat it as a compliance document: drafted in compliance language and filed without legal review. That treatment does not match what the document does. A Self-Report is a legal document with compliance content. Its legal aspects, meaning characterization, scope, timing and language, carry at least as much weight as the operational facts.

This reference explains why Self-Reports are legal documents first. It covers the privilege questions that arise before filing, the characterization and scope discipline that determines settlement leverage, the timing rules and the self-reporting credit that rides on them, the mitigation statement that sets up the eventual settlement, and the internal coordination that makes a high-quality Self-Report possible.

• A Self-Report is a legal document. Drafting it as a compliance document concedes ground the entity has not examined.
• The framing in the Self-Report becomes the framing the regulator settles against. Choose it deliberately.
• Privilege over the pre-filing investigation has to be set up before the investigation begins. In our experience, retroactive privilege claims rarely hold.
• Scope discipline matters as much as content. Report the full extent of the noncompliance you are reporting, and keep separate matters separate.
• Timing is strategic, and it is not open-ended. Appendix 4C encourages Self-Reports when the entity becomes aware of a possible violation, and the Sanction Guidelines tie self-reporting credit to prompt filing before the regulator finds the issue.
• The mitigation statement is the entity's first chance to set up the settlement. Drafting it well shapes the outcome months later.
• Counsel and compliance both contribute to the Self-Report. Either alone produces a weaker document than the two together.

Chapter 1

Why Self-Reports Are Legal Documents First

Self-Reports are treated as compliance documents. Their function in enforcement is legal.

1.1 What the Rules Say a Self-Report Is

Appendix 2 of the NERC Rules of Procedure defines a Self-Report as a report by a registered entity stating that it believes it has, or may have, violated a Reliability Standard. Appendix 4C, Section 4.5, lists its contents: a risk assessment, a description of its extent, its cause, and the actions taken or to be taken to mitigate it, including preventing recurrence. Under Section 4.0, any CMEP submission must be signed by an officer, employee, attorney, or other authorized representative. Self-Reports go to the Compliance Enforcement Authority (CEA) through Align.

Once filed, the submission is part of the regulator's record, read, cited and relied on for the rest of the matter. Its wording binds the entity in any settlement or adjudicated outcome. Its framing shapes the penalty, characterization and mitigation the regulator proposes.

1.2 How They Usually Get Written

Compliance staff usually draft Self-Reports in operational language, focused on corrective action. The legal characterization is left implicit, or put in terms the regulator may not use. The result reads as cooperative while binding the entity to characterizations nobody examined or chose.

How the violation is characterized, how far the acknowledgment reaches, how the mitigation statement is worded and when the report is filed are legal calls. The compliance content describes the operational facts; the legal aspects shape how those facts will be read.

1.3 The Structural Fix

Bring counsel in from the moment the entity identifies a potential violation. Counsel reviews the legal aspects, compliance supplies the operational facts, and the finished document carries both. In our view, entities that work this way protect their settlement posture for the rest of the matter. Entities that do not hand the regulator a settlement anchor on terms they would not choose.

From the Practice

Characterization, scope, language and timing shape how the operational facts are read and settled. Counsel and compliance both contribute. The integrated document is the deliverable.

Chapter 2

The Privilege Question Before Filing

Privilege over the pre-filing investigation has to be established before the investigation begins. Filing the Self-Report does not automatically waive privilege over that work, but the way the investigation was run can.

2.1 Why the Pre-Filing Investigation Is Exposed

The investigation an entity runs before it files is one of the most privilege-sensitive moments in the enforcement lifecycle. It generates documents. It captures witness recollections that may later become testimony. It lays the factual foundation for the filing and for any settlement that follows. Whether that work is protected depends on how it was structured when it started, and the structure cannot be retrofitted once the work is done.

An investigation run by compliance staff and framed as routine root cause analysis is generally discoverable. The memoranda can be requested and produced. The interviews end up in records the regulator can reach. If the entity later wants to take a different position, the narrative that investigation produced becomes the regulator's narrative. In our view, little of this can be repaired afterward. A memo that was never prepared for counsel is not privileged later because counsel asks for it.

2.2 What Protection Looks Like

An investigation conducted at counsel's direction, as legal analysis prepared in connection with a potential enforcement matter, is generally protected. Two doctrines do the work. The attorney-client privilege covers communications between employees and counsel made to secure legal advice; the Supreme Court applied it to that setting in Upjohn Co. v. United States. The work product doctrine, reflected in Federal Rule of Civil Procedure 26(b)(3), ordinarily shields documents prepared in anticipation of litigation. The other side can reach them only by showing substantial need and that it cannot, without undue hardship, obtain their substantial equivalent by other means. Even then, Rule 26(b)(3)(B) requires the court to protect counsel's mental impressions, conclusions, opinions and legal theories. How those doctrines apply in a particular CMEP matter is a question for counsel.

Two limits matter here. First, Upjohn is explicit that the privilege protects communications, not the underlying facts. The facts the Self-Report has to state are not privileged because counsel learned them. Second, the Self-Report itself is not privileged once filed. What stays protected is the underlying analysis that informed it.

2.3 Two Products, Kept Separate

The design of a privileged pre-filing investigation follows the design described in EC-WP-800 for any enforcement-related investigation. Counsel directs the work in writing. Investigators report to counsel. Interim work product is marked privileged and circulates only inside the privilege circle. The investigation produces a privileged memorandum that informs the drafting and is never filed. The Self-Report states the operational facts, framed deliberately for the regulator's record. The two products are related and distinct, and keeping them distinct preserves the entity's options for the rest of the matter.

From the Practice

In our experience, retroactive privilege claims rarely hold. Investigations run by compliance staff without counsel's direction are generally discoverable. Investigations run at counsel's direction generally are not, though the underlying facts remain discoverable. Privilege protects communications, not facts. The Self-Report states the facts for the record. The privileged memorandum stays internal. Both, separately.

Chapter 3

Characterizing the Violation: Words That Bind

The characterization in the Self-Report binds the entity, so the wording is a legal choice.

3.1 What the Characterization Covers

NERC's Self-Report and Mitigation User Guide asks for how and when the issue was discovered, the standard, requirement, registered functions and duration, the extent of condition, root and contributing causes, and a risk assessment. Each field is a wording choice.

The regulator reads the characterization as the entity's view, and the settlement language, penalty calculation and mitigation requirements build on it. Under Appendix 4C, Section 5.6, a settlement may say the entity admits the Alleged Violation, does not contest it, or neither admits nor denies it, but never that it denies it. In our view, the words in the Self-Report largely decide which of those positions is still open at the negotiating table.

3.2 The Predictable Errors

Three errors recur: stating the violation more broadly than the facts support; language implying culpability or willfulness the facts do not require; and folding a single violation together with related issues that belong in separate matters. Each widens the matter and is hard to walk back.

3.3 What Counsel-Reviewed Characterization Looks Like

A counsel-reviewed characterization is precise about what happened, uses the regulator's terminology and concedes no legal point the entity has not decided to concede. Duration is specific, scope is bounded to what is documented, and cause is stated as fact, not as a legal conclusion. That keeps the entity's credibility and protects its settlement posture.

3.4 The Characterization Outlives the Matter

The characterization also outlasts the matter. Appendix 4C, Section 9.2, has the CEA retain Self-Report records, where technically feasible, for the longer of five years or any retention period specified by FERC or another Applicable Governmental Authority. Where the records are material to an unresolved noncompliance, that period does not start until the matter is resolved. Later audits read earlier characterizations, and future enforcement matters may cite them as compliance history, which is why counsel and compliance should both shape the wording.

From the Practice

Common errors widen the matter: overstated duration or scope, implied culpability, unrelated issues combined. The characterization stays in the record for years.

Chapter 4

Scope Discipline: What to Include and What to Exclude

Scope discipline in a Self-Report matters as much as content. The instinct to over-include creates exposure the original violation never required.

4.1 The Over-Inclusion Instinct

Every Self-Report has a scope: what the entity is reporting, the period covered, the systems involved, and which related issues, if any, come along. Compliance teams often want to over-include, on the theory that broad disclosure shows good faith. In our view, the instinct is well meant and wrong, because over-inclusion expands what the regulator will investigate, adds to the documentation that must be produced, stretches the timeline to closure, and creates exposure the original violation did not.

4.2 Bound the Report to the Actual Violation

The discipline is to scope the Self-Report to the actual violation, supported by the actual facts. A documentation gap that affects three procedures is a Self-Report about three procedures, not about the entire procedural framework. A control failure during a discrete period is a Self-Report about that period, not about the broader compliance program. The scope is as wide as necessary, supported by evidence, and tied to the specific requirement. The User Guide sets the same practice: "A separate Self-Report should be created for each Requirement with the noncompliance information relevant only to that Requirement."

Bounding is not the same as under-reporting. The User Guide expects an extent-of-condition review and asks the entity to describe both the scope of the issue and how the review was done. If that review shows the problem reaches a fourth procedure, the report covers four. Precision cuts both ways.

4.3 Bounded Disclosure Is Not Concealment

Counsel manages scope, and the discipline is uncomfortable for teams trained to disclose broadly. That discomfort is worth acknowledging. Bounded disclosure is not concealment. It is precision: full transparency about the matter being reported, without merging into it matters that are separate. A bounded report still gives the CEA every piece of information it needs to investigate the reported violation, because withholding that information is the concealment aggravator in the Sanction Guidelines.

Separate does not mean ignored. The Sanction Guidelines treat concealing, or attempting to conceal, the violation or information necessary to investigate the violation as an aggravating factor, and the presumption is that the monetary penalty doubles. Cooperation credit requires timely and thorough cooperation, which should include disclosure of all pertinent information known by the entity. If the investigation turns up a different potential noncompliance, it gets its own analysis and its own Self-Report where the entity has, or may have, violated a Reliability Standard (Appendix 4C, Section 4.5). In our view the right question is not whether to disclose it, but whether it belongs in this report or in another one.

4.4 Keep the Cause Analysis at the Level of the Matter

Scope discipline also governs cause. A Self-Report has to state the cause of the noncompliance; Section 4.5 of Appendix 4C requires it. The User Guide adds that the entity should identify all contributing causes in order to effectively correct the noncompliance and prevent recurrence. So report every contributing cause the investigation has established for this noncompliance, factually. If the cause analysis is still under way, the User Guide accepts the entity's best estimate of the cause, with the analysis completed as part of mitigation. What stays out is speculation about systemic causes the investigation did not confirm, because it invites the regulator to look at those systemic issues and produces a much larger investigation than the Self-Report ever contemplated.

From the Practice

Scope discipline matters as much as content. Self-Reports that reach past the actual violation invite regulator interest in adjacent matters. Bounded disclosure is not concealment. It is precision. Report the full extent of this noncompliance, and give a separate issue its own analysis and its own Self-Report where the entity has, or may have, violated a requirement. State the cause at the level of the immediate matter. Speculating about systemic causes invites an investigation the Self-Report did not contemplate.

Chapter 5

Timing: When the Window Opens and When to Use It

The timing of a Self-Report is strategic, but the rules set the outer edges. Filing too early and filing too late both carry avoidable costs.

5.1 What the Rules Say About Timing

Appendix 4C, Section 4.5, says Self-Reports are encouraged at the time a registered entity becomes aware that it has, or may have, violated a Reliability Standard. It sets no fixed filing deadline. The incentive sits in the Sanction Guidelines (Appendix 4B). To earn self-reporting credit, the entity must report within a reasonably prompt time after becoming aware of the violation and before the regulator detects it through a compliance monitoring engagement or a notification of an upcoming one. A footnote adds that an entity should submit a Self-Report as soon as practical, but typically within three months of discovery, and provide more information as it becomes known. Regulators keep discretion to give credit outside that period.

Two more details carry real weight. Receiving a notification letter for an upcoming audit, spot check or self-certification generally ends self-reporting credit for the in-scope requirements until the engagement is over. And the credit itself is meaningful: the Sanction Guidelines allow the self-report factor to reduce the base monetary penalty by up to 30 percent.

5.2 Ready Enough to File

The right moment is neither rushed nor delayed. It is when the entity has investigated enough to file an accurate report, has worked out its legal posture, and is prepared to stand behind the report for the rest of the matter. The investigation needs to be complete enough to support an accurate filing, but not so exhaustive that the credit window closes. Deciding when it is enough is a legal judgment counsel makes with the compliance team. The factual foundation has to be solid. The characterization has to be considered. The mitigation framing has to be drafted. Internal authority to file has to be in place.

None of this justifies sitting on a known issue. The guidance expects the entity to file promptly and supplement as facts develop, so the preparation described in Chapter 7 has to exist before the violation surfaces. The User Guide also gives the route when readiness and promptness pull apart. Self-Reports can be based on preliminary information. If identifying all relevant information may take more than three months, the entity should inform its CEA of the noncompliance and ask for guidance on the timing. And if an extent-of-condition review would delay notice, it can be completed within mitigation.

5.3 Filing Too Early

Filing before the strategy is ready causes predictable problems. The investigation may surface facts that change the framing after the report is on the record. The mitigation language may not yet reflect what the entity is actually doing. Supplementing a Self-Report with new facts is expected. Reversing its characterization is different, and in our view it tells the regulator the original framing was not thought through. That creates negotiation friction the entity could have avoided.

5.4 Filing Too Late

Filing late creates a different kind of problem. The regulator may find the matter on its own first, and an issue found in an audit or spot check does not qualify for self-reporting credit. The regulator may read the delay as a sign of a weak compliance program. Under the Sanction Guidelines the program is a mitigating factor, and a poor program cannot by itself raise the penalty, so the cost is mitigating credit lost or reduced. Each of these costs the entity more than the time it spent building its strategy. Timing is a strategic decision that counsel manages with attention to both the credit window and the readiness of the report.

From the Practice

Timing is strategic. The right moment is when the entity has investigated enough, settled its legal posture, and is ready to stand behind the report. Appendix 4C sets no fixed deadline, but self-reporting credit depends on prompt filing before the regulator finds the issue. The Sanction Guidelines point to as soon as practical, typically within three months of discovery. Counsel manages the timing decision with compliance. The groundwork has to exist before the violation surfaces.

Chapter 6

The Mitigation Statement: Setting Up the Settlement

The mitigation statement in the Self-Report is the entity's first chance to set up the eventual settlement. Drafting it deliberately shapes the outcome months later.

6.1 More Than a Procedural Element

Under Appendix 4C, Section 4.5, a Self-Report describes the actions taken or to be taken to mitigate the noncompliance, including preventing recurrence. The User Guide allows mitigation to be submitted with the Self-Report or later. Mitigation can take the form of Mitigating Activities or a formal Mitigation Plan, and Section 6.2 lists what a Mitigation Plan must contain, including the cause, the activities to correct the noncompliance and its cause and to prevent recurrence, a completion date, and implementation milestones. The CEA may agree to a mutually acceptable timeline for completion of milestones, typically no more than three (3) months for each milestone, and it can adjust that timeline. Section 6.1 also states that submitting a Mitigation Plan does not constitute an admission of a violation.

The mitigation statement often gets treated as a box to fill. It is one of the most consequential parts of the document. It is the entity's first chance to frame how the regulator thinks about remediation, and that framing becomes the foundation for the mitigation terms in any settlement.

6.2 Narrow and Specific Beats Broad and Open

A mitigation statement that promises broadly, without precision about scope or completion criteria, creates open-ended obligations the entity will have to meet. One that promises narrowly, with specific scope, timelines and completion criteria, creates obligations that are bounded, achievable and verifiable. The second is the stronger position, because the framing carries into the settlement document and into the entity's obligations for years. Milestones matter here too: Section 6.2 warns that failing to complete work tied to accepted milestones can lead to additional violations.

6.3 The Statement Frames the Cause

The mitigation statement also frames the cause. An entity that describes a matter as a specific control failure that has now been fixed stands in a different place than one that describes broad programmatic weakness requiring comprehensive change. Both descriptions may be partly accurate. The first produces a settlement focused on the specific control. The second produces a settlement that commits the entity to program changes that may exceed what the underlying matter warrants.

6.4 How Counsel Drafts It

Counsel drafts the mitigation statement with all of these downstream effects in mind. The statement is honest about what the entity is doing and will do, and precise about scope, timeline and completion. Open-ended language that creates obligations nobody examined stays out. The aim is a settlement that reflects the actual matter, not the expanded version the regulator might propose if the framing left that door open.

From the Practice

Specific, bounded, time-limited mitigation language produces specific, bounded settlement obligations. Broad language produces open-ended ones. The mitigation statement also frames the cause. Counsel drafts it with an eye on how that framing will read in the settlement document.

Chapter 7

Coordinating with Counsel and Compliance Internally

A high-quality Self-Report needs counsel and compliance working together, on a process built before the violation surfaces.

7.1 Design the Process Before You Need It

Design the integration before any matter arises. It answers five questions: who is notified when a potential violation is identified, who decides whether it warrants a Self-Report, who drafts, who reviews, and who has final filing authority. Without it, each matter triggers ad hoc coordination that runs past the credit window, and the report goes out missing an input.

7.2 Notification Is Where It Usually Breaks

In our experience, notification is where the process most often breaks. Compliance teams find potential violations through operational review, audit findings, employee reports or outside information, and their first instinct is to investigate before calling counsel. That produces the discoverable investigation described in Chapter 2. The defensible design has compliance notify counsel at once, and counsel decides whether to engage and at what level.

7.3 Drafting and Signing

Both functions draft. Counsel writes the legal aspects: the characterization, the scope, and the strategic framing. Compliance writes the operational facts: what happened technically, which controls were involved, and what mitigation has been done. The draft moves between them until both are satisfied.

Counsel manages the filing decision and the filing, with compliance in support. Section 1.1 covers who may sign. In our view a senior officer should sign a Self-Report, and whoever signs should have read and understood the document, including its legal implications. Counsel briefs the signer on the content and the strategic posture before signing. This is not a formality. The signer is committing the entity, and the briefing is what makes that commitment informed.

From the Practice

Design the counsel-compliance process before any matter arises. Ad hoc coordination costs time and quality. Compliance notifies counsel the moment a potential violation is identified. Counsel decides the level of engagement, and the investigation follows. The signer commits the entity. Counsel briefs the signer before signing.

Chapter 8

The Self-Report as a Forward-Facing Asset

A good Self-Report is an asset for the rest of the lifecycle. A poor one is a liability.

8.1 Where the Report Travels

A Self-Report puts the entity's account into the regulator's record, and the record moves quickly. Under Appendix 4C, the CEA runs a Preliminary Screen within ten business days after a potential noncompliance is identified, and NERC notifies FERC within two business days of receiving the CEA's notice. FERC's regulations at 18 CFR 39.7(b) require NERC and each Regional Entity to have procedures to report self-reported violations to the Commission promptly, and 39.7(b)(4) treats the matter as nonpublic until it is filed as a Notice of Penalty or otherwise resolved.

In investigation and negotiation, the regulator reads its requests and settlement positions against it. At closure, the Notice of Penalty filed with FERC must include findings of fact about the conduct behind each violation. NERC publicly posts information about settled violations (Appendix 4C, Section 5.6). It also posts Notices of Penalty for non-CIP violations (Section 8.2). Both redact confidential and critical infrastructure information. In later compliance cycles, the report is part of the entity's regulatory history.

8.2 Asset or Liability

A well-drafted Self-Report works for the entity in all of those settings. Its framing supports the settlement posture; its scope, mitigation language and characterization are bounded, precise and accurate. In our view, reports like that settle cleaner and close faster.

A poorly drafted one works against the entity in the same settings: framing that concedes points nobody examined, scope wider than the facts, open-ended mitigation language. In our view it costs the entity in settlement and on the road to closure, because the report is evidence of its view.

8.3 File Once, File Deliberately

The entity decides which kind of report it has filed at the moment it files. Supplementing it as facts develop is expected. In our view, repeated corrections to its framing signal a program that is not producing reliable analysis. File deliberately, with counsel and compliance both at the table. The document will be read for years.

From the Practice

Supplement with new facts, but file at a quality that needs no reframing.

Glossary

Glossary

Align. NERC's system for submitting Self-Reports and mitigation to the CEA.

Alleged Violation. A potential noncompliance where the CEA has determined evidence indicates a violation, to be resolved outside Compliance Exception or FFT (Appendix 2).

Attorney-client privilege. Protects confidential communications between a client, including its employees, and counsel made to secure legal advice, not the underlying facts.

CMEP. Compliance Monitoring and Enforcement Program (Appendix 4C, Rules of Procedure).

Compliance Enforcement Authority (CEA). NERC or the Regional Entity in its role of monitoring and enforcing compliance with the Reliability Standards (Appendix 2).

Compliance Exception. A streamlined disposition for minimal-risk noncompliance, not included in compliance history for penalty purposes (Appendix 4C, Section 4A.1).

Extent of condition. The review of how far a noncompliance reaches. The User Guide asks for the scope of the issue and how the review was done.

Find, Fix, Track and Report (FFT). Streamlined disposition for minimal or moderate risk (Appendix 4C, Section 4A.2).

Mitigating Activities. Actions to correct and prevent recurrence of a noncompliance, whether or not embodied in a Mitigation Plan (Appendix 2).

Mitigation Plan. The entity's action plan to correct a noncompliance and prevent recurrence; contents listed in Appendix 4C, Section 6.2.

Notice of Penalty. NERC's filing with FERC of a penalty, with findings of fact and the record of the proceeding (18 CFR 39.7).

Preliminary Screen. The CEA's ten-business-day check: entity registered, requirement applicable and in effect, matter not a duplicate (Appendix 4C, Section 4.8).

Sanction Guidelines. Rules of Procedure Appendix 4B, which sets how penalties are determined.

Self-Logging. A log kept in place of individual Self-Reports by entities approved after a formal review of internal controls; minimal risk only, with a rebuttable presumption of Compliance Exception treatment (Appendix 4C, Section 4.5A).

Self-Report. A report by a registered entity stating that it believes it has, or may have, violated a Reliability Standard (Appendix 2).

Work product. Material prepared in anticipation of litigation, shielded absent substantial need and undue hardship (Federal Rule of Civil Procedure 26(b)(3)).

How Energy Compliance Can Help

How Energy Compliance Can Help

A Self-Report is decided in the first days after a potential violation surfaces, when the privilege structure, characterization and scope get set. Energy Compliance, Inc. and Stich Angell, P.A. work that problem together, with a named senior practitioner on each side.

Legal Series services

The Legal Series supports registered entities across the full enforcement lifecycle, structured for operational execution and legal defensibility. Integrated legal-compliance services include, but are not limited to:

• Self-Report drafting and legal review
• Internal investigation conducted under privilege
• Notice of Penalty response strategy and execution
• Document production and privilege log management
• Witness preparation for Regional Entity interviews
• Settlement negotiation with Regional Entity counsel
• FERC submission preparation and review
• Legal-compliance operating framework design
• Counsel-led after-action review and lessons integration

The practice is organized around four lines of work. Enforcement Defense: Notice of Penalty response and settlement strategy. Privilege Counsel: internal investigation and document production under privilege. Regulatory Advisory: FERC submissions and Regional Entity counsel engagement. Legal-Compliance Integration: operating frameworks built before enforcement arrives. Each engagement is scoped to the entity's role, function, regulatory posture, and the procedural stage of the matter.

Compliance support behind the filing

• Data request strategy. The regulator reads its information requests against the Self-Report. We plan responses that stay consistent with the record.
• Audit defense. Characterizations carry into later audits. We prepare entities for the engagement where an earlier Self-Report will be on the table.
• Compliance program management. We build the Chapter 7 notification and drafting process into the program before it is needed.

WattOps Compliance

The duration, extent and mitigation facts in a Self-Report are only as good as the evidence behind them. WattOps Compliance is EC's NERC compliance evidence platform (wattopscompliance.com). We will run one standard at one facility through WattOps at no cost; CIP standards are excluded.

RenewOps

For renewable and storage operators, the facts that establish when a noncompliance started and how far it reached often sit in operations data. RenewOps is EC's renewable operations monitoring and analytics platform, with a Data Center module.

If a potential violation is on your desk, or you want the process in place before one is, call us before anyone starts writing.

Website: energycomplianceinc.com · Email: [email protected]

Phone: 763.438.4427

About the Author

About the Author

Rob Smith is the Founder and Principal of Energy Compliance, Inc., with more than thirty years in the industry on every side of the system. He began in control-room operations as a Reliability Coordinator, Transmission Operator, and Power System Operator across RTO/ISO and utility control centers. On the regulator side, he was a senior compliance auditor and subject matter expert for NERC Reliability Standards. He audited grid facilities, evaluated mitigation adequacy, participated in risk-based oversight of utility mitigation activities, and supported the development of violation notifications and settlements in FERC-directed enforcement actions. He conducted a regulatory audit in the Sultanate of Oman against the Sultanate's Sector Law and Grid Code.

He founded Energy Compliance, Inc. to deliver senior regulator-side compliance authority without the layered staffing and billable-hour overhead of larger firms.

Education: MBA, Energy Management, University of Mary; MSL, Compliance Law, Fordham Law University; BAS, Energy Management, Bismarck State College; BAS, Mechanical Engineering, Metallurgy minor, University of Florida; BAS, Criminology, St. Petersburg College (State Law Enforcement Certification); AAS, Power Plant Technology, Bismarck State College; AAS, Electrical Transmission System Technology, Bismarck State College.

Certifications: NERC Lead Auditor training; previously NERC-certified at the Reliability Coordinator level; 1st Class A Boiler Engineer License, Minnesota.

Cara C. Passaro, Stich Angell, P.A.

Cara C. Passaro is Shareholder and Firm President at Stich Angell, P.A. She has represented clients throughout the upper Midwest since 2001 and has tried cases to verdict, won dispositive motions, or reached favorable settlements in hundreds of matters. Her practice covers construction and design defect defense, products liability, personal injury, and energy compliance representation. She is licensed to practice in the Minnesota and North Dakota state and federal courts and is recognized as a Super Lawyer. Cara serves as the named legal author of the Energy Compliance, Inc. Legal Series and is the partner engagement lead for the Stich Angell side of the integrated practice.

About Energy Compliance, Inc.

About Energy Compliance, Inc.

Energy Compliance, Inc. is an independent consulting and advisory firm focused exclusively on electric reliability, cybersecurity reliability, and regulatory compliance for organizations connected to the North American Bulk Electric System.

Our work supports registered entities, including Generator Owners and Operators, Transmission Owners and Operators, Reliability Coordinators, Balancing Authorities, and Distribution Providers, across NERC Reliability Standards, FERC orders, RTO/ISO market participation rules, Regional Entity oversight, and state regulatory frameworks.

Energy Compliance partners with Stich Angell, P.A. for legal matters arising in the NERC enforcement lifecycle, including Notice of Penalty response, settlement negotiation, internal investigation under privilege, and the integrated legal-compliance operating frameworks registered entities need before enforcement arrives. The integrated practice replaces the sequential model in which compliance and legal engage separately and meet only after a matter has escalated.

Engagements are overseen by a senior practitioner on the compliance side and by a named partner on the legal side. We do not staff for billable hours. We staff for outcomes. Our deliverables are written to be operationally executable and audit-defensible, not to manufacture activity.

Energy Compliance is not affiliated with, sponsored by, or endorsed by the North American Electric Reliability Corporation, the Federal Energy Regulatory Commission, or any Regional Entity.

About Stich Angell, P.A.

Since 1971, Stich Angell lawyers have represented businesses in civil matters. Practice areas include catastrophic injury and wrongful death, products liability, construction, retail and hospitality, transportation, and energy regulatory legal services. The firm has expanded into energy compliance representation, partnering with Energy Compliance, Inc. to give registered entities integrated legal and compliance support across the NERC enforcement lifecycle. Stich Angell, P.A. is located in Bloomington, Minnesota. To engage the integrated legal-compliance practice, contact Energy Compliance, Inc. at 763.438.4427 or Stich Angell at (612) 333-6251. Online at energycomplianceinc.com and stichlaw.com.

Sources and Authorities

Sources and Authorities

• North American Electric Reliability Corporation, Rules of Procedure, Appendix 4C, Compliance Monitoring and Enforcement Program (effective May 19, 2022), Sections 4.0, 4.5, 4.5A, 4.8, 4A, 5.6, 6.1 through 6.4, 8.2, 9.2 and 9.3. https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/appendix-4c.pdf
• North American Electric Reliability Corporation, Rules of Procedure, Appendix 4B, Sanction Guidelines of the North American Electric Reliability Corporation (effective January 19, 2021), Section 3.3 adjustment factors, footnotes 6 through 8, and adjustment factor table. https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/appendix-4b.pdf
• North American Electric Reliability Corporation, Rules of Procedure, Appendix 2, Definitions Used in the Rules of Procedure (effective June 27, 2024): Alleged Violation, Compliance Enforcement Authority, Mitigating Activities, Mitigation Plan, Self-Report. https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/appendix-2.pdf
• North American Electric Reliability Corporation, Registered Entity Self-Report and Mitigation Plan User Guide, Version 5.0 (October 15, 2024). https://www.nerc.com/globalassets/programs/enforcement/enforcement-resources/registered-entity-self-report-and-mitigation-plan.pdf
• 18 CFR 39.7, Enforcement of Reliability Standards, Code of Federal Regulations (April 1, 2025 edition), via govinfo, accessed October 25, 2026. https://www.govinfo.gov/link/cfr/18/39?sectionnum=7&year=mostrecent&link-type=html
• Upjohn Co. v. United States, 449 U.S. 383 (1981). https://supreme.justia.com/cases/federal/us/449/383/
• Federal Rules of Civil Procedure, Rule 26(b)(3), Trial Preparation: Materials. https://www.law.cornell.edu/rules/frcp/rule_26
• Stich Angell, P.A., attorney profile of Cara C. Passaro. https://stichlaw.com/cara-c-passaro/
• Stich Angell, P.A., firm website and contact information. https://stichlaw.com/