Self-Reporting: Legal Considerations Before You File

Foreword

Foreword

This professional reference is part of the Legal Series published by Energy Compliance, Inc. in partnership with Stich Angell, P.A., for registered entities and the people who run their compliance and legal programs. NERC enforcement is procedurally a civil enforcement regime that registered entities frequently treat as a compliance process. The framing matters. The decisions made early in any enforcement matter bind the entity through every subsequent stage, and many of those decisions involve legal judgment that compliance teams are not trained to make alone. The cost of recognizing this late is significant, rarely visible at the moment, and largely avoidable with the right operating framework in place. Energy Compliance, Inc. partners with Stich Angell, P.A. to provide registered entities with integrated legal-compliance support across the full enforcement lifecycle. Rob Smith brings more than thirty years of operator and regulator-side compliance experience. Cara Passaro and the Stich Angell team bring civil litigation depth, appellate practice, and increasing focus on energy compliance defense. The combination is the structural alternative to the model in which compliance consulting and legal counsel operate as separate engagements that converge only when an enforcement matter has already arrived. These references are written for the compliance manager who has to brief the general counsel honestly. For the in-house attorney who needs to understand how NERC enforcement actually proceeds. For the senior leader who has been told that the enforcement matter is under control and suspects it is not. For the outside counsel who has been asked to advise on a NERC matter for the first time and needs a practitioner's view of the procedural reality. The references do not substitute for engaged counsel and they do not replace operational compliance judgment. They describe how the system actually works, in the voice we use in front of regulators and in the courtroom, so that registered entities can make the decisions in front of them with the information practitioners would want them to have. If the integrated legal-compliance approach we describe is what your entity needs, the back of this reference contains contact information. If not, the reference still belongs to you. Take what is useful, apply it well, and remember that the structural decisions made before an enforcement matter arrives are almost always worth more than the decisions made after.

— Cara C. Passaro and Rob Smith Stich Angell, P.A. · Energy Compliance, Inc.

EC-WP-803 Self-Reporting: Legal Considerations Before You File

Why Self-Reports Are Legal Documents First

Why Self-Reports Are Legal Documents First

Self-Reports are widely treated as compliance documents drafted in compliance language. The treatment is misaligned with the document's actual function in enforcement.

A Self-Report is procedurally a sworn or quasi-sworn submission by the registered entity to a Regional Entity, acknowledging a potential violation of one or more NERC Reliability Standards. The submission becomes part of the regulator's record. The submission's content is read, cited, and relied upon by the regulator across the rest of the enforcement lifecycle. The submission's wording binds the entity in any subsequent settlement and in any adjudicated outcome. The submission's framing influences the penalty, the characterization, and the mitigation requirements that the regulator eventually proposes. Each of these consequences is legal in nature, even when the underlying subject matter is operational. Despite this profile, Self-Reports are commonly drafted by compliance personnel as compliance documents. The language is operational. The framing emphasizes corrective action. The legal characterization of the violation is left implicit or stated in compliance terms that may not align with the legal terminology the regulator will use. The result is a document that reads as compliant in tone while binding the entity to legal characterizations the entity has not actually examined or chosen to make. The reframing required is not exotic. A Self-Report is a legal document with compliance content. The legal aspects, including the characterization of the violation, the scope of the acknowledgment, the language of the mitigation statement, and the timing of filing, are subject to legal analysis and legal judgment. The compliance content describes the operational facts. The legal aspects shape how those facts will be interpreted. Both are necessary. Treating the document as compliance-only misses half the work. The structural fix is to integrate counsel into Self-Report development from the moment the entity identifies a potential violation. Counsel reviews the legal aspects. Compliance contributes the operational facts. The integrated document carries both inputs. Entities that adopt this discipline produce Self-Reports that protect the entity's settlement posture across the rest of the lifecycle. Entities that do not, file documents that the regulator uses to anchor the eventual settlement on terms the entity would have chosen differently if it had examined them legally.

FROM THE PRACTICE A Self-Report is a legal document. Drafting it as a compliance document concedes ground the entity has not actually examined. The legal aspects of a Self-Report (characterization, scope, language, timing) shape how the operational facts will be interpreted and settled. Counsel and compliance both contribute. Counsel reviews legal aspects. Compliance contributes facts. The integrated document is the deliverable.

The Privilege Question Before Filing

The Privilege Question Before Filing

Privilege over the pre-filing investigation has to be established before the investigation begins. Filing the Self-Report does not waive the privilege automatically, but the investigation conducted before filing can.

The entity's investigation of a potential violation, conducted before the Self-Report is filed, is one of the most privilege-sensitive moments in the enforcement lifecycle. The investigation generates documents. The investigation produces witness recollections that may later become testimony. The investigation forms the factual foundation for the entity's eventual filing and any subsequent settlement. Whether that work is privileged depends on how it is structured at the moment it begins, and the structure cannot be retrofitted after the work is done. An investigation conducted by compliance staff, framed as routine root cause analysis, is generally discoverable. The investigation memoranda will be produced if requested. The witness interviews will be reflected in records that the regulator can access. The factual narrative the investigation produces becomes the regulator's narrative if the entity later wants to take a different position. None of this is recoverable after the fact. The privilege is lost at the moment of creation, not at the moment of production. An investigation conducted at counsel's direction, framed as legal analysis prepared in connection with a potential enforcement matter, is generally privileged. The investigation memoranda are work product. The witness interviews are conducted by counsel or under counsel's direction. The factual narrative is the entity's own analysis, which the entity controls and uses to inform its filing strategy. The Self-Report itself is not privileged once filed, but the underlying investigation that informed it remains protected. The structural design of a privileged pre-filing investigation is consistent with the design described in EC-WP-800 for any enforcement-related investigation. Counsel directs the work in writing. Investigators report to counsel. Interim work product is marked privileged and distributed only inside the privilege circle. The investigation produces a privileged memorandum that informs the Self-Report drafting and is not itself filed. The Self-Report contains the operational facts, framed deliberately by counsel for the regulator's record. The two products are related and distinct. Maintaining the distinction preserves the entity's strategic optionality across the rest of the matter.

FROM THE PRACTICE Privilege over the pre-filing investigation is established before the investigation begins. Retroactive privilege claims rarely hold. Investigations conducted by compliance staff without counsel direction are generally discoverable. Investigations conducted at counsel's direction are generally privileged. The Self-Report contains operational facts framed for the record. The underlying privileged memorandum stays internal. Both, separately.

Characterizing the Violation: Words That Bind

Characterizing the Violation: Words That Bind

The characterization of the violation in the Self-Report binds the entity through the rest of the matter. The wording is a legal choice, not a compliance shortcut.

The Self-Report characterizes the violation. The characterization includes which standard or requirement was violated, the nature of the noncompliance, the duration, the operational scope, and the entity's view of the underlying cause. Each element of the characterization is a wording choice, and the choices made in the Self-Report bind the entity through the rest of the lifecycle. The regulator reads the characterization as the entity's view of the matter. Subsequent settlement language anchors on the characterization. The penalty calculation reflects the characterization. The mitigation requirements respond to the characterization. Common characterization errors are predictable. Stating the violation in broader terms than the facts actually support, often out of an abundance of caution that the entity intends to demonstrate. Using language that implies legal conclusions about culpability or willfulness when the facts do not require such language. Combining what is actually a single violation with related operational issues that should remain separate matters. Each error broadens the scope of the matter beyond what the facts require, and each is reversible only with significant difficulty after the Self-Report is filed. Counsel-reviewed characterization is precise about what happened, in language that matches the regulator's standard terminology, without conceding legal points the entity has not actually conceded. Duration is stated specifically. Operational scope is bounded to what is documented. Cause is described factually rather than characterized in language that implies legal conclusions. The characterization is honest, complete, and contained. Honesty preserves the entity's credibility with the regulator. Containment preserves the entity's settlement posture. The characterization also has implications beyond the immediate matter. The entity's regulatory record carries the characterization forward. Subsequent audits read the prior matters' characterizations. Future enforcement matters may cite the characterization in evaluating the entity's overall compliance posture. The wording the entity uses today appears in regulatory contexts for years. Drafting it deliberately, with both counsel and compliance contributing, is the discipline that protects the entity across all of those forward-looking contexts.

FROM THE PRACTICE The characterization in the Self-Report binds the entity through the rest of the matter. The wording is a legal choice, not a compliance shortcut. Common errors broaden the matter beyond what the facts require: overstating duration, overstating scope, implying culpability, combining unrelated issues. The characterization appears in regulatory contexts for years. Drafting it deliberately protects the entity across forward-looking matters.

Scope Discipline: What to Include and What to Exclude

Scope Discipline: What to Include and What to Exclude

Scope discipline in a Self-Report is as consequential as content. The instinct to over-include creates exposure the original violation did not require.

A Self-Report has a scope. The scope defines what the entity is reporting, what time period the report covers, what operational systems are implicated, and what related issues, if any, are included. The instinct of compliance teams is often to over-include, on the theory that broader disclosure demonstrates good faith. The instinct is well-intentioned and wrong. Over-inclusion expands the matter the regulator will investigate, increases the documentation that has to be produced, lengthens the timeline to closure, and creates exposure that the original violation did not require. The discipline is to scope the Self-Report to the actual violation, supported by the actual facts, with related-but-distinct issues handled separately if at all. A documentation gap that affects three procedures is a Self-Report about three procedures, not a Self-Report about the entire procedural framework. A control failure that occurred during a discrete period is a Self-Report about that period, not a Self-Report about the broader compliance program. The scope is bounded to what is necessary, supported by evidence, and tied to the specific requirement the entity is acknowledging. Counsel manages the scope discipline. The discipline is uncomfortable for compliance teams that have been trained to disclose broadly, and the discomfort is appropriate to acknowledge. Bounded disclosure is not concealment. It is precision. The entity is acknowledging what the entity is acknowledging, with full transparency about the bounded matter, and remaining silent about adjacent matters that are not actually within the scope of this report. If the regulator subsequently identifies adjacent matters, those become separate matters with their own analysis. The Self-Report does not create an obligation to volunteer them. The scope discipline also addresses the question of cause. A Self-Report acknowledges what happened. It does not need to diagnose every contributing cause across the entity's operations. The cause analysis is appropriate to include at the level of the immediate matter, framed factually, and bounded to what the investigation actually established. Speculating about systemic causes that the investigation did not confirm invites regulator interest in those systemic issues, which produces a much larger investigation

FROM THE PRACTICE Scope discipline matters as much as content. Self-Reports that exceed the actual violation invite regulator interest in adjacent matters. Bounded disclosure is not concealment. It is precision. The entity is acknowledging what is supported by the actual facts and bounded to the specific requirement. The cause analysis is appropriate at the level of the immediate matter. Speculating about systemic causes invites investigation the Self-Report did not contemplate.

Timing: When the Window Opens and When to Use It

Timing: When the Window Opens and When to Use It

The timing of a Self-Report is strategic. Filing too early or too late both produce avoidable consequences. The entity should be ready to file at the moment the strategy supports it.

Self-Reports have a regulatory timing framework. The Regional Entity expects timely filing of identified potential violations, and undue delay can itself become a separate compliance issue. At the same time, filing before the entity has completed its investigation and developed its strategic posture produces a Self-Report that the entity may later want to amend or reframe, which creates its own complications. The right timing is neither rushed nor delayed. It is the moment at which the entity has completed sufficient investigation to file a complete and accurate report, has developed its legal posture, and is prepared to defend the report through the rest of the matter. The investigation has to be complete enough to support an accurate Self-Report but not so exhaustive that the timing window is missed. The judgment about when investigation is sufficient is a legal judgment that counsel makes in conjunction with the compliance team. The factual foundation has to be solid. The legal characterization has to be considered. The mitigation framing has to be drafted. The internal authority for filing has to be in place. Each of these has to be ready before the report is appropriate to file. Filing too early produces predictable problems. The investigation may surface facts that change the framing after the Self-Report is on the record. The mitigation language may not yet reflect the entity's actual remediation posture. The entity may amend the report later, which signals to the regulator that the original framing was not considered. Each of these creates negotiation friction that the entity could have avoided by waiting until the strategy was ready. Filing too late produces a different category of problem. The Regional Entity may identify the matter independently before the Self-Report arrives, which significantly changes the enforcement posture. The Regional Entity may view the delay as itself indicative of compliance program weakness. The Regional Entity may apply more aggressive penalty analysis to a late-filed matter than to a timely-filed one. Each of these costs the entity meaningfully more than the time the entity used to develop the strategy. The timing decision is not optional. It is a strategic decision counsel manages with attention to both the

FROM THE PRACTICE Timing is strategic. The right moment is when the entity has completed sufficient investigation, developed its legal posture, and is ready to defend the report. Filing too early creates negotiation friction the entity could have avoided. Filing too late changes the enforcement posture significantly. Counsel manages the timing decision in conjunction with compliance. Each of the elements that supports filing has to be ready before the filing happens.

The Mitigation Statement: Setting Up the Settlement

The Mitigation Statement: Setting Up the Settlement

The mitigation statement in the Self-Report is the entity's first opportunity to set up the eventual settlement. Drafting it deliberately shapes the outcome months later.

Self-Reports include or accompany a mitigation statement that describes the actions the entity has taken or will take to address the noncompliance and prevent recurrence. The mitigation statement is widely treated as a procedural element of the Self-Report. It is in fact one of the most strategically consequential parts of the document. The mitigation statement is the entity's first opportunity to frame how the regulator will think about remediation, which becomes the foundation for the regulator's eventual mitigation requirements in any settlement. A mitigation statement that promises broadly, without precision about scope or completion criteria, creates open-ended obligations the entity will have to meet. A mitigation statement that promises narrowly, with specific scope, specific timelines, and specific completion criteria, creates obligations that are bounded, achievable, and verifiable. The entity is significantly better positioned with the second framing, because the framing carries forward into the settlement document and into the entity's compliance obligations across multiple subsequent years. The mitigation statement also frames the underlying cause analysis. The entity that describes a matter as the result of a specific control failure that has now been remediated is in a different position than the entity that describes the matter as the result of broader programmatic weaknesses that require comprehensive program updates. Both framings may be accurate to varying degrees. The first framing produces a settlement focused on the specific control. The second framing produces a settlement that requires the entity to commit to comprehensive program changes that may exceed what the underlying matter actually warrants. Counsel drafts the mitigation statement with attention to all of these forward-looking implications. The statement is honest about what the entity is doing and what the entity will do. The statement is precise about scope, timeline, and completion. The statement avoids open-ended language that creates obligations the entity has not actually examined. The statement positions the entity for a settlement that reflects the actual matter rather than expanded versions the regulator might propose if the framing

FROM THE PRACTICE The mitigation statement is the entity's first opportunity to set up the settlement. Drafting it well shapes the outcome months later. Specific, bounded, time-limited mitigation language produces specific, bounded settlement obligations. Broad language produces open-ended ones. The mitigation statement also frames the cause. Counsel drafts it with attention to how the framing will appear in the eventual settlement document.

Coordinating with Counsel and Compliance Internally

Coordinating with Counsel and Compliance Internally

High-quality Self-Reports require integrated input from counsel and compliance. The coordination is operational, not theoretical, and is built before the violation surfaces.

The integration of counsel and compliance in Self-Report development is operational work that has to be designed before any specific matter arises. The design includes who is notified when a potential violation is identified, who decides whether the matter warrants a Self-Report, who drafts the report, who reviews it, and who has final filing authority. Without this design, each potential matter triggers ad hoc coordination that takes longer than the timing window allows, and the report often gets filed without one of the necessary inputs. The notification step is the most commonly mishandled. Compliance teams identify potential violations through routine operational review, audit findings, employee reports, or external information. The compliance team's first instinct is often to investigate internally before notifying counsel. This instinct produces the discoverable investigation problem described in Chapter 2. The defensible design has compliance notify counsel at the moment a potential matter is identified, with counsel then deciding whether to engage and at what level. The drafting design recognizes that both functions contribute. Counsel drafts the legal aspects, including the characterization, the scope, and the strategic framing. Compliance drafts the operational facts, including the technical detail of what happened, the specific controls involved, and the mitigation actions taken. The integrated draft moves between counsel and compliance for review until both are satisfied. The drafting is iterative and is not delegated entirely to either function. The filing decision and the filing itself are managed by counsel, with compliance in support. The filing is typically signed or attested by a designated officer of the entity, often the chief compliance officer or another senior executive. The signature carries personal exposure, and the signing officer should have read and understood the document, including the legal implications. Counsel briefs the signing officer on the document's content and the strategic posture before signing. This step is sometimes treated as a formality. It should not be. The signing officer is committing the entity, and the briefing is what makes the commitment informed.

FROM THE PRACTICE Counsel-compliance integration in Self-Report development is operational work designed before any matter arises. Ad hoc coordination misses timing and quality. Compliance notifies counsel at the moment a potential violation is identified. Counsel decides engagement level. Investigation follows that decision. The signing officer is committing the entity. Counsel briefs the officer on content and strategic posture before signing. The briefing is not a formality.

The Self-Report as a Forward-Facing Asset

The Self-Report as a Forward-Facing Asset

A well-drafted Self-Report is an asset across the rest of the lifecycle. A poorly drafted one is a liability. The entity decides which one it has at the moment of filing.

A Self-Report is the entity's articulation of the matter into the regulator's record. Across the rest of the lifecycle, the report is referenced, cited, and read. In the investigation phase, the regulator interprets information requests against what the report said. In the negotiation phase, the regulator anchors settlement positions on the report's framing. In the closure phase, the FERC submission incorporates language consistent with the report. In subsequent compliance cycles, the entity's regulatory record includes the report as a permanent artifact. A well-drafted Self-Report is an asset across all of these contexts. The framing supports the entity's settlement posture. The scope is bounded and defensible. The mitigation language is precise and achievable. The characterization is accurate and contained. The report reads as a credible, professional document that demonstrates the entity's seriousness about compliance without conceding ground that the entity has not actually examined. Reports of this quality predict cleaner settlements, shorter timelines to closure, and more favorable post-matter dynamics with the regulator. A poorly drafted Self-Report is a liability across the same contexts. The framing concedes points the entity has not actually examined. The scope expands the matter beyond what the facts require. The mitigation language creates open-ended obligations. The characterization carries language the entity will later wish had been written differently. Reports of this quality predict more difficult settlements, longer timelines, and more aggressive regulator postures, because the report itself is being used as evidence of the entity's view of the matter. The entity decides which kind of report it has filed at the moment of filing. After filing, the report is in the record. Amendments are possible but disfavored, and frequent amendment signals to the regulator that the entity's compliance program is not producing reliable analysis. The discipline is to file once, file deliberately, with counsel and compliance both contributing, with strategic posture in mind, and with the understanding that the document filed today will appear in regulatory contexts for years. That discipline is the structural difference between Self-Reports as assets and Self-Reports as liabilities.

FROM THE PRACTICE A well-drafted Self-Report is an asset across the rest of the lifecycle. A poorly drafted one is a liability. The entity decides at the moment of filing. The framing in the report appears in investigation, negotiation, closure, FERC submission, and subsequent compliance cycles. Quality compounds. File once, file deliberately. Amendments are possible but disfavored. The discipline is to file at a quality that does not require amendment.

About the Author

About the Author

Cara C. Passaro is Shareholder and Firm President at Stich Angell, P.A., where she has practiced civil trial and appellate law for more than two decades. She is licensed to practice in the state and federal courts of Minnesota and North Dakota and has been recognized as a Super Lawyer for her work in civil litigation and construction litigation defense. Cara's practice has historically focused on products liability, premises liability, transportation liability, and complex commercial litigation, with an emphasis on the defense of corporate clients in high-stakes matters across the Midwest. She has tried jury cases to verdict in Minnesota state court, argued matters at the Minnesota Court of Appeals, and managed appellate work through the Minnesota Supreme Court. In recent years, Cara and the Stich Angell team have extended the firm's civil litigation practice into energy compliance defense, working with registered entities and their compliance partners on NERC enforcement matters, Notice of Penalty response, settlement negotiations with Regional Entities, and the integrated legal-compliance frameworks that determine whether enforcement matters resolve as manageable procedural events or as multi-year exposures. Cara serves as the named legal author of the Energy Compliance, Inc. Legal Series and is the partner engagement lead for the Stich Angell side of the integrated practice.

About Stich Angell, P.A. Stich Angell, P.A. is a Minneapolis-based civil litigation firm founded in 1971. The firm represents businesses, individuals, and organizations across a broad range of civil practice areas, with particular depth in complex litigation, products liability, transportation liability, professional liability, insurance defense, construction litigation, and appellate practice. The firm's trial and appellate attorneys are recognized among the most experienced civil trial lawyers in the state, with extensive experience representing clients through trial verdict and appellate review. Although the firm is based in Minnesota, the attorneys represent clients in matters across the United States. Stich Angell has expanded the firm's civil litigation practice into energy compliance defense, partnering with Energy Compliance, Inc. to provide registered entities with integrated legal and compliance support across the NERC enforcement lifecycle. The combined practice brings civil litigation discipline, appellate strength, and senior regulatory experience to a category of matters that has historically lacked that combination. Stich Angell, P.A. is located at 3601 Minnesota Drive, Suite 450, Minneapolis, Minnesota 55435, and may be reached at (612) 333-6251 or at stichlaw.com.

About Energy Compliance, Inc.

About Energy Compliance, Inc.

Energy Compliance, Inc. is an independent consulting and advisory firm focused exclusively on electric reliability, cybersecurity reliability, and regulatory compliance for organizations connected to the North American Bulk Electric System. Our work supports registered entities, including Generator Owners and Operators, Transmission Owners and Operators, Reliability Coordinators, Balancing Authorities, and Distribution Providers, across NERC Reliability Standards, FERC orders, RTO/ISO market participation rules, Regional Entity oversight, and state regulatory frameworks. Energy Compliance partners with Stich Angell, P.A. for legal matters arising in the NERC enforcement lifecycle, including Notice of Penalty response, settlement negotiation, internal investigation under privilege, and the integrated legal-compliance operating frameworks that registered entities need before enforcement arrives. The integrated practice replaces the sequential model in which compliance and legal engage separately and converge only when a matter has already escalated. Engagements are led by a single senior practitioner on the compliance side and by a named partner on the legal side. We do not staff for billable hours. We staff for outcomes. Our deliverables are written to be operationally executable and audit-defensible, not to manufacture activity. Energy Compliance is not affiliated with, sponsored by, or endorsed by the North American Electric Reliability Corporation, the Federal Energy Regulatory Commission, or any Regional Entity.

Legal Series Services

Legal Series Services

The Legal Series supports registered entities across the full enforcement lifecycle. The work is structured for operational execution and legal defensibility. Every engagement is led by a named senior practitioner on the compliance side and by a named partner at Stich Angell on the legal side.

Integrated legal-compliance services include, but are not limited to:

• Notice of Penalty response strategy and execution
• Internal investigation conducted under privilege
• Document production and privilege log management
• Witness preparation for Regional Entity interviews
• Settlement negotiation with Regional Entity counsel
• Self-Report drafting and legal review
• FERC submission preparation and review
• Legal-compliance operating framework design
• Counsel-led after-action review and lessons integration

Each engagement is scoped to the entity's role, function, regulatory posture, and the procedural stage of the matter.

ENERGY COMPLIANCE LEGAL SERIES

Defensible Compliance. Disciplined Defense. Energy Compliance, Inc. and Stich Angell, P.A. partner to provide registered entities with integrated legal and compliance support across the NERC enforcement lifecycle, from Self-Report through Notice of Penalty through settlement at FERC.

ENFORCEMENT DEFENSE PRIVILEGE COUNSEL Notice of Penalty response and settlement Internal investigation and document production strategy. under privilege.

REGULATORY ADVISORY LEGAL-COMPLIANCE INTEGRATION FERC submission, Regional Entity counsel Operating frameworks built before enforcement engagement. arrives.

CONNECT WITH US