The Legal-Compliance Interface in Audit Defense

Foreword

Foreword

This professional reference is part of the Legal Series published by Energy Compliance, Inc. in partnership with Stich Angell, P.A., for registered entities and the people who run their compliance and legal programs.

NERC enforcement is, procedurally, a civil enforcement regime. Registered entities often treat it as a compliance process. That framing matters. The decisions made early in an enforcement matter bind the entity through every later stage, and many of them call for legal judgment that compliance teams are not trained to make alone. Recognizing this late is costly. The cost is rarely visible in the moment, and most of it can be avoided with the right operating framework in place.

Energy Compliance, Inc. partners with Stich Angell, P.A. to give registered entities integrated legal-compliance support across the full enforcement lifecycle. Rob Smith brings more than thirty years of operator and regulator-side compliance experience. Cara Passaro and the Stich Angell team bring civil litigation depth, appellate practice, and a growing focus on energy compliance representation. Together they offer an alternative to the usual model, where compliance consulting and legal counsel run as separate engagements and meet only after an enforcement matter has arrived.

We wrote these references for the compliance manager who has to brief the general counsel honestly. For the in-house attorney who needs to understand how NERC enforcement actually proceeds. For the senior leader who has been told the enforcement matter is under control and suspects it is not. And for the outside counsel asked to advise on a NERC matter for the first time, who needs a practitioner's view of the procedural reality.

These references do not substitute for engaged counsel, and they do not replace operational compliance judgment. They describe how the system works, in the voice we use in front of regulators and in the courtroom, so that registered entities can make the decisions in front of them with the information a practitioner would want them to have.

If the integrated approach we describe is what your entity needs, the back of this reference tells you how to reach us. If not, the reference still belongs to you. Take what is useful and apply it well. The structural decisions made before an enforcement matter arrives are almost always worth more than the ones made after.

Cara C. Passaro and Rob Smith

Shareholder and Firm President, Stich Angell, P.A.

Founder and Principal, Energy Compliance, Inc.

Executive Summary

Executive Summary

A NERC Compliance Audit is an operationally complex event. It tests the entity's compliance program and its legal preparation at the same time. Most entities design the two functions to run in parallel with little coordination, on the assumption that compliance handles the audit and counsel comes in only if things escalate. That assumption produces predictable failures at the interface between the two: where handoffs are required, where judgment calls cross from the operational side to the legal side, and where the entity's response has to reflect both.

This reference covers why the interface matters most during an audit, how to define the two functions in operational terms, where the handoffs happen and where they fail, and how privilege protection works under live audit conditions. It then turns to joint counsel-compliance preparation for subject matter expert (SME) interviews, the document production rhythm that protects the entity's position, the escalation triggers that move counsel from supporting to leading, and the post-audit work that leaves a stronger framework for the next cycle. Where the NERC Rules of Procedure or the federal rules set a step or a time window, we cite it. Everything else is our practitioner judgment, and we label it that way.

• In our view, many audit problems trace to gaps at the legal-compliance interface rather than to a gap in either function alone.
• The interface is engineered before the audit. The audit itself is the wrong time to design coordination.
• Handoffs that work in calm conditions fail under audit pressure. They need rehearsal.
• Privilege protection under live audit conditions takes a discipline that is uncommon in compliance practice and standard in legal practice.
• SME preparation is joint. Counsel handles posture and the boundary of testimony. Compliance handles substance.
• Document production during an audit carries higher stakes than routine production. Privilege review and the privilege log still apply.
• Name the escalation triggers in advance. In our view, deciding in real time is where escalation goes wrong.

Chapter 1

Why the Interface Matters Most During Audit

A Compliance Audit stresses every interface in the entity's compliance program. That includes the interfaces between compliance and operations, IT and engineering. Each one gets exercised under audit conditions, and any weakness shows to the auditor in real time. The one that matters most for the entity's audit posture, and the one least often engineered with discipline, is the interface between compliance and counsel.

1.1 The Interface Moments

The legal-compliance interface comes into play at several points during an audit:

• An auditor's question touches a topic that may be legally sensitive.
• A document the auditor requests may contain privileged content.
• An SME's answer may create exposure that should be worked through before the matter closes.
• The audit team's evaluation points toward potential noncompliance that deserves legal review before the entity responds.
• The exit briefing previews findings the entity will have to address strategically.

Each of these is an interface moment. How the interface performs in each one shapes the outcome of the audit.

1.2 Engineered and Unengineered Interfaces

Where the interface is engineered, these moments get handled cleanly. Compliance recognizes the trigger. Counsel is consulted in real time, usually through a channel set up before the audit. The decision is made jointly, the response to the auditor is coordinated, and the audit moves on without the friction that signals weakness.

Where the interface is not engineered, the moments get handled ad hoc. Compliance either proceeds without consulting anyone or stops to work out how to consult, with the auditor watching. Either way the audit posture suffers, and usually it shows.

1.3 The Window to Build It

The fix is structural: engineer the interface before the audit. The Rules of Procedure give you the time to do it. Under Section 4.1.1 of the Compliance Monitoring and Enforcement Program (CMEP), Appendix 4C to the NERC Rules of Procedure, the Compliance Enforcement Authority tells the entity at least 270 days before a planned Compliance Audit that it plans to audit. At least 90 days before a scheduled audit begins, it sends the audit notice: the Reliability Standards to be evaluated, the audit team members and their recent employment history, and the request for documents, data, and information. The interface should be designed, staffed, and rehearsed inside that window.

The work is uncomfortable for compliance teams that have run audits on their own for years. That discomfort is worth acknowledging. In our view, an engineered interface produces meaningfully better audit outcomes than an unengineered one, and the gap is widest in the audits where the most is at stake.

From the Practice

A Compliance Audit stresses every interface in the compliance program. The legal-compliance interface matters most and is least often engineered.

Interface moments are predictable: legally sensitive topics, privilege-relevant documents, SME exposure, potential noncompliance, and the exit briefing.

Appendix 4C gives at least 270 days' notice of a planned audit and at least 90 days' notice of a scheduled one. Build the interface in that window.

Chapter 2

Defining the Two Functions Operationally

Compliance and counsel have distinct roles during an audit. Define them in operational terms, not philosophical ones, and make sure the definition holds up under audit pressure.

2.1 Two Roles That Complement Each Other

The roles complement each other; they do not overlap. Compliance owns the operational management of the audit. Counsel owns the legal layer that runs alongside it. Compliance works with the audit team day to day. Counsel is consulted on legal questions, drafts or reviews submissions, manages privilege questions, and stands ready to escalate if the audit starts turning into a potential enforcement matter. Write the distinction down. Do not leave it to interpretation in the moment.

2.2 What Compliance Owns

The compliance role covers scheduling, document logistics, witness coordination, operational response drafting, daily debriefs with the audit team, internal communication about the audit's progress, and management of the audit calendar. These are operational functions, and they need a compliance presence every day of the audit. Compliance is the audit team's primary point of contact for everything that does not call for legal judgment.

2.3 What Counsel Owns

The counsel role is narrower and more selective. Counsel is engaged on defined categories of question. Counsel reviews any production that may contain privileged content. Counsel drafts or reviews responses to information requests with legal implications, and manages anything that escalates beyond routine audit interaction, including the entity's comments on the draft Compliance Audit report and any matter that may move into enforcement. Counsel does not need to sit in every interaction, but counsel must be reachable throughout the audit on an agreed response time.

One procedural point belongs to counsel from the start. Section 4.0 of Appendix 4C requires that any report or other submission of information required by the CMEP be signed by an officer, employee, attorney, or other authorized representative of the entity. Decide before the audit who signs what.

2.4 The Integration Point

The interface between the two roles is where they integrate. Compliance recognizes when a trigger has occurred and consults counsel before responding. Counsel answers fast enough that the audit does not stall. Rehearse the integration in advance, with sample trigger situations and the expected response from each side. Without rehearsal it fails the first time it is tested, and an audit is the wrong place to learn.

From the Practice

Compliance owns operational management. Counsel owns the legal layer that runs alongside it.

Compliance is the audit team's primary point of contact for everything that does not require legal judgment. Counsel is selective and reachable.

Rehearse the interface in advance with examples. Without rehearsal, it fails the first time it is tested under audit pressure.

Chapter 3

Where the Handoffs Happen (and Where They Fail)

In our view, handoffs between compliance and counsel are the failure points behind most audit-related legal problems. Naming them in advance lets the entity prepare for them.

3.1 The Handoff Moments

During an active audit, handoffs happen at predictable points:

• An information request arrives that requires document production.
• A witness interview is scheduled that may surface legally sensitive testimony.
• The auditor asks a question that goes past operational scope into legal interpretation.
• The audit team flags potential noncompliance, or the draft Compliance Audit report arrives for comment.
• The audit team asks about the entity's intentions regarding settlement or admission.

The draft report handoff has a defined clock. Under Section 4.1.5 of Appendix 4C, the draft Compliance Audit report goes to the entity for comment, and the entity has 30 days to comment and to identify Confidential Information it proposes for redaction. The audit team then considers corrections and finalizes the report. Counsel should be in that 30-day review from the first day, not the last.

Each of these handoff moments has a familiar failure pattern when the interface is not engineered. There are three.

3.2 The Unrecognized Handoff

This is the most common failure. Compliance does not see that the auditor's question or request has a legal layer, and responds without consulting counsel. The response goes into the record. The legal implications surface later, often in a way that narrows the entity's options. This is not a failure of the compliance staff. It is a failure of an interface design that never equipped them to recognize the trigger.

3.3 The Late Handoff

Compliance recognizes the trigger but calls counsel after the operational response is already moving. The auditor has a draft answer. The document has been produced. The witness has been interviewed. Counsel arrives to inherit a record that is already built and cannot be unbuilt. The late handoff happens when compliance runs at its default speed and skips the short pause a recognized trigger should produce.

3.4 The Over-Handoff

Compliance knows there is legal sensitivity but is unsure where the line sits, so it consults counsel on every interaction. Counsel becomes a bottleneck, the audit slows, and the relationship with the audit team strains. This one is also a design failure: compliance was never given confidence about which triggers actually require consultation.

All three failures yield to the same fix: an interface design that names the triggers, defines the response to each, and rehearses the discipline before the audit arrives.

From the Practice

Handoff moments are predictable: document production, witness interviews, legally complex questions, potential noncompliance and the draft report, and settlement or admission questions.

Three failure patterns: unrecognized, late, and over-handoff. Interface design that names the triggers and defines the response addresses all three.

The entity has 30 days to comment on the draft Compliance Audit report under Appendix 4C. Put counsel in that review on day one.

Chapter 4

Privilege Protection in Real-Time Audit Conditions

Protecting privilege during an active audit is harder than in calmer matters. The protection has to work in real time and hold up under audit pressure.

4.1 Why Audit Conditions Are Different

The audit team is present. Document production decisions happen on compressed timelines. Witness interviews get scheduled with little preparation time. Internal communication about the audit is frequent and involves many people. Each condition creates privilege risk that has to be managed in real time, under a discipline set before the audit began.

4.2 Confidential Is Not Privileged

Start with a distinction that compliance teams often blur. Section 1500 of the NERC Rules of Procedure protects Confidential Information that an entity submits to NERC or a Regional Entity, and the entity, as the submitting party, is required to mark that information as confidential and identify the category it falls in (Section 1502.1). Confidentiality under Section 1500 controls how the receiving entity handles and discloses what it receives. It is not the attorney-client privilege and it is not work-product protection. Federal Rule of Evidence 502(g) describes those as the protection applicable law gives to confidential attorney-client communications and to material prepared in anticipation of litigation or for trial. Marking a document Confidential Information does not protect its privilege. Producing a privileged document can waive the privilege. Mark what you produce, and decide on privilege before you produce it.

4.3 The Privileged Channel

The discipline starts with a privileged communication channel for any matter-related conversation that may come up during the audit. Set it up before the audit and name the participants. Do not use the email distribution lists that carry normal compliance traffic for audit communication on legally sensitive topics. Phone calls on those topics include counsel; they are not relayed to counsel afterward. Put the discipline in writing, with examples, and walk the team through it before the audit starts.

4.4 Production Is the Highest-Volume Risk

Document production during an audit carries the most privilege risk by volume. Auditors request documents on short timelines, compliance produces to meet them, and the privilege review is the step most likely to be skipped or squeezed. The interface design answers this by routing every production through a privilege review step, even when the timeline is tight. Counsel reviews quickly when needed but is never bypassed. Keep the privilege log in real time, alongside the production, not rebuilt after the audit closes.

4.5 Witness Interviews

The privilege risk in witness interviews is different but just as real. An SME interview may surface communications that took place under privileged conditions, and the witness will not always recognize when a question is reaching for privileged content. Counsel's preparation addresses this by walking through the likely categories of question and marking where the witness should defer, or where counsel should be consulted before an answer is given. Counsel may also decide to attend interviews likely to raise privilege issues. If so, raise it with the audit team lead before the interview schedule is set. In our view, the alternative, unprotected testimony, is much worse.

From the Practice

Privilege protection during an audit runs on compressed timelines and heavy communication volume. Set the discipline before the audit.

Confidential Information under Section 1500 is not privilege. Mark what you produce, and make the privilege call before you produce it.

Every production routes through privilege review, even when the timeline is tight. Counsel reviews quickly. The step is never bypassed.

Chapter 5

SME Preparation: Joint Counsel-Compliance Discipline

In our view, SME interviews surface more audit problems than any other phase of a NERC audit. Preparation that brings counsel and compliance together is how the entity gets through them.

The interview exposes gaps that documentation hides, contradictions that operational practice creates, and uncertainty the SME was never prepared to handle. Design the joint preparation before the audit and carry it out in the days before each interview.

5.1 Compliance Owns the Substance

Compliance runs the substantive preparation. The SME's domain knowledge is reviewed and refreshed. The procedures and controls relevant to the interview topic are walked through. Operational reality is reconciled with the documentation. Common audit questions in the topic area are anticipated and discussed. The SME learns to describe the program in their own words, which is the test the audit will apply.

5.2 Counsel Owns Posture and Boundary

Counsel runs the posture and boundary preparation. The SME is briefed on what to do if a question reaches into legally sensitive content, and is prepared to defer to counsel when appropriate in language that does not sound evasive. The SME learns the difference between describing what they know operationally and speculating about things outside their direct knowledge. And the SME understands that the interview produces testimony, not casual conversation, and adjusts accordingly. Joint preparation is what makes that possible.

5.3 What the SME Does Not Say

Joint preparation also covers what the SME leaves out. Volunteering information beyond the question, even with good intentions, can open new audit threads the entity then has to address. The SME is briefed to answer the question asked, completely and accurately, and then stop. Counsel rehearses this with each SME, often playing the auditor in a mock interview. The investment is small next to the cost of one avoidable finding from an unprepared SME. It also compounds across the audit, because every interview is conducted under the same discipline.

From the Practice

Compliance owns substantive preparation. Counsel owns posture and boundary preparation. The entity needs both. The SME answers the question asked, completely and accurately, and stops. Counsel rehearses this with each SME before the interview.

Chapter 6

Document Production During Audit Engagement

Document production during an audit carries different stakes than routine compliance production. The entity has to protect both privilege and its strategic position under time pressure.

6.1 Different Stakes

The audit team reads the documents in real time and uses them to evaluate compliance with the Reliability Standards in scope. The same documents may also be read for evidence relevant to an enforcement matter that could come out of the audit. Under Section 4.0 of Appendix 4C, potential noncompliance identified through compliance monitoring goes to a Preliminary Screen, and if the screen is affirmative, the matter proceeds under Section 5.0, Enforcement Actions. Production decisions made under time pressure can carry legal consequences well beyond the audit, and the production discipline has to reflect that.

6.2 The Basic Discipline

The basic discipline is the one counsel applies in any document-heavy matter. Review each request before production for scope, privilege, and any other protection that applies. Record privilege determinations in the real-time log described in section 4.4 of this paper. Schedule productions so the review happens without missing the auditor's Required Date. Keep the cooperative posture of producing what is requested, and at the same time keep the discipline of producing only what is responsive, after privilege review.

For the log itself, the litigation model is a useful benchmark. Federal Rule of Civil Procedure 26(b)(5)(A) requires a party withholding information as privileged to make the claim expressly and to describe what is withheld in a way that, without revealing the privileged content, lets others assess the claim. A Compliance Audit is not civil discovery, so treat this as a model for the log, not a rule that governs the audit.

If a request looks unreasonable, there is a defined path. Section 4.0 of Appendix 4C allows a registered entity that believes a request for documents, data, or information is unreasonable to ask the NERC general counsel for a written determination. That is a decision for counsel, not something to raise on the fly in a daily debrief.

6.3 Speed

What the audit adds is speed. In our view, audit teams expect productions faster than enforcement-matter productions usually require. Compliance is responsible for assembling the documents on that schedule. Counsel is responsible for the privilege review on the same schedule. The two functions work in parallel, not in sequence, with counsel's review set up in advance by an interface design that anticipates production volume and timing.

6.4 The Record Outlives the Audit

The other audit-specific concern is later use. Documents produced during an audit may surface again in a later enforcement matter, carrying the framing they had in the audit production. Counsel pays attention to how documents are produced, what cover language goes with them, and how the privilege log is structured, knowing the entity may be defending positions about those documents in enforcement months or years later. Audit production discipline is not only about the audit. It is about the record the audit creates.

From the Practice

Documents produced during an audit may be referenced in enforcement matters that have not arisen yet.

Compliance assembles documents on the auditor's schedule. Counsel reviews privilege on the same schedule. The two functions work in parallel.

Keep the privilege log in real time, alongside the production. In our view, a privilege claim raised long after production is much harder to sustain.

Chapter 7

Escalation Triggers: When Counsel Takes the Lead

Most audits do not need counsel to lead. Some do. Define the trigger in advance. In our view, escalation decided in real time is where most of these matters go wrong.

7.1 Why Define Triggers in Advance

When counsel does need to lead, the transition has to happen quickly. Define the triggers ahead of time and rehearse them, so nobody has to make that call cold.

7.2 The Observable Triggers

The triggers are observable:

• The audit team has identified potential noncompliance that, in our view, is unlikely to close as a Compliance Exception or under Find, Fix, Track and Report, and may proceed as an Alleged Violation toward a Notice of Penalty.
• The audit team has requested information that goes beyond routine audit scope and into investigative territory.
• The audit team has begun discussing potential enforcement consequences in the daily debriefs.
• The audit team has indicated that a matter will be referred to the Regional Entity's enforcement staff rather than handled within the audit.
• The entity receives an instruction to retain and preserve records, which Appendix 4C requires in a Notice of Preliminary Screen (Section 5.2) and when a Compliance Investigation is initiated (Section 4.4.1).

A Compliance Investigation can be initiated at any time in response to a system disturbance, a Complaint, or any potential noncompliance identified by any other means, and Compliance Investigations are confidential unless FERC directs otherwise (Appendix 4C, Section 4.4). Any one of these signals warrants counsel taking the lead, with compliance executing operationally under counsel's direction instead of running the matter on its own.

7.3 What Changes When Counsel Leads

When the transition happens, the change is structural. Counsel becomes the primary contact with the audit team on substantive matters. Compliance keeps handling logistics and operational coordination. Communications about the audit route through counsel. Counsel drafts or reviews any submission to the audit team. Privilege protocols tighten, and the internal communication discipline gets a fresh review. It is the right posture for a matter that has moved into enforcement territory, and in our view a transition handled professionally does not read as hostile to a competent audit team.

7.4 The Cost of Moving Late

Entities that do not make the transition cleanly, because they miss the trigger or resist the role change, end up with audits that become enforcement matters from a weaker position than they would have held if counsel had taken the lead earlier. In our view, the cost of a late transition is structural and hard to recover. The cost of a timely one is small, and it buys a better position for the rest of the matter. A trigger framework is cheap insurance against that cost.

From the Practice

Most audits do not need counsel to lead. Some do. Define the trigger framework in advance.

Triggers are observable: potential noncompliance headed past Compliance Exception or FFT, investigative information requests, enforcement talk in debriefs, referral signals, and any preservation instruction.

A late transition hands enforcement a weaker posture. The trigger framework is cheap insurance against that cost.

Chapter 8

Post-Audit Integration and the Operating Loop

An audit produces learning that should update the legal-compliance operating framework. Capturing it depends on treating the post-audit period as a deliberate phase.

The audit closes. The findings are issued or pending. A team that has run at high intensity for weeks returns to baseline. The temptation is to celebrate, recover, and file the audit away as a finished event. The defensible posture is the opposite: treat the close as the start of the improvement cycle. Skip that and you forfeit the improvement the audit just paid for.

8.1 Two Products

The post-audit work has two products.

The first is a privileged after-action review, drafted by counsel and shared inside the privilege circle. It records honestly what worked and what did not: the handoffs that succeeded and the ones that failed, the privilege moments handled well and the ones where privilege was at risk, the SME interviews that went cleanly and the ones that produced findings better preparation would have prevented. The candor in this document is the input the entity needs to actually change its framework.

The second is an operational lessons document, written at a higher level for broader internal distribution. It covers program changes, training updates, changes to cadence, and documentation discipline. It leaves out the legally sensitive analysis and sets out the operational changes the entity will make in response to what the audit taught. It is the basis for the program improvement cycle that compliance owns and counsel supports.

8.2 Closing the Loop

Feeding these two products into the legal-compliance operating framework described in EC-WP-800, NERC Enforcement: A Legal Field Guide, is the loop that produces real improvement from one audit cycle to the next. The entity revises the framework, updates the interface design, refines the escalation triggers, and schedules the handoff rehearsals. None of this is glamorous, but it separates programs that improve year over year from programs that get roughly the same audit results no matter how many cycles they go through.

From the Practice

Two products: a privileged after-action review, with candor inside the privilege circle, and an operational lessons document for broader distribution. Revise the framework, the interface design and the triggers after every audit, and schedule the next rehearsals.

Glossary

Glossary

Alleged Violation. A potential noncompliance for which the Compliance Enforcement Authority has determined, based on an assessment of the facts and circumstances, that evidence exists to indicate the registered entity violated a Reliability Standard, and that will be resolved outside the Compliance Exception or FFT processes (NERC Rules of Procedure, Appendix 2).

Attorney-client privilege. The protection that applicable law provides for confidential attorney-client communications (Federal Rule of Evidence 502(g)(1)).

Compliance Audit. A systematic, objective review and examination of records and activities to determine whether a registered entity meets the Requirements of applicable Reliability Standards (Appendix 2).

Compliance Enforcement Authority (CEA). NERC or the Regional Entity in its role of monitoring and enforcing compliance with the NERC Reliability Standards (Appendix 2).

Compliance Investigation. A comprehensive investigation, which may include an on-site visit with interviews of the appropriate personnel, to determine whether a violation of a Reliability Standard has occurred (Appendix 2).

Confidential Information. Information protected under Section 1500 of the NERC Rules of Procedure. The defined categories include Critical Energy Infrastructure Information, personnel information, and audit work papers (Appendix 2). Confidentiality under Section 1500 is not the same as privilege.

Exit briefing. The briefing the Compliance Audit team holds with the registered entity as the audit concludes. Appendix 4C, Section 4.1.1, lists it as a step in the audit process, followed by a review of the audit report with the entity before the report is finalized.

Notice of Penalty. A notice prepared by NERC and filed with FERC, after NERC approves a Confirmed Violation or a settlement agreement, stating the penalty or sanction imposed or agreed to (Appendix 2).

Potential noncompliance. The identification by the Compliance Enforcement Authority of a possible failure by a registered entity to comply with an applicable Reliability Standard (Appendix 2).

Preliminary Screen. The Compliance Enforcement Authority's initial evaluation of evidence that potential noncompliance has occurred or is occurring, including whether the entity is registered and the Requirement applies to it (Appendix 2).

Privilege log. A record of documents withheld or redacted on privilege grounds, describing each item well enough to assess the claim without revealing the privileged content. Federal Rule of Civil Procedure 26(b)(5)(A) sets this standard in federal civil litigation.

Reliability Standard Audit Worksheet (RSAW). A NERC worksheet, specific to a Reliability Standard, used in Compliance Audits. Appendix 4C, Section 4.1, provides that RSAWs will be posted on NERC's website.

Required Date. The date, given in a notice from the Compliance Enforcement Authority, by which the registered entity must take some action (Appendix 2).

Subject matter expert (SME). The operator, engineer, or analyst who answers the audit team's questions about how a requirement is met in practice.

Work-product protection. The protection that applicable law provides for tangible material, or its intangible equivalent, prepared in anticipation of litigation or for trial (Federal Rule of Evidence 502(g)(2)).

How Energy Compliance Can Help

How Energy Compliance Can Help

This paper describes an interface that has to be built before the audit notice arrives. That is the work Energy Compliance, Inc. and Stich Angell, P.A. do together: compliance leads the operational side, a named Stich Angell partner leads the legal side, and both are in the room before the audit team is.

Audit Defense, RSAW Production, and Data Request Strategy

On the compliance side, we prepare entities for Compliance Audits: building the evidence and the RSAW narratives for the standards in scope, designing the data request response process so production runs on the audit team's schedule with privilege review built in, and preparing SMEs on substance ahead of joint preparation with counsel.

Legal Series Services

The Legal Series supports registered entities across the full enforcement lifecycle. Every engagement is led by a named senior practitioner on the compliance side and by a named partner at Stich Angell on the legal side. Integrated legal-compliance services include, but are not limited to:

• Notice of Penalty response strategy and execution
• Internal investigation conducted under privilege
• Document production and privilege log management
• Witness preparation for Regional Entity interviews
• Settlement negotiation with Regional Entity counsel
• Self-Report drafting and legal review
• FERC submission preparation and review
• Legal-compliance operating framework design
• Counsel-led after-action review and lessons integration

The combined practice is organized around four areas: Enforcement Defense (Notice of Penalty response and settlement strategy), Privilege Counsel (internal investigation and document production under privilege), Regulatory Advisory (FERC submissions and Regional Entity counsel engagement), and Legal-Compliance Integration (operating frameworks built before enforcement arrives). Each engagement is scoped to the entity's role, function, regulatory posture, and the procedural stage of the matter.

WattOps Compliance

WattOps Compliance is EC's NERC compliance evidence platform (wattopscompliance.com). In an audit, the production counsel reviews is only as good as the evidence record behind it, and that record is what WattOps is for. We will run one standard at one facility through WattOps at no cost (CIP standards excluded).

RenewOps

RenewOps is EC's renewable operations monitoring and analytics platform, with a Data Center module. For renewable and storage operators, an SME's answer in an audit interview often comes down to the operations data, and RenewOps is where that data is monitored and analyzed.

If your next audit notice is coming and the interface between your compliance team and your counsel has never been rehearsed, call us before the 90-day notice arrives, not after.

Website: energycomplianceinc.com · Email: [email protected]

Phone: 763.438.4427

About the Author

About the Author

Rob Smith

Rob Smith is the Founder and Principal of Energy Compliance, Inc., with more than thirty years in the industry on every side of the system. He began in control-room operations as a Reliability Coordinator, Transmission Operator, and Power System Operator across RTO/ISO and utility control centers. On the regulator side, he was a senior compliance auditor and subject matter expert for NERC Reliability Standards. He audited grid facilities, evaluated mitigation adequacy, participated in risk-based oversight of utility mitigation activities, and supported the development of violation notifications and settlements in FERC-directed enforcement actions. He conducted a regulatory audit in the Sultanate of Oman against the Sultanate's Sector Law and Grid Code.

He founded Energy Compliance, Inc. to deliver senior regulator-side compliance authority without the layered staffing and billable-hour overhead of larger firms.

Education: MBA, Energy Management, University of Mary; MSL, Compliance Law, Fordham Law University; BAS, Energy Management, Bismarck State College; BAS, Mechanical Engineering, Metallurgy minor, University of Florida; BAS, Criminology, St. Petersburg College (State Law Enforcement Certification); AAS, Power Plant Technology, Bismarck State College; AAS, Electrical Transmission System Technology, Bismarck State College.

Certifications: NERC Lead Auditor training; previously NERC-certified at the Reliability Coordinator level; 1st Class A Boiler Engineer License, Minnesota.

Cara C. Passaro

Cara C. Passaro is Shareholder and Firm President at Stich Angell, P.A. She has represented clients throughout the upper Midwest since 2001, is licensed in the Minnesota and North Dakota state and federal courts, and is recognized as a Super Lawyer. Her practice covers construction, premises and products liability, transportation, and energy compliance representation, and her representative cases include decisions of the Minnesota Supreme Court and the Minnesota Court of Appeals.

Cara serves as the named legal author of the Energy Compliance, Inc. Legal Series and is the partner engagement lead for the Stich Angell side of the integrated practice.

About Energy Compliance, Inc.

About Energy Compliance, Inc.

Energy Compliance, Inc. is an independent consulting and advisory firm focused exclusively on electric reliability, cybersecurity reliability, and regulatory compliance for organizations connected to the North American Bulk Electric System.

Our work supports registered entities, including Generator Owners and Operators, Transmission Owners and Operators, Reliability Coordinators, Balancing Authorities, and Distribution Providers, across NERC Reliability Standards, FERC orders, RTO/ISO market participation rules, Regional Entity oversight, and state regulatory frameworks.

Energy Compliance partners with Stich Angell, P.A. for legal matters arising in the NERC enforcement lifecycle, including Notice of Penalty response, settlement negotiation, internal investigation under privilege, and the integrated legal-compliance operating frameworks registered entities need before enforcement arrives. The integrated practice replaces the sequential model, in which compliance and legal engage separately and meet only when a matter has already escalated.

Engagements are overseen by a senior practitioner on the compliance side and by a named partner on the legal side. We do not staff for billable hours. We staff for outcomes. Our deliverables are written to be operationally executable and audit-defensible, not to manufacture activity.

Energy Compliance is not affiliated with, sponsored by, or endorsed by the North American Electric Reliability Corporation, the Federal Energy Regulatory Commission, or any Regional Entity.

About Stich Angell, P.A.

Stich Angell, P.A. is a Minnesota civil litigation firm that has practiced since 1971. Its practice areas include products liability, construction, transportation, professional negligence, insurance law, appellate practice, and energy regulatory legal services, including NERC and FERC enforcement defense. Although based in Minnesota, the firm represents clients throughout the country. Stich Angell partners with Energy Compliance, Inc. to give registered entities integrated legal and compliance support across the NERC enforcement lifecycle.

Stich Angell, P.A. is located in Bloomington, Minnesota, and may be reached at (612) 333-6251 or at stichlaw.com.

Learn more at energycomplianceinc.com. Stich Angell at stichlaw.com.

Sources and Authorities

Sources and Authorities

• North American Electric Reliability Corporation, Rules of Procedure, Appendix 4C, Compliance Monitoring and Enforcement Program (effective May 19, 2022), Sections 4.0, 4.1.1, 4.1.5, 4.4, 4.4.1, 5.0, 5.1, 5.2, 5.3 and 5.9; retrieved and confirmed current October 25, 2026. https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/appendix-4c.pdf
• North American Electric Reliability Corporation, Rules of Procedure, Appendix 2, Definitions Used in the Rules of Procedure (effective June 27, 2024); retrieved October 25, 2026. https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/appendix-2.pdf
• North American Electric Reliability Corporation, Rules of Procedure (effective November 28, 2023), Section 1500, Confidential Information, Sections 1502 and 1505; retrieved October 25, 2026. https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/nerc-rop.pdf
• Federal Rules of Evidence, Rule 502, Attorney-Client Privilege and Work Product; Limitations on Waiver, Legal Information Institute, Cornell Law School; accessed October 25, 2026. https://www.law.cornell.edu/rules/fre/rule_502
• Federal Rules of Civil Procedure, Rule 26(b)(5), Claiming Privilege or Protecting Trial-Preparation Materials, Legal Information Institute, Cornell Law School; accessed October 25, 2026. https://www.law.cornell.edu/rules/frcp/rule_26
• Stich Angell, P.A., Cara C. Passaro attorney profile; accessed October 25, 2026. https://stichlaw.com/cara-c-passaro/
• Stich Angell, P.A., About Us and Expertise pages; accessed October 25, 2026. https://stichlaw.com/about-us/ and https://stichlaw.com/expertise/