Privilege in NERC Compliance Work

Foreword

Foreword

This professional reference is part of the Legal Series published by Energy Compliance, Inc. in partnership with Stich Angell, P.A., for registered entities and the people who run their compliance and legal programs. NERC enforcement is procedurally a civil enforcement regime that registered entities frequently treat as a compliance process. The framing matters. The decisions made early in any enforcement matter bind the entity through every subsequent stage, and many of those decisions involve legal judgment that compliance teams are not trained to make alone. The cost of recognizing this late is significant, rarely visible at the moment, and largely avoidable with the right operating framework in place. Energy Compliance, Inc. partners with Stich Angell, P.A. to provide registered entities with integrated legal-compliance support across the full enforcement lifecycle. Rob Smith brings more than thirty years of operator and regulator-side compliance experience. Cara Passaro and the Stich Angell team bring civil litigation depth, appellate practice, and increasing focus on energy compliance defense. The combination is the structural alternative to the model in which compliance consulting and legal counsel operate as separate engagements that converge only when an enforcement matter has already arrived. These references are written for the compliance manager who has to brief the general counsel honestly. For the in-house attorney who needs to understand how NERC enforcement actually proceeds. For the senior leader who has been told that the enforcement matter is under control and suspects it is not. For the outside counsel who has been asked to advise on a NERC matter for the first time and needs a practitioner's view of the procedural reality. The references do not substitute for engaged counsel and they do not replace operational compliance judgment. They describe how the system actually works, in the voice we use in front of regulators and in the courtroom, so that registered entities can make the decisions in front of them with the information practitioners would want them to have. If the integrated legal-compliance approach we describe is what your entity needs, the back of this reference contains contact information. If not, the reference still belongs to you. Take what is useful, apply it well, and remember that the structural decisions made before an enforcement matter arrives are almost always worth more than the decisions made after.

— Cara C. Passaro and Rob Smith Stich Angell, P.A. · Energy Compliance, Inc.

EC-WP-805 Privilege in NERC Compliance Work

Why Privilege Operates Differently in NERC Matters

Why Privilege Operates Differently in NERC Matters

NERC matters have specific features that make privilege analysis different from privilege analysis in other civil enforcement contexts. The differences should inform every program design choice.

Privilege in NERC compliance and enforcement matters operates within the same legal doctrines that apply across civil enforcement, with a set of context-specific features that make routine assumptions risky. The regulatory framework involves Regional Entities, NERC, and FERC, each with its own procedural posture. The matters involve technical operational subjects that are reduced to documentary form across many systems and personnel. The matters typically involve multiple consultants, contractors, and other third parties who participate in the entity's compliance work in various capacities. Each of these features creates privilege questions that registered entities without legal infrastructure routinely get wrong. The first contextual feature is the documentary intensity of NERC compliance work. Programs generate procedure documents, operating logs, evidence packages, training records, audit responses, mitigation plans, and many other artifacts. Each is a candidate for production in any enforcement matter. Determining which artifacts are or could be privileged requires analysis at the moment of creation, not at the moment of production. Programs that generate documents without any privilege framing produce documentary universes that are entirely discoverable, even when the underlying analysis would have qualified for protection if the analysis had been structured differently. The second contextual feature is the multi-party nature of compliance work. Compliance consultants, engineering consultants, IT vendors, training providers, and outside auditors all routinely participate in the entity's compliance program. Each of these participants either is or is not inside the privilege circle for any given communication. The default state for most non-attorney participants is outside the circle, which means communications including them may not be protected even when they include counsel. The structural design of these engagements either preserves or defeats privilege, and the design has to be intentional. The third contextual feature is the regulatory community context. The same Regional Entity staff who collaborate productively with the entity in normal compliance work may, in an enforcement matter, be

FROM THE PRACTICE Privilege in NERC matters operates within standard doctrines but in context-specific forms. The context features are documentary intensity, multi-party engagement, and regulatory community proximity. Programs that generate documents without any privilege framing produce documentary universes that are entirely discoverable, even when the underlying analysis would have qualified. Default state for non-attorney participants is outside the privilege circle. Structural design of engagements is what brings them inside, when appropriate.

Attorney-Client Privilege: The Doctrine and the Operations

Attorney-Client Privilege: The Doctrine and the Operations

Attorney-client privilege is a familiar doctrine. Its operational implementation in NERC compliance work is where most errors arise.

Attorney-client privilege protects confidential communications between counsel and the client made for the purpose of obtaining or providing legal advice. The doctrine is well established and broadly understood at the level of principle. The operational implementation in NERC compliance work is where the doctrine produces friction with the way registered entities actually conduct their programs, and where most privilege failures originate. The communication has to be between counsel and the client. The client in a corporate context is the entity acting through its officers, employees, and agents within the scope of their duties. Communications that include parties who are neither counsel nor within the client's scope generally fall outside the privilege. This becomes complex when communications routinely include compliance consultants, contractors, vendors, and other third parties whose participation is not automatically privileged. The communication has to be made for the purpose of obtaining or providing legal advice. Communications about operational matters, even when counsel is included for awareness, may not qualify if the predominant purpose was operational rather than legal. The framing of the communication matters. Counsel-led discussions framed as legal analysis are protected. Compliance-led discussions where counsel is copied for visibility are often not. Programs that route all communications through counsel for completeness are not actually creating privileged records; they are creating discoverable records that include counsel. The communication has to remain confidential. Privilege depends on the communication not being disclosed beyond the privileged circle. Disclosure to additional parties, even unintentionally, can waive the privilege over the specific communication and sometimes over related communications on the same subject. Confidentiality is a discipline, maintained at every step from creation through retention. Programs that treat counsel communications as broadcast vehicles waive privilege without recognizing they have done so, and the waiver becomes binding when the matter reaches discovery.

FROM THE PRACTICE Attorney-client privilege is well established as doctrine. Operational implementation in NERC work is where most errors arise. Communications must be between counsel and the client, for the purpose of legal advice, and remain confidential. All three requirements operate together. Failure on any one defeats the privilege. Routing communications through counsel for completeness does not create privileged records. It creates discoverable records that include counsel.

Work Product Protection: Where It Applies

Work Product Protection: Where It Applies

Work product protection covers materials prepared in connection with anticipated proceedings. The protection is distinct from attorney-client privilege and is asserted differently.

Work product protection covers documents and tangible things prepared in anticipation of litigation or in connection with an actual or reasonably anticipated proceeding. The protection is distinct from attorney-client privilege. It applies even when the document is not a communication between counsel and client. It applies to materials prepared by the client at counsel's direction, by counsel directly, or by consultants engaged for the proceeding. The protection is real and underused in NERC compliance practice. The triggering event for work product protection is the anticipation of a proceeding. In NERC contexts, this includes anticipated audits, anticipated enforcement matters, ongoing investigations, and any situation where the entity has reasonable basis to expect a regulator may pursue formal proceedings. Documents prepared in this context, with the proceeding in mind, can qualify for work product protection even when no specific matter has yet been filed. Programs that recognize this can structure investigation work, evidence development, and analytical memoranda to qualify for the protection from the moment of creation. The protection has limits. Materials prepared in the ordinary course of business, without the proceeding-anticipation framing, generally do not qualify. Materials prepared partly for proceedings and partly for other purposes face dual-purpose analysis that varies by jurisdiction. Materials prepared after the entity has produced the underlying facts in another context may have limited protection because the same content already exists in non-protected form. Programs that want to maximize work product protection structure document creation deliberately, not retroactively. Work product protection is asserted at the time of production, similar to attorney-client privilege. The protection has to appear on a privilege log, with the relevant elements identified, and has to survive any challenge by the regulator. Work product is not invulnerable. A regulator that demonstrates substantial need and inability to obtain the substantive equivalent without undue hardship can sometimes overcome the protection for fact work product, though opinion work product reflecting counsel's mental impressions is more strongly protected. The structural defense is to identify and assert the protection consistently, and to be prepared to defend the basis if challenged.

FROM THE PRACTICE Work product protection covers materials prepared in connection with anticipated proceedings. The protection is distinct from attorney-client privilege and is asserted differently. Anticipation of a proceeding includes anticipated audits, enforcement matters, and any situation where formal proceedings are reasonably expected. Programs can structure work to qualify from creation. The protection is asserted at the time of production. Identify the protection consistently, log it correctly, and be prepared to defend the basis if challenged.

The Consultant Problem and Its Solution

The Consultant Problem and Its Solution

Compliance consultants create most modern privilege failures. The structural fix is well known and rarely implemented.

Most contemporary privilege failures in NERC compliance matters trace to the involvement of compliance consultants. The pattern is consistent. The entity engages a consulting firm to support compliance work. The consultant participates in communications that include counsel. The consultant's participation, without an appropriate engagement structure, defeats the privilege over those communications. The entity discovers the failure at production time, when the regulator's discovery of consultant-included communications produces an unprotected universe of work that the entity had assumed was privileged. The legal framework for protecting consultant communications under privilege is well established. The consultant must be functioning as an agent of counsel for purposes of the privileged work. The engagement structure has to reflect this agency relationship explicitly, typically through an engagement letter or engagement letter addendum that establishes the consultant as working under counsel's direction for the matter, with the appropriate confidentiality and work-product framing. Without that structure, the consultant is a third party whose presence destroys privilege, even when the consultant's substantive contribution to the work is valuable. The engagement structure is straightforward to implement when planned in advance and difficult to retrofit. For routine compliance consulting work that does not involve enforcement matters, the consultant may be engaged directly by the entity without privilege framing, and the work product is generally not privileged. When an enforcement matter arises or is anticipated, the consultant's involvement should be re-papered through counsel, with a new engagement structure that brings the work under the privilege framework. The re-papering is administrative and is often the difference between protected and unprotected investigation work in the matter. Programs that work routinely with the same consulting firm benefit from establishing a master engagement framework that anticipates both routine and matter-specific work. Routine work continues under the standard engagement. Matter-specific work, when triggered, automatically falls under counsel's direction with the appropriate privilege framing. The framework reduces the friction of re-papering at the moment a matter arises and ensures that the consultant's work product is protected

FROM THE PRACTICE Most contemporary privilege failures involve compliance consultants. The structural fix is well known and rarely implemented. The consultant must be functioning as an agent of counsel for the privileged work, with engagement structure reflecting the agency relationship. A master engagement framework that anticipates both routine and matter-specific work reduces re-papering friction and protects matter work product from the start.

Distribution Discipline: The Most Common Waiver

Distribution Discipline: The Most Common Waiver

Privilege depends on confidentiality. The most common privilege failure in NERC programs is broad distribution that destroys the confidentiality the privilege depends on.

The single most common privilege failure pattern in NERC compliance programs is the broad distribution of counsel communications inside the entity. The communication originates as a privileged exchange between counsel and a defined client team. The communication is forwarded to additional internal personnel for awareness. The forwarded copies include the original substantive content. Each forward broadens the distribution beyond the original privileged circle. At some point, the distribution becomes broad enough that the communication has lost the confidentiality privilege requires. The mechanism is rarely intentional. Compliance teams routinely share information across functions. Updates from counsel are perceived as relevant operational information that the team should know. Forwarding the email feels efficient. The legal consequence of the forwarding is invisible at the moment of forwarding and surfaces only when the matter reaches discovery. By that point, the waiver has occurred and is not recoverable. The discipline that prevents this is straightforward and uncomfortable. Counsel communications are treated as a controlled distribution. The distribution list is defined at the time of creation, generally narrow, and not expanded without counsel agreement. Forwarding is discouraged. When information from counsel needs to be shared more broadly, the substantive content is summarized in operational language, in a separate communication that is not framed as privileged, and the original counsel communication is not forwarded. The discipline operates against entrenched habits and requires deliberate socialization across the team. The discipline also addresses internal copy practices. Counsel communications are not routinely cc'd to compliance distribution lists, even when the topic is relevant to those lists. The distribution is intentional and bounded. When meetings include discussion of counsel-provided analysis, the meeting attendance list is treated as a privilege variable. Recording of meetings that include privileged discussion is controlled. Notes from such meetings are framed and distributed with privilege in mind. None of these practices are exotic in legal contexts. All of them are uncommon in compliance contexts that have not had legal infrastructure embedded in the program.

FROM THE PRACTICE The single most common privilege failure is broad distribution that destroys the confidentiality privilege requires. The mechanism is rarely intentional. Counsel communications are a controlled distribution. The list is defined at creation, narrow, and not expanded without counsel agreement. When information needs to be shared more broadly, summarize the substance in operational language, in a separate non-privileged communication. Do not forward the original.

Privilege Logs and Production Mechanics

Privilege Logs and Production Mechanics

Privilege logs are the operational mechanism that protects privilege at production time. Logs maintained in real time work. Logs assembled retroactively often fail.

When document production is required in a NERC matter, the entity withholds privileged documents from the production and identifies them on a privilege log. The log describes each withheld document with sufficient detail for the regulator to evaluate the privilege claim. The log is the operational mechanism that protects privilege at production time, and the quality of the log determines whether the privilege claims survive scrutiny. Logs maintained in real time work better than logs assembled retroactively. A real-time log is built as documents are reviewed for production, with privilege determinations made and logged contemporaneously by counsel. The log entries reflect the actual reasoning at the moment of decision. The log is internally consistent. The log is defensible against challenge because the entries can be supported with the documents themselves and with the contemporaneous record of the determination. Retroactive logs are assembled after production is otherwise complete, often under time pressure to meet a regulator deadline. The privilege determinations are made quickly, sometimes by personnel who were not involved in the underlying work. The reasoning is reconstructed rather than recorded. The log entries may not align cleanly with the documents they describe. The defensibility under challenge is weaker, and regulators that perceive a retroactive log are more likely to challenge the privilege claims, often successfully. Beyond the log itself, production mechanics matter. The production should be staged to allow real-time privilege review. The privilege circle should be defined and maintained. The document collection should be conducted under counsel direction so that privileged documents are identified and segregated before any production is made. Categories of documents likely to require privilege analysis should be identified in advance. None of this is exotic. It is the operational discipline that distinguishes production processes that protect privilege from production processes that compromise it. Programs that have not built this discipline experience predictable losses at production time, often in matters where the underlying privilege analysis would have been entirely sound if it had been operationalized correctly.

FROM THE PRACTICE Privilege logs are the operational mechanism that protects privilege at production time. Real-time logs work. Retroactive logs often fail. Real-time logs are built contemporaneously by counsel as documents are reviewed. The reasoning is recorded, not reconstructed. The log is defensible under challenge. Production mechanics matter beyond the log: staged production, defined privilege circle, counsel-directed document collection, advance identification of likely-privileged categories.

Privilege Across Multi-Entity Matters

Privilege Across Multi-Entity Matters

NERC matters sometimes involve multiple registered entities or industry coordination. Privilege in those contexts requires additional structural protection.

Some NERC compliance and enforcement matters involve multiple registered entities. Joint owners of generation facilities. Members of regional reliability initiatives. Industry working groups responding to a common audit theme or enforcement trend. Coordinated responses to FERC orders that affect multiple entities. Each of these contexts creates privilege questions that single-entity matters do not, and the structural protections required are different from the standard single-entity privilege framework. The basic legal framework for privilege protection in multi-entity contexts is the joint defense privilege or common interest doctrine. Communications among parties who share a common legal interest, conducted for the purpose of advancing that common interest, can remain privileged even when shared across the parties. The doctrine has variations across jurisdictions and has procedural requirements that the parties must respect to maintain the protection. Engaging in apparent joint defense without the structural protections in place produces communications that are not actually protected, and the parties may discover this only when one of them is required to produce the communications in a separate matter. The structural protection is the joint defense agreement, executed by the participating entities through their respective counsel, that establishes the common interest, defines the scope of the joint defense, and addresses confidentiality, communication protocols, and the handling of joint work product. The agreement is drafted with attention to the specific matter, the participating parties, and the relevant jurisdictions. Without the agreement, communications among the parties that include counsel are at risk of being treated as third-party disclosure that defeats the privilege over the underlying analysis. The multi-entity context also creates considerations around the disclosure of one party's privileged information to other parties. Even within a joint defense framework, parties retain their individual privileges over their own underlying work, and the framework does not automatically extend each party's privilege to the others. Communications about specific party-internal matters should remain within that party's individual privilege circle. The joint defense framework covers the shared interest, not the underlying party-specific work. Programs that work in industry contexts on common matters benefit from explicit structural design at the outset of the matter, including counsel-led documentation

FROM THE PRACTICE Multi-entity NERC matters create privilege questions that single-entity matters do not. Joint defense or common interest frameworks are the structural protection. Joint defense agreements, executed by participating entities through counsel, establish the common interest and address confidentiality, communications, and joint work product. Within a joint defense framework, parties retain individual privileges over their own underlying work. Joint defense covers shared interest, not party-specific matters.

Building a Privilege-First Operating Posture

Building a Privilege-First Operating Posture

Programs with mature privilege protection do not assemble it when matters arise. They build it in advance and operate under it routinely.

Programs that protect privilege effectively in NERC matters share a common characteristic. The privilege framework is built into the operating posture before any matter requires it. The framework is documented. The discipline is socialized to the team. The structural elements, including the privilege circle definition, the consultant engagement framework, the distribution discipline, and the privilege log mechanics, are operational at all times, not assembled when a matter arises. The framework operates whether or not any specific matter is active, and shifts seamlessly into matter-specific posture when triggered. Building this framework requires deliberate effort and senior commitment. The compliance team must understand what privilege is, when it applies, and how the team's daily practices either preserve or defeat it. Counsel must be reachable for consultation on privilege questions that arise in real time. The consultant engagements must be structured with privilege in mind from the start. The document creation and distribution practices must reflect the privilege framework consistently. The training that supports all of this must be delivered to relevant personnel and refreshed periodically. None of this is exotic. All of it requires the discipline to operationalize what counsel knows in principle. The framework also addresses the practical questions that arise routinely. When does a compliance question warrant counsel consultation. What constitutes the privilege circle for a specific topic. How is a consultant brought inside the circle for a matter. What is the protocol for documenting decisions that may later be relevant to enforcement. How are privilege logs maintained. Each of these questions has an answer that the framework provides, and the answers are consistent across the program rather than improvised at the moment. The economics of the privilege-first posture are favorable across multiple dimensions. The cost of building the framework is the cost of counsel time and program design effort. The cost of operating without the framework is the cost of the privilege failures that occur in any matter the entity faces, plus the broader cost of an enforcement posture that is structurally weaker than the matter requires. Entities that have moved to the privilege-first posture report lower enforcement exposure across multiple cycles, fewer privilege disputes during production, and meaningfully cleaner audit experiences. The

FROM THE PRACTICE Privilege-first programs build the framework before any matter requires it. The framework operates routinely and shifts into matter-specific posture when triggered. The framework requires deliberate effort and senior commitment. Compliance, counsel, consultants, document practices, and training all align under it. The investment compounds. The alternative compounds against the entity in the same direction. The structural choice is binary even if implementation is gradual.

About the Author

About the Author

Cara C. Passaro is Shareholder and Firm President at Stich Angell, P.A., where she has practiced civil trial and appellate law for more than two decades. She is licensed to practice in the state and federal courts of Minnesota and North Dakota and has been recognized as a Super Lawyer for her work in civil litigation and construction litigation defense. Cara's practice has historically focused on products liability, premises liability, transportation liability, and complex commercial litigation, with an emphasis on the defense of corporate clients in high-stakes matters across the Midwest. She has tried jury cases to verdict in Minnesota state court, argued matters at the Minnesota Court of Appeals, and managed appellate work through the Minnesota Supreme Court. In recent years, Cara and the Stich Angell team have extended the firm's civil litigation practice into energy compliance defense, working with registered entities and their compliance partners on NERC enforcement matters, Notice of Penalty response, settlement negotiations with Regional Entities, and the integrated legal-compliance frameworks that determine whether enforcement matters resolve as manageable procedural events or as multi-year exposures. Cara serves as the named legal author of the Energy Compliance, Inc. Legal Series and is the partner engagement lead for the Stich Angell side of the integrated practice.

About Stich Angell, P.A. Stich Angell, P.A. is a Minneapolis-based civil litigation firm founded in 1971. The firm represents businesses, individuals, and organizations across a broad range of civil practice areas, with particular depth in complex litigation, products liability, transportation liability, professional liability, insurance defense, construction litigation, and appellate practice. The firm's trial and appellate attorneys are recognized among the most experienced civil trial lawyers in the state, with extensive experience representing clients through trial verdict and appellate review. Although the firm is based in Minnesota, the attorneys represent clients in matters across the United States. Stich Angell has expanded the firm's civil litigation practice into energy compliance defense, partnering with Energy Compliance, Inc. to provide registered entities with integrated legal and compliance support across the NERC enforcement lifecycle. The combined practice brings civil litigation discipline, appellate strength, and senior regulatory experience to a category of matters that has historically lacked that combination. Stich Angell, P.A. is located at 3601 Minnesota Drive, Suite 450, Minneapolis, Minnesota 55435, and may be reached at (612) 333-6251 or at stichlaw.com.

About Energy Compliance, Inc.

About Energy Compliance, Inc.

Energy Compliance, Inc. is an independent consulting and advisory firm focused exclusively on electric reliability, cybersecurity reliability, and regulatory compliance for organizations connected to the North American Bulk Electric System. Our work supports registered entities, including Generator Owners and Operators, Transmission Owners and Operators, Reliability Coordinators, Balancing Authorities, and Distribution Providers, across NERC Reliability Standards, FERC orders, RTO/ISO market participation rules, Regional Entity oversight, and state regulatory frameworks. Energy Compliance partners with Stich Angell, P.A. for legal matters arising in the NERC enforcement lifecycle, including Notice of Penalty response, settlement negotiation, internal investigation under privilege, and the integrated legal-compliance operating frameworks that registered entities need before enforcement arrives. The integrated practice replaces the sequential model in which compliance and legal engage separately and converge only when a matter has already escalated. Engagements are led by a single senior practitioner on the compliance side and by a named partner on the legal side. We do not staff for billable hours. We staff for outcomes. Our deliverables are written to be operationally executable and audit-defensible, not to manufacture activity. Energy Compliance is not affiliated with, sponsored by, or endorsed by the North American Electric Reliability Corporation, the Federal Energy Regulatory Commission, or any Regional Entity.

Legal Series Services

Legal Series Services

The Legal Series supports registered entities across the full enforcement lifecycle. The work is structured for operational execution and legal defensibility. Every engagement is led by a named senior practitioner on the compliance side and by a named partner at Stich Angell on the legal side.

Integrated legal-compliance services include, but are not limited to:

• Notice of Penalty response strategy and execution
• Internal investigation conducted under privilege
• Document production and privilege log management
• Witness preparation for Regional Entity interviews
• Settlement negotiation with Regional Entity counsel
• Self-Report drafting and legal review
• FERC submission preparation and review
• Legal-compliance operating framework design
• Counsel-led after-action review and lessons integration

Each engagement is scoped to the entity's role, function, regulatory posture, and the procedural stage of the matter.

ENERGY COMPLIANCE LEGAL SERIES

Defensible Compliance. Disciplined Defense. Energy Compliance, Inc. and Stich Angell, P.A. partner to provide registered entities with integrated legal and compliance support across the NERC enforcement lifecycle, from Self-Report through Notice of Penalty through settlement at FERC.

ENFORCEMENT DEFENSE PRIVILEGE COUNSEL Notice of Penalty response and settlement Internal investigation and document production strategy. under privilege.

REGULATORY ADVISORY LEGAL-COMPLIANCE INTEGRATION FERC submission, Regional Entity counsel Operating frameworks built before enforcement engagement. arrives.

CONNECT WITH US