Mitigation Plan Negotiation: Legal Strategy

Foreword

Foreword

This professional reference is part of the Legal Series published by Energy Compliance, Inc. in partnership with Stich Angell, P.A., for registered entities and the people who run their compliance and legal programs. NERC enforcement is procedurally a civil enforcement regime that registered entities frequently treat as a compliance process. The framing matters. The decisions made early in any enforcement matter bind the entity through every subsequent stage, and many of those decisions involve legal judgment that compliance teams are not trained to make alone. The cost of recognizing this late is significant, rarely visible at the moment, and largely avoidable with the right operating framework in place. Energy Compliance, Inc. partners with Stich Angell, P.A. to provide registered entities with integrated legal-compliance support across the full enforcement lifecycle. Rob Smith brings more than thirty years of operator and regulator-side compliance experience. Cara Passaro and the Stich Angell team bring civil litigation depth, appellate practice, and increasing focus on energy compliance defense. The combination is the structural alternative to the model in which compliance consulting and legal counsel operate as separate engagements that converge only when an enforcement matter has already arrived. These references are written for the compliance manager who has to brief the general counsel honestly. For the in-house attorney who needs to understand how NERC enforcement actually proceeds. For the senior leader who has been told that the enforcement matter is under control and suspects it is not. For the outside counsel who has been asked to advise on a NERC matter for the first time and needs a practitioner's view of the procedural reality. The references do not substitute for engaged counsel and they do not replace operational compliance judgment. They describe how the system actually works, in the voice we use in front of regulators and in the courtroom, so that registered entities can make the decisions in front of them with the information practitioners would want them to have. If the integrated legal-compliance approach we describe is what your entity needs, the back of this reference contains contact information. If not, the reference still belongs to you. Take what is useful, apply it well, and remember that the structural decisions made before an enforcement matter arrives are almost always worth more than the decisions made after.

— Cara C. Passaro and Rob Smith Stich Angell, P.A. · Energy Compliance, Inc.

EC-WP-806 Mitigation Plan Negotiation: Legal Strategy

The Mitigation Plan as a Negotiation Instrument

The Mitigation Plan as a Negotiation Instrument

The mitigation plan is widely treated as the regulator's prescription. It is in fact a negotiation instrument that shapes the entity's compliance obligations for years.

The mitigation plan in a NERC settlement is widely treated by registered entities as the regulator's prescription for the entity's remediation. The regulator proposes language. The entity accepts the language with limited modification. The plan becomes part of the settlement document. The framing is then operationalized through years of implementation. This treatment understates what the mitigation plan actually is. The plan is a negotiation instrument that determines what the entity is committing to do, how the entity will be evaluated against the commitment, and what the entity's compliance obligations look like for the duration of the plan. The reframing matters because the mitigation plan often has more long-term consequence for the entity than the penalty amount that the same settlement establishes. The penalty is paid once. The mitigation plan operates continuously, sometimes for two or three years, with the entity being evaluated by the Regional Entity at each reporting interval. Plans that are excessively broad, vaguely scoped, or weakly defined in their closure criteria produce continuing obligations that the entity has to meet without clear endpoints. Plans that are precisely scoped, operationally bounded, and explicitly closeable produce a finite obligation that the entity discharges and exits. Negotiating the mitigation plan with this lens requires both counsel and compliance to engage substantively. Counsel is responsible for the legal characterization, the language precision, the closure architecture, and the protection against forward-looking exposure. Compliance is responsible for the operational executability of the proposed remediation, the realistic timeline, and the resource implications of the proposed obligations. The two functions develop the entity's negotiating position together, and the position is presented to the regulator as the entity's considered counterproposal rather than as procedural editing of the regulator's draft. Entities that adopt this posture produce mitigation plans that reflect what the actual remediation requires, not what the regulator's first draft proposed. The plans are operationally tractable, legally defensible, and bounded in time. The entities then deliver against the plans on schedule, achieve closure on the negotiated criteria, and exit the matter cleanly. Entities that accept the regulator's first draft operate under broader and longer obligations than the matter required, often discovering at the closure

FROM THE PRACTICE The mitigation plan is a negotiation instrument, not a regulator's prescription. The plan often has more long-term consequence for the entity than the penalty amount. Counsel addresses legal characterization, language precision, and closure architecture. Compliance addresses operational executability and resource implications. Both, together. Entities that negotiate substantively produce plans that close on schedule. Entities that accept first drafts operate under obligations that often do not actually close.

Reading the Regulator's Mitigation Theory

Reading the Regulator's Mitigation Theory

ory The regulator's proposed mitigation reflects a theory about what the underlying issue requires. Reading the theory accurately is the foundation of the negotiation.

When the Regional Entity proposes mitigation language, the proposal reflects a theory about the underlying compliance issue. The theory has assumptions about cause, scope of risk, and the remediation needed to address both. The theory is not always articulated explicitly. It often has to be inferred from the proposed mitigation language, the related portions of the settlement framing, and the regulator's prior practice in similar matters. Reading the theory accurately is the foundation of the entity's negotiating position, because the entity is not negotiating the language as text. The entity is negotiating against the underlying theory. Common regulator theories include several recognizable patterns. The control failure theory assumes that a specific control did not function as designed and that targeted remediation of the control will address the matter. The programmatic theory assumes that the control failure was symptomatic of broader program weaknesses requiring comprehensive program updates. The cultural theory assumes that the entity's compliance culture allowed the issue to develop and that training, governance, or leadership-attention measures are required. Each theory produces different mitigation language, different scope, and different implementation burden, and the entity's response should reflect engagement with the actual theory rather than only the language. Reading the theory is also iterative. The regulator may begin with one theory, hear the entity's counterposition, and shift to a different framing. The shift is observable in the regulator's revisions to the proposed language and in the framing of any settlement discussions. Counsel attentive to these shifts can engage with the actual theory at each stage of the negotiation. Counsel that focuses only on the language as text misses the underlying theoretical movement and produces a final plan that addresses the regulator's first theory rather than the theory the regulator actually arrived at. The negotiating implication of theory-reading is that the entity's response can engage at the theory level rather than only at the language level. If the regulator's theory is too broad for the actual matter, the entity's response can present the case for a narrower theory, supported by facts the regulator may not have fully appreciated. The regulator that accepts the narrower theory often agrees to mitigation language that reflects the narrower scope. This kind of substantive theory engagement is uncommon in

FROM THE PRACTICE Mitigation language reflects an underlying regulator theory. Reading the theory accurately is the foundation of the negotiation. Common theories: control failure, programmatic weakness, cultural cause. Each produces different mitigation scope, language, and implementation burden. The entity's response can engage at the theory level, not only at the language level. This is uncommon and high-leverage when the entity has the capacity for it.

Operationally Executable vs Legally Defensible

Operationally Executable vs Legally Defensible

Mitigation language has to satisfy two distinct criteria. Loosening either produces predictable failures during implementation.

Mitigation language in a NERC settlement has to satisfy two distinct criteria simultaneously. The language has to be operationally executable, meaning the entity can actually do what the language commits the entity to doing within the resources, timeline, and operational reality the entity faces. The language has to be legally defensible, meaning the language is precise enough to support a clear demonstration of compliance and bounded enough that disputes about completion can be resolved on the language itself. Loosening either criterion produces predictable failures during implementation. Operationally executable language has specific characteristics. The actions are within the entity's operational control. The timeline is realistic given the actions required. The resources implied are available. The verification activities can be completed by people who exist or who the entity will hire. None of this is automatic when the regulator drafts the proposed language. The regulator does not know the entity's specific resource constraints, operational rhythm, or competing priorities. The entity has to translate the regulator's draft into language that operations can actually deliver. Compliance owns this translation. Legally defensible language has different characteristics. The actions are described specifically enough that the entity can demonstrate completion. The completion criteria are objective rather than discretionary. The language does not commit the entity to standards higher than the underlying requirement actually requires. The language does not create dependencies that the entity cannot control. The language is internally consistent and does not produce ambiguities that can be resolved against the entity later. Counsel owns this defensibility analysis. The two criteria sometimes pull in different directions. Operationally executable language often wants flexibility, while legally defensible language often wants specificity. The negotiation finds language that satisfies both. This usually requires more drafting effort than the regulator's first proposal received. The investment is small compared to the cost of operating for years under language that fails on either criterion. Programs that conduct this two-criterion review on every draft mitigation plan produce plans that close cleanly on schedule. Programs that conduct only one of the reviews produce plans that fail on the other criterion during implementation.

FROM THE PRACTICE Mitigation language has to satisfy two criteria: operationally executable and legally defensible. Loosening either produces predictable failures. Compliance owns the operational executability analysis. Counsel owns the legal defensibility analysis. Both reviews are required on every draft. The two criteria sometimes pull in different directions. The negotiation finds language that satisfies both. This is more drafting effort than the regulator's first proposal received.

Scope, Depth, and Timeline Discipline

Scope, Depth, and Timeline Discipline

The three dimensions of mitigation that the entity has the most leverage to negotiate are scope, depth, and timeline. Each has its own discipline.

Mitigation plans have three dimensions where entity-side negotiation typically has the most leverage. The scope of the mitigation, including which systems, processes, and personnel are covered. The depth of the mitigation, including how thoroughly the entity must address each in-scope element. The timeline of the mitigation, including how quickly the entity must complete each element and how long the plan operates overall. Each dimension has its own discipline, and progress on one does not automatically support progress on the others. Scope discipline addresses what the mitigation actually covers. The regulator's proposed scope is sometimes broader than the underlying violation requires. A documentation gap that affected three procedures may produce a proposed mitigation covering all procedures of similar type across the entity. A control failure in one operational area may produce a proposed mitigation covering related areas where no failure occurred. The entity's negotiating position should bound the scope to what the actual matter requires, with credible argument about why the broader scope is not warranted by the underlying facts. Bounded scope is achievable in many matters and produces meaningfully smaller implementation burden. Depth discipline addresses how thoroughly the entity must address in-scope elements. The regulator's proposed depth often defaults to comprehensive review and reconstruction. The entity's response can frame the appropriate depth based on what the actual issue revealed and what reasonable assurance against recurrence requires. Depth language that requires comprehensive program updates is meaningfully different from depth language that requires targeted updates with periodic verification. The difference operates over the life of the plan and across every reporting cycle. Timeline discipline addresses both the per-action timing and the overall plan duration. The regulator's proposed timeline reflects the regulator's view of urgency and may not account for the entity's operational realities. Realistic timelines that reflect actual remediation work, with verification milestones at intervals that allow course correction, produce plans the entity can actually deliver on schedule. Aggressive timelines that exceed the entity's actual delivery capacity produce missed milestones, regulator dissatisfaction, and sometimes amended plans with worse terms. The entity

FROM THE PRACTICE Three dimensions where entity-side negotiation has most leverage: scope, depth, timeline. Each has its own discipline. Progress on one does not automatically support the others. Bounded scope is achievable in many matters. The entity's response should argue from the actual facts, not from comfort with the regulator's proposed framing. Realistic timelines produce plans the entity can deliver. Aggressive timelines produce missed milestones, regulator dissatisfaction, and worse-terms amendments.

The Implementation Burden: What You Are Committing To

The Implementation Burden: What You Are Committing To

The mitigation plan is an operational obligation that runs for the plan's duration. Understanding the burden before signing is the entity's responsibility.

The implementation burden of a mitigation plan is the operational reality the entity will live with for the plan's duration. Personnel time. Documentation effort. System changes. Training delivery. Internal reviews. External verification activities. Reporting cycles. Each obligation creates work the entity has to perform on the schedule the plan establishes. The aggregate burden over the life of the plan is often significant, and entities that have not estimated the burden before signing routinely find themselves understaffed for the implementation work the plan actually requires. Estimating the burden is the entity's responsibility, not the regulator's. The regulator does not have visibility into the entity's resource situation, the competing priorities the compliance team manages, or the operational disruption that comprehensive remediation creates. Compliance teams have to model the burden under realistic assumptions about who will do the work, how long it will take, what other priorities will compete for the same time, and what the verification and reporting effort will require above the substantive remediation effort. When the burden estimate exceeds what the entity can credibly deliver, the negotiating position is to seek modifications to scope, depth, or timeline that bring the burden into the deliverable range. This is a substantive negotiation, not a procedural one. The entity is not asking the regulator to relax requirements as a favor. The entity is presenting the burden estimate, the implementation plan that supports it, and the modifications that would produce a plan the entity can actually execute. The regulator that accepts this kind of substantive engagement often agrees to modifications, because the regulator's interest is in mitigation that actually happens, not mitigation that is committed but not delivered. Where modifications cannot be obtained, the entity has to commit internal resources sufficient to deliver against the plan as agreed. This may require staffing additions, contractor support, or reprioritization of other compliance work. The decision to commit those resources should be made before the plan is signed, with senior leadership awareness, and with the resource commitment

FROM THE PRACTICE The implementation burden runs for the plan's duration. Estimating the burden before signing is the entity's responsibility, not the regulator's. When the burden exceeds deliverable capacity, negotiate scope, depth, or timeline. Substantive engagement on burden produces meaningful modifications. Where modifications are unavailable, commit the resources internally before signing. The alternative is missed milestones and amended plans on worse terms.

Reporting Obligations and Their Long Tail

Reporting Obligations and Their Long Tail

Reporting requirements produce a recurring compliance event for each reporting interval. The cumulative effect across the plan duration is significant and is rarely modeled in advance.

Mitigation plans typically include reporting obligations that the entity must satisfy on a defined cadence for the plan's duration. Quarterly progress reports. Annual certifications. Milestone notifications. Closure-readiness submissions. Each reporting obligation is a recurring compliance event that requires preparation, internal coordination, factual documentation, legal review, and timely submission. The cumulative effect across a multi-year plan is significant and is rarely modeled in advance during the negotiation. The reporting obligations also create compliance exposure beyond the substantive mitigation work. A late report can be a separate compliance issue. A report that contains inaccuracies can produce a separate matter. A report that does not satisfy the substantive requirements of the plan provision can trigger regulator inquiry that extends the matter beyond the original mitigation scope. Each report is a moment of regulator interaction that the entity has to handle with the same care that the original matter received, even though the routine nature of reporting can produce complacency. The negotiating position on reporting should address both the cadence and the content. Quarterly reporting on a multi-year plan is significantly more burdensome than annual reporting and produces more frequent opportunities for compliance issues. The content requirements should be specific enough that the entity knows what to provide and bounded enough that the entity is not making expansive certifications about matters outside the report's scope. Reporting templates and content frameworks negotiated at settlement reduce ambiguity during the implementation period. Counsel should also negotiate the consequences of reporting variances, where possible. Plans that treat any reporting variance as a separate compliance violation produce a brittle structure. Plans that include defined cure provisions, allowing the entity to address minor variances without separate enforcement consequence, produce a structure the entity can operate under realistically. Cure provisions are not always available, but they are sometimes negotiable when the entity asks for them, and the asking is itself a discipline that signals the entity is thinking about the plan as an operational artifact rather than as an executory document.

FROM THE PRACTICE Reporting obligations produce recurring compliance events for the plan's duration. The cumulative effect is significant and rarely modeled during negotiation. Each report is a regulator interaction with separate compliance exposure. Late reports, inaccurate reports, or non-conforming reports each create new matter risk. Negotiate cadence, content, and consequences of variances. Cure provisions, where available, produce a plan structure the entity can operate under realistically.

Negotiating the Closure Criteria

Negotiating the Closure Criteria

Mitigation plans need explicit closure criteria. Plans that close on regulator discretion never actually close on a defined timeline.

The closure criteria of a mitigation plan determine when the entity has fulfilled its obligations and the matter is concluded. The criteria should be explicit, objective, and verifiable. Plans that include explicit criteria allow the entity to plan toward closure, document the closure events as they occur, and submit a closure-ready certification that the regulator evaluates against defined standards. Plans that close on regulator discretion, without explicit criteria, never actually close on a timeline the entity controls. The matter remains open at the regulator's pleasure, which produces continuing obligations and continuing administrative cost long after the substantive remediation has been completed. Negotiating closure criteria explicitly is sometimes uncomfortable for entity counsel because it can read as the entity asking permission to close the matter. The opposite framing is more accurate. The entity is asking for clear standards against which the regulator will evaluate the entity's work. The regulator that agrees to defined criteria has communicated what closure requires. The regulator that resists defined criteria has communicated that closure is at regulator discretion regardless of the entity's performance, which is a structural problem the entity should surface and address before the plan is signed. Closure criteria language has standard elements. The substantive milestones the entity must complete. The verification mechanism that confirms the milestones have been met. The submission protocol for the closure-readiness package. The timeline within which the regulator will evaluate the submission. The standard the regulator will apply to determine whether closure is granted. The procedure for addressing any deficiencies the regulator identifies. Each element can be negotiated explicitly, and explicit language on each produces a closure architecture that operates predictably. Plans that close cleanly on the negotiated criteria allow the entity to exit the matter, archive the documentation, and update the legal-compliance operating framework with the lessons. Plans that do not close, despite substantive completion, continue to consume entity attention indefinitely and prevent the lessons-integration step that EC-WP-801 and EC-WP-804 describe. The entity's interest in clean closure is structural, and the negotiation effort required to secure explicit closure criteria is small compared to the cost of operating under an open-ended plan for years longer than the underlying matter required.

FROM THE PRACTICE Closure criteria need to be explicit, objective, and verifiable. Plans that close on regulator discretion never actually close on a timeline the entity controls. Negotiating closure explicitly is asking for clear standards. The regulator that resists has communicated that closure is discretionary regardless of performance. Plans that close cleanly allow the entity to exit, archive, and integrate lessons. Plans that do not close consume entity attention indefinitely.

The Mitigation Plan as a Future Audit Variable

The Mitigation Plan as a Future Audit Variable

The mitigation plan is read by future auditors. The wording, the closure history, and the implementation evidence all affect subsequent audit posture.

A mitigation plan is part of the entity's regulatory record. Future audits read the prior mitigation plans as part of their preparation. The wording of the plan, the closure history, the implementation evidence the entity preserved, and the entity's overall performance against the plan all affect subsequent audit posture. A mitigation plan that closed cleanly with documented evidence supports a strong audit posture in subsequent cycles. A mitigation plan that did not close, or that closed without robust documentation, can become an audit problem in subsequent cycles even when the underlying matter was years earlier. The entity should preserve mitigation implementation evidence with the same discipline that the underlying compliance program applies to substantive evidence. Each milestone completion is documented at the time of completion. Each verification activity is documented with the verification record. Each reporting submission is preserved with the supporting workpapers. The aggregate evidence package supports the closure submission and remains available for future audit reference. Programs that lose track of mitigation implementation evidence find that the evidence has to be reconstructed when subsequent auditors ask for it, and reconstructed evidence is meaningfully weaker than contemporaneous evidence. The mitigation plan also informs the entity's compliance program forward. The remediation undertaken during the plan often becomes part of the entity's standard operating posture. The new procedures stay in place. The new controls continue to operate. The training updates remain part of the curriculum. This integration is appropriate when the mitigation reflects genuine program improvement and is problematic when the mitigation includes elements that exceeded what the underlying matter required and that the entity now has to maintain forever as a function of the mitigation language. Counsel should consider this forward operation when negotiating the mitigation language, and should avoid language that locks the entity into operational structures the matter did not actually warrant. Finally, the mitigation plan and its closure are part of the institutional learning that the legal-compliance operating framework integrates after each matter. The lessons about what worked, what did not, and what the entity will do differently next time inform every subsequent matter the entity faces. The

FROM THE PRACTICE Mitigation plans are part of the regulatory record. Future audits read them. Closure history and implementation evidence affect subsequent audit posture. Preserve mitigation implementation evidence with the same discipline as substantive compliance evidence. Reconstructed evidence is meaningfully weaker than contemporaneous evidence. Counsel should consider forward operation when negotiating mitigation language. Avoid language that locks the entity into structures the matter did not actually warrant.

About the Author

About the Author

Cara C. Passaro is Shareholder and Firm President at Stich Angell, P.A., where she has practiced civil trial and appellate law for more than two decades. She is licensed to practice in the state and federal courts of Minnesota and North Dakota and has been recognized as a Super Lawyer for her work in civil litigation and construction litigation defense. Cara's practice has historically focused on products liability, premises liability, transportation liability, and complex commercial litigation, with an emphasis on the defense of corporate clients in high-stakes matters across the Midwest. She has tried jury cases to verdict in Minnesota state court, argued matters at the Minnesota Court of Appeals, and managed appellate work through the Minnesota Supreme Court. In recent years, Cara and the Stich Angell team have extended the firm's civil litigation practice into energy compliance defense, working with registered entities and their compliance partners on NERC enforcement matters, Notice of Penalty response, settlement negotiations with Regional Entities, and the integrated legal-compliance frameworks that determine whether enforcement matters resolve as manageable procedural events or as multi-year exposures. Cara serves as the named legal author of the Energy Compliance, Inc. Legal Series and is the partner engagement lead for the Stich Angell side of the integrated practice.

About Stich Angell, P.A. Stich Angell, P.A. is a Minneapolis-based civil litigation firm founded in 1971. The firm represents businesses, individuals, and organizations across a broad range of civil practice areas, with particular depth in complex litigation, products liability, transportation liability, professional liability, insurance defense, construction litigation, and appellate practice. The firm's trial and appellate attorneys are recognized among the most experienced civil trial lawyers in the state, with extensive experience representing clients through trial verdict and appellate review. Although the firm is based in Minnesota, the attorneys represent clients in matters across the United States. Stich Angell has expanded the firm's civil litigation practice into energy compliance defense, partnering with Energy Compliance, Inc. to provide registered entities with integrated legal and compliance support across the NERC enforcement lifecycle. The combined practice brings civil litigation discipline, appellate strength, and senior regulatory experience to a category of matters that has historically lacked that combination. Stich Angell, P.A. is located at 3601 Minnesota Drive, Suite 450, Minneapolis, Minnesota 55435, and may be reached at (612) 333-6251 or at stichlaw.com.

About Energy Compliance, Inc.

About Energy Compliance, Inc.

Energy Compliance, Inc. is an independent consulting and advisory firm focused exclusively on electric reliability, cybersecurity reliability, and regulatory compliance for organizations connected to the North American Bulk Electric System. Our work supports registered entities, including Generator Owners and Operators, Transmission Owners and Operators, Reliability Coordinators, Balancing Authorities, and Distribution Providers, across NERC Reliability Standards, FERC orders, RTO/ISO market participation rules, Regional Entity oversight, and state regulatory frameworks. Energy Compliance partners with Stich Angell, P.A. for legal matters arising in the NERC enforcement lifecycle, including Notice of Penalty response, settlement negotiation, internal investigation under privilege, and the integrated legal-compliance operating frameworks that registered entities need before enforcement arrives. The integrated practice replaces the sequential model in which compliance and legal engage separately and converge only when a matter has already escalated. Engagements are led by a single senior practitioner on the compliance side and by a named partner on the legal side. We do not staff for billable hours. We staff for outcomes. Our deliverables are written to be operationally executable and audit-defensible, not to manufacture activity. Energy Compliance is not affiliated with, sponsored by, or endorsed by the North American Electric Reliability Corporation, the Federal Energy Regulatory Commission, or any Regional Entity.

Legal Series Services

Legal Series Services

The Legal Series supports registered entities across the full enforcement lifecycle. The work is structured for operational execution and legal defensibility. Every engagement is led by a named senior practitioner on the compliance side and by a named partner at Stich Angell on the legal side.

Integrated legal-compliance services include, but are not limited to:

• Notice of Penalty response strategy and execution
• Internal investigation conducted under privilege
• Document production and privilege log management
• Witness preparation for Regional Entity interviews
• Settlement negotiation with Regional Entity counsel
• Self-Report drafting and legal review
• FERC submission preparation and review
• Legal-compliance operating framework design
• Counsel-led after-action review and lessons integration

Each engagement is scoped to the entity's role, function, regulatory posture, and the procedural stage of the matter.

ENERGY COMPLIANCE LEGAL SERIES

Defensible Compliance. Disciplined Defense. Energy Compliance, Inc. and Stich Angell, P.A. partner to provide registered entities with integrated legal and compliance support across the NERC enforcement lifecycle, from Self-Report through Notice of Penalty through settlement at FERC.

ENFORCEMENT DEFENSE PRIVILEGE COUNSEL Notice of Penalty response and settlement Internal investigation and document production strategy. under privilege.

REGULATORY ADVISORY LEGAL-COMPLIANCE INTEGRATION FERC submission, Regional Entity counsel Operating frameworks built before enforcement engagement. arrives.

CONNECT WITH US