Contracting with Compliance Consultants: What Counsel Should Require

Foreword

Foreword

This professional reference is part of the Legal Series published by Energy Compliance, Inc. in partnership with Stich Angell, P.A., for registered entities and the people who run their compliance and legal programs. NERC enforcement is procedurally a civil enforcement regime that registered entities frequently treat as a compliance process. The framing matters. The decisions made early in any enforcement matter bind the entity through every subsequent stage, and many of those decisions involve legal judgment that compliance teams are not trained to make alone. The cost of recognizing this late is significant, rarely visible at the moment, and largely avoidable with the right operating framework in place. Energy Compliance, Inc. partners with Stich Angell, P.A. to provide registered entities with integrated legal-compliance support across the full enforcement lifecycle. Rob Smith brings more than thirty years of operator and regulator-side compliance experience. Cara Passaro and the Stich Angell team bring civil litigation depth, appellate practice, and increasing focus on energy compliance defense. The combination is the structural alternative to the model in which compliance consulting and legal counsel operate as separate engagements that converge only when an enforcement matter has already arrived. These references are written for the compliance manager who has to brief the general counsel honestly. For the in-house attorney who needs to understand how NERC enforcement actually proceeds. For the senior leader who has been told that the enforcement matter is under control and suspects it is not. For the outside counsel who has been asked to advise on a NERC matter for the first time and needs a practitioner's view of the procedural reality. The references do not substitute for engaged counsel and they do not replace operational compliance judgment. They describe how the system actually works, in the voice we use in front of regulators and in the courtroom, so that registered entities can make the decisions in front of them with the information practitioners would want them to have. If the integrated legal-compliance approach we describe is what your entity needs, the back of this reference contains contact information. If not, the reference still belongs to you. Take what is useful, apply it well, and remember that the structural decisions made before an enforcement matter arrives are almost always worth more than the decisions made after.

— Cara C. Passaro and Rob Smith Stich Angell, P.A. · Energy Compliance, Inc.

EC-WP-807 Contracting with Compliance Consultants: What Counsel Should Require

Why Counsel Should Be in the Consulting Contract

Why Counsel Should Be in the Consulting Contract

Compliance consulting contracts have legal consequences across multiple dimensions. Counsel involvement before signing prevents most of the predictable problems.

Compliance consulting contracts are legal documents with consequences across multiple dimensions of the entity's operations. The contracts establish or fail to establish privilege framing for the consultant's work. They allocate risk between the entity and the consultant for any problems the engagement produces. They define what the entity is buying and what the consultant is delivering. They determine what happens if the entity needs to end the engagement before completion. Each of these is a legal question, and resolving each requires counsel involvement before the contract is signed. Compliance teams routinely sign consulting contracts without meaningful counsel review. The contracts are perceived as procurement matters. The standard form provided by the consultant is signed with limited modification. The entity discovers later that the contract did not address something the entity needed it to address, and by that point the contract is signed and the leverage to negotiate has passed. The pattern is predictable across consulting engagement types and across firms. The legal layer is most consequential precisely in the situations where the entity needs the consultant most. When an enforcement matter arises and the consultant's prior work becomes relevant. When the consultant's recommendations are challenged at audit. When the engagement needs to end before scheduled completion. When the entity needs the consultant's institutional knowledge transferred internally before the consultant departs. Each of these situations exposes whatever the contract did or did not require, and the gaps are visible at the moment they matter most. Counsel involvement before signing addresses the predictable problems before they become unrecoverable. The investment is small in absolute terms. The engagement attorney spends a few hours reviewing and negotiating the contract. The negotiation produces specific changes that protect the entity across each dimension. The signed contract reflects the entity's actual interests rather than the consultant's standard form. Programs that build this discipline into every consulting engagement experience meaningfully fewer problems across the engagement portfolio than programs that sign first and address legal issues later.

FROM THE PRACTICE Compliance consulting contracts have legal consequences across privilege, risk allocation, scope, and termination. Counsel involvement before signing is structural. The legal layer is most consequential precisely when the entity needs the consultant most: enforcement matters, audit challenges, early termination, knowledge transfer. Counsel investment before signing is small. The cost of skipping it shows up at the moment the entity needs the contract to do work the contract was not drafted to do.

The Engagement Structure: Privilege and Agency Considerations

The Engagement Structure: Privilege and Agency Considerations

The engagement structure determines whether the consultant's work is privileged or discoverable. The structure has to be designed before the work begins.

The engagement structure for a compliance consultant determines whether the consultant's work product, communications, and analysis are privileged or discoverable. The structure has to be designed at the contracting stage. Retrofitting privilege framing onto an engagement that was structured without it is meaningfully harder and sometimes legally ineffective. The contract is the moment the structure is established. Two general structures apply. The direct engagement structure has the consultant engaged by the entity, working under the entity's direction, producing work that is generally not privileged. This structure is appropriate for routine compliance support work that does not anticipate enforcement matters. The advantage is operational simplicity. The cost is that the consultant's work product may be discoverable in any future enforcement matter, and the entity has limited ability to claim protection over it. The counsel-direction structure has the consultant engaged by counsel or under counsel's direction, working as an agent of counsel for purposes of legal analysis. The work product is generally privileged. This structure is appropriate when the engagement is connected to actual or anticipated enforcement matters, internal investigations under privilege, or other legally sensitive work. The contracting paperwork has to reflect this structure explicitly, including the agency relationship, the privilege framing, and the confidentiality obligations that flow from it. Programs that work routinely with the same consulting firm benefit from a master engagement framework that establishes the firm's standing arrangement with the entity. The framework typically includes the direct engagement structure for routine work and a mechanism for converting specific matters to the counsel-direction structure when triggered. The conversion mechanism is the operational discipline that makes the structure work in practice. Without the mechanism, the conversion does not happen until well after the matter that needs it has begun, and by then the privilege protection is at risk.

FROM THE PRACTICE The engagement structure determines whether the consultant's work is privileged or discoverable. The structure is designed at contracting. Direct engagement structure suits routine work but produces discoverable work product. Counsel-direction structure suits matter-related work and produces privileged work product. Master engagement frameworks include both structures and a conversion mechanism. The mechanism is the operational discipline that makes the structure work in practice.

Scope Definition: Specific, Bounded, Auditable

Scope Definition: Specific, Bounded, Auditable

Scope language in consulting contracts is often general. General scope produces engagement drift, deliverable disputes, and unclear deliverables that fail at audit.

Scope language in compliance consulting contracts is one of the most consequential elements and one of the most poorly drafted. Many contracts include scope language that is general enough to cover almost anything the consultant might do during the engagement. The generality benefits the consultant, who can bill against an open scope. The generality hurts the entity, which cannot enforce specific deliverables, cannot dispute consultant decisions to expand the work, and cannot defend the deliverables at audit by reference to a clear scope baseline. Effective scope language has three properties. It is specific about what the consultant is doing. It is bounded about what the consultant is not doing. It is auditable, meaning the scope can be tested against actual delivery and any variance can be identified objectively. Each property requires drafting effort that the consultant's standard form generally does not include, and each property protects the entity in ways that vague scope language does not. Specificity addresses the work itself. The contract identifies the specific compliance areas the engagement covers, the specific deliverables the consultant will produce, the specific timeline for each deliverable, and the specific quality standards each deliverable must meet. Compliance contributes the substantive content of these specifications. Counsel ensures the language is contractually enforceable rather than aspirational. Boundedness addresses what the engagement does not cover. The contract states explicitly that the consultant is not engaged for matters outside the defined scope, that scope expansion requires a written change order with corresponding fee adjustment, and that the consultant's recommendations are limited to the defined scope. This protects the entity from consultant-driven scope creep, which is one of the most common patterns in compliance consulting engagements. Auditability addresses how the entity will evaluate the engagement. The contract identifies how scope completion will be measured, how variances will be documented, and what constitutes acceptable performance against the defined scope. This positions the entity to manage the engagement actively rather than only at completion.

FROM THE PRACTICE Scope language is often general. General scope produces engagement drift, deliverable disputes, and unclear deliverables that fail at audit. Effective scope is specific (about what is being done), bounded (about what is not), and auditable (against objective measures of completion). Boundedness protects the entity from consultant-driven scope creep, which is one of the most common patterns in compliance consulting.

Deliverable Standards and Audit Defensibility

Deliverable Standards and Audit Defensibility

Consulting deliverables are often used as audit evidence. The contract should establish deliverable standards that make the deliverables actually defensible.

Compliance consulting engagements produce deliverables that the entity uses as part of its compliance posture. Procedure documents. Evidence frameworks. Risk assessments. Mitigation plans. Training materials. Each of these may eventually be presented to an auditor, who will evaluate the deliverable on its merits without reference to the consulting engagement that produced it. The contract should establish deliverable standards that make the deliverables actually defensible, not only acceptable to the entity at delivery time. Audit-defensible deliverables share recognizable characteristics. They are technically accurate at the level the standard requires. They are operationally executable by the entity's actual personnel. They are internally consistent across related deliverables. They are written in language that can be defended in front of a regulator without translation. They are supported by the evidence the standard requires, with the evidence preserved in a form the entity can produce on demand. None of this is automatic in standard consulting contracts. The contract has to require it explicitly. Counsel and compliance both contribute to the deliverable standards. Compliance specifies the technical accuracy and operational executability requirements. Counsel specifies the language precision and audit-defensibility requirements. The combined specification produces contract language that requires deliverables meeting both criteria. The consultant either accepts the standard or negotiates modifications, and the negotiation is itself a useful signal about how the consultant approaches deliverable quality. Consultants who resist clear deliverable standards are often consultants whose deliverables would not have met the standards. The contract should also establish a deliverable acceptance protocol. The entity has a defined period to review each deliverable and to identify any deficiencies. Deficiencies are addressed under a defined remediation process. Acceptance is documented. Failure to accept does not occur by default; the entity affirmatively documents acceptance. This discipline protects the entity from deliverables that arrive flawed and that the consultant later argues were accepted because no objection was raised. The protocol is administrative and pays for itself the first time it is invoked.

FROM THE PRACTICE Consulting deliverables are often used as audit evidence. The contract should establish standards that make them actually defensible at audit. Audit-defensible deliverables are technically accurate, operationally executable, internally consistent, audit-friendly in language, and supported by preserved evidence. A deliverable acceptance protocol with defined review period and explicit acceptance documentation prevents flawed deliverables from going unchallenged by default.

Termination, Transition, and Knowledge Transfer

Termination, Transition, and Knowledge Transfer

Termination, transition, and knowledge transfer provisions determine the entity's flexibility during and after the engagement. Standard forms rarely protect the entity adequately.

Termination provisions in standard consulting contracts often favor the consultant. The entity may terminate only for cause, with a high standard of cause, after extensive notice and cure provisions. The entity may owe the consultant the full contract value at termination regardless of work delivered. The entity may have limited ability to use the consultant's work product after termination. Each of these elements limits the entity's flexibility and exposes the entity to a captive relationship with the consultant. Effective termination provisions allow the entity to end the engagement without cause, on reasonable notice, with the entity owing only for work actually delivered through the termination date. The entity retains full rights to use the consultant's work product after termination. Any disputes about pre-termination work are resolved under defined processes that do not require the entity to continue the engagement during the dispute. Counsel negotiates these provisions even when the consultant resists, because the alternative is a contract that traps the entity in an engagement that has stopped producing value. Transition provisions address what happens at engagement end, whether by termination or by completion. The consultant should be obligated to support the entity's transition for a defined period after engagement end. The transition includes documentation handoff, walk-throughs of any frameworks or methodologies the consultant introduced, and reasonable cooperation with any successor consultant or with the entity's internal team taking over the work. Without these provisions, the entity may end the engagement and discover that the consultant takes institutional knowledge with them that the entity then has to reconstruct. Knowledge transfer provisions specifically address the institutional knowledge the consultant accumulates during the engagement. The consultant maintains documentation of decisions, frameworks, and reasoning in a form the entity can understand and use after the consultant departs. The knowledge transfer happens throughout the engagement, not only at the end. This addresses the pattern described in EC-WP-702, where consultants concentrate knowledge in ways that make the entity dependent on them. The contract obligation prevents the dependency from developing as a

FROM THE PRACTICE Termination, transition, and knowledge transfer provisions determine the entity's flexibility. Standard forms favor the consultant on each. Effective termination allows the entity to end the engagement without cause, on reasonable notice, owing only for work actually delivered. Knowledge transfer happens throughout the engagement, not only at the end. The contract obligation prevents the entity from becoming captive to the consultant by default.

Indemnification, Insurance, and Allocation of Risk

Indemnification, Insurance, and Allocation of Risk

Standard contract risk allocation typically favors the consultant. Counsel renegotiates these provisions to reflect the entity's actual exposure profile.

Standard compliance consulting contracts typically include indemnification, limitation of liability, and insurance provisions that favor the consultant. The entity indemnifies the consultant against third-party claims. The consultant's liability is capped at a low multiple of the engagement fee. The consultant's insurance coverage is limited and may not extend to the kinds of harms that could arise from compliance work failures. Each of these elements transfers risk to the entity that the entity's actual exposure profile would suggest should remain with the consultant. Counsel renegotiates these provisions to reflect the entity's actual exposure. The consultant indemnifies the entity for breaches of contract, professional negligence, and misuse of confidential information. The consultant's liability cap is increased to a level that meaningfully reflects potential damages, often a multiple of fees substantially higher than the standard form. The consultant's insurance coverage is verified, with limits and coverage scope appropriate for compliance work, and with the entity named as additional insured where applicable. None of these are standard, and all of them are achievable through negotiation when the entity has counsel willing to engage. The risk allocation also addresses the question of consultant work product that turns out to be inadequate or wrong. The consultant's responsibility for inadequate deliverables should be defined explicitly. The remedies for inadequate work should include re-performance at the consultant's cost, damages for harm caused by reliance on inadequate work, and termination rights if the inadequacy is material. Standard forms often disclaim all of this, leaving the entity with the cost of inadequate work as the entity's risk to bear despite having paid for the work. Insurance provisions deserve specific attention. Compliance consulting work can implicate professional liability coverage that varies significantly across firms. The contract should require the consultant to maintain professional liability insurance with defined minimum limits, applicable to the work being performed, and with the entity named as additional insured. The contract should require the consultant to provide certificates of insurance and to notify the entity of any material changes to coverage. These provisions are administrative to negotiate and significantly protective when an actual claim arises.

FROM THE PRACTICE Standard contracts favor the consultant on indemnification, liability caps, and insurance. Counsel renegotiates these to reflect the entity's actual exposure profile. The consultant indemnifies the entity for breaches, negligence, and misuse of confidential information. Liability caps reflect potential damages, not standard form defaults. Insurance provisions require professional liability coverage with defined limits, the entity as additional insured, and certificates with material-change notification.

The Consultant-as-Witness Question

The Consultant-as-Witness Question

In enforcement matters, the consultant may become a witness. The contract should address this possibility before it becomes urgent.

When an enforcement matter arises and the consultant has been involved in the entity's compliance work, the consultant may become a witness in the matter. The consultant's testimony, internal records, communications with the entity, and work product can all be subject to the regulator's discovery process. The consultant's posture during the matter, including their willingness to support the entity's positions, their availability for interviews, and their cooperation with the entity's defense, becomes meaningful operationally. The contract should address this possibility before the matter arises rather than after. The contract should require the consultant to cooperate with the entity in any regulatory matter that involves the consultant's work, including making personnel available for witness preparation and interviews, providing documentation as requested, and supporting the entity's positions to the extent the consultant's actual knowledge supports them. This obligation continues after the engagement ends, for a defined period, and includes the consultant's reasonable best efforts to ensure that personnel who participated in the work remain available. Without this contractual obligation, the consultant's cooperation depends on consultant goodwill, which is variable. The contract should also address confidentiality obligations that survive the engagement. The consultant's obligations to keep entity information confidential should continue indefinitely, with the consultant remaining bound to the obligations even after engagement end. This protects the entity against the consultant becoming a source of information about the entity in subsequent matters or in the public domain. The obligation should be specific enough to be enforceable, with defined exceptions only for legally compelled disclosure with prior notice to the entity. The contract should address the consultant's participation under privilege if the engagement was structured under counsel direction. The consultant should be bound to maintain the privilege framing, to claim privilege on behalf of the entity for any communications that fall within it, and to coordinate with entity counsel on any privilege questions that arise. The consultant should not be permitted to make independent disclosures of privileged work product, even under regulator request, without the entity's consent or court order. These provisions protect the privilege architecture that the engagement

FROM THE PRACTICE The consultant may become a witness in enforcement matters. The contract should address this possibility before it becomes urgent. Cooperation obligations include personnel availability, document provision, and reasonable best efforts to support the entity's positions where the facts support them. Privilege provisions bind the consultant to maintain the privilege framing, claim privilege on behalf of the entity, and not make independent disclosures of privileged work product.

Counsel's Ongoing Role During the Engagement

Counsel's Ongoing Role During the Engagement

ent Counsel's role does not end at contract signing. The engagement requires ongoing legal oversight at defined trigger points.

Counsel involvement in compliance consulting engagements is sometimes treated as a one-time event at contracting. The contract is signed and counsel exits the engagement until the next contract or until a problem arises. This treatment underutilizes counsel's contribution and produces predictable problems that earlier intervention would have prevented. The defensible model has counsel involved at defined trigger points throughout the engagement. Counsel's ongoing role includes review of any deliverable that may have legal implications, particularly characterization documents, mitigation plans, and self-assessment frameworks. Counsel's review at deliverable stage is faster and more effective than counsel's review when a problem with the deliverable surfaces later. The review can be brief if the deliverable does not raise concerns, and it produces a documented checkpoint that confirms counsel saw and approved the work product. Counsel's ongoing role also includes engagement-status check-ins on a defined cadence, particularly for engagements that extend beyond a few months. The check-in addresses whether the engagement is staying within scope, whether the consultant is performing as the contract requires, whether any new legal issues have surfaced, and whether any contract amendments or change orders should be processed. The check-in is operationally light and prevents the slow drift that characterizes engagements where counsel is not involved between contracting and problems. Counsel's ongoing role becomes more intensive when triggered by specific events. The consultant's work surfaces a potential compliance issue. The regulator initiates an inquiry that touches on the consultant's work area. The entity is preparing for an audit that will exercise the consultant's work product. The consultant's engagement is approaching renewal or termination. Each of these is a counsel-engagement trigger that should be defined in advance and acted on consistently. Programs that build this discipline into their consulting engagement framework experience meaningfully fewer surprises across the engagement portfolio than programs that treat counsel involvement as event-driven only when something has already gone wrong. The structural choice is the same as in the rest of the legal-compliance framework. Counsel is integrated, not summoned.

FROM THE PRACTICE Counsel's role does not end at contract signing. The engagement requires ongoing legal oversight at defined trigger points. Deliverable review, periodic check-ins, and event-triggered intensive review are the cadence. Each is operationally light and prevents predictable problems. Counsel is integrated into the engagement, not summoned when something has already gone wrong. The structural choice is consistent with the rest of the legal-compliance framework.

About the Author

About the Author

Cara C. Passaro is Shareholder and Firm President at Stich Angell, P.A., where she has practiced civil trial and appellate law for more than two decades. She is licensed to practice in the state and federal courts of Minnesota and North Dakota and has been recognized as a Super Lawyer for her work in civil litigation and construction litigation defense. Cara's practice has historically focused on products liability, premises liability, transportation liability, and complex commercial litigation, with an emphasis on the defense of corporate clients in high-stakes matters across the Midwest. She has tried jury cases to verdict in Minnesota state court, argued matters at the Minnesota Court of Appeals, and managed appellate work through the Minnesota Supreme Court. In recent years, Cara and the Stich Angell team have extended the firm's civil litigation practice into energy compliance defense, working with registered entities and their compliance partners on NERC enforcement matters, Notice of Penalty response, settlement negotiations with Regional Entities, and the integrated legal-compliance frameworks that determine whether enforcement matters resolve as manageable procedural events or as multi-year exposures. Cara serves as the named legal author of the Energy Compliance, Inc. Legal Series and is the partner engagement lead for the Stich Angell side of the integrated practice.

About Stich Angell, P.A. Stich Angell, P.A. is a Minneapolis-based civil litigation firm founded in 1971. The firm represents businesses, individuals, and organizations across a broad range of civil practice areas, with particular depth in complex litigation, products liability, transportation liability, professional liability, insurance defense, construction litigation, and appellate practice. The firm's trial and appellate attorneys are recognized among the most experienced civil trial lawyers in the state, with extensive experience representing clients through trial verdict and appellate review. Although the firm is based in Minnesota, the attorneys represent clients in matters across the United States. Stich Angell has expanded the firm's civil litigation practice into energy compliance defense, partnering with Energy Compliance, Inc. to provide registered entities with integrated legal and compliance support across the NERC enforcement lifecycle. The combined practice brings civil litigation discipline, appellate strength, and senior regulatory experience to a category of matters that has historically lacked that combination. Stich Angell, P.A. is located at 3601 Minnesota Drive, Suite 450, Minneapolis, Minnesota 55435, and may be reached at (612) 333-6251 or at stichlaw.com.

About Energy Compliance, Inc.

About Energy Compliance, Inc.

Energy Compliance, Inc. is an independent consulting and advisory firm focused exclusively on electric reliability, cybersecurity reliability, and regulatory compliance for organizations connected to the North American Bulk Electric System. Our work supports registered entities, including Generator Owners and Operators, Transmission Owners and Operators, Reliability Coordinators, Balancing Authorities, and Distribution Providers, across NERC Reliability Standards, FERC orders, RTO/ISO market participation rules, Regional Entity oversight, and state regulatory frameworks. Energy Compliance partners with Stich Angell, P.A. for legal matters arising in the NERC enforcement lifecycle, including Notice of Penalty response, settlement negotiation, internal investigation under privilege, and the integrated legal-compliance operating frameworks that registered entities need before enforcement arrives. The integrated practice replaces the sequential model in which compliance and legal engage separately and converge only when a matter has already escalated. Engagements are led by a single senior practitioner on the compliance side and by a named partner on the legal side. We do not staff for billable hours. We staff for outcomes. Our deliverables are written to be operationally executable and audit-defensible, not to manufacture activity. Energy Compliance is not affiliated with, sponsored by, or endorsed by the North American Electric Reliability Corporation, the Federal Energy Regulatory Commission, or any Regional Entity.

Legal Series Services

Legal Series Services

The Legal Series supports registered entities across the full enforcement lifecycle. The work is structured for operational execution and legal defensibility. Every engagement is led by a named senior practitioner on the compliance side and by a named partner at Stich Angell on the legal side.

Integrated legal-compliance services include, but are not limited to:

• Notice of Penalty response strategy and execution
• Internal investigation conducted under privilege
• Document production and privilege log management
• Witness preparation for Regional Entity interviews
• Settlement negotiation with Regional Entity counsel
• Self-Report drafting and legal review
• FERC submission preparation and review
• Legal-compliance operating framework design
• Counsel-led after-action review and lessons integration

Each engagement is scoped to the entity's role, function, regulatory posture, and the procedural stage of the matter.

ENERGY COMPLIANCE LEGAL SERIES

Defensible Compliance. Disciplined Defense. Energy Compliance, Inc. and Stich Angell, P.A. partner to provide registered entities with integrated legal and compliance support across the NERC enforcement lifecycle, from Self-Report through Notice of Penalty through settlement at FERC.

ENFORCEMENT DEFENSE PRIVILEGE COUNSEL Notice of Penalty response and settlement Internal investigation and document production strategy. under privilege.

REGULATORY ADVISORY LEGAL-COMPLIANCE INTEGRATION FERC submission, Regional Entity counsel Operating frameworks built before enforcement engagement. arrives.

CONNECT WITH US