Contracting with Compliance Consultants: What Counsel Should Require

Foreword

Foreword

This professional reference is part of the Legal Series published by Energy Compliance, Inc. in partnership with Stich Angell, P.A., for registered entities and the people who run their compliance and legal programs.

NERC enforcement is, procedurally, a civil enforcement regime that registered entities often treat as a compliance process. The framing matters. Decisions made early in an enforcement matter bind the entity through every later stage, and many of them call for legal judgment that compliance teams are not trained to make alone. Recognizing that late is expensive. The cost is rarely visible in the moment, and most of it is avoidable with the right operating framework in place.

Energy Compliance, Inc. partners with Stich Angell, P.A. to give registered entities integrated legal-compliance support across the full enforcement lifecycle. Rob Smith brings more than thirty years of operator and regulator-side compliance experience. Cara Passaro and the Stich Angell team bring civil litigation depth, appellate practice, and a growing focus on energy compliance representation. Together they are the structural alternative to the usual model, in which compliance consulting and legal counsel run as separate engagements and meet only after an enforcement matter has arrived.

These references are written for the compliance manager who has to brief the general counsel honestly. For the in-house attorney who needs to understand how NERC enforcement actually proceeds. For the senior leader who has been told the enforcement matter is under control and suspects it is not. For the outside counsel asked to advise on a NERC matter for the first time, who needs a practitioner's view of the procedural reality.

The references do not substitute for engaged counsel, and they do not replace operational compliance judgment. They describe how the system works, in the voice we use in front of regulators and in the courtroom, so that registered entities can make the decisions in front of them with the information practitioners would want them to have.

If the integrated legal-compliance approach we describe is what your entity needs, the back of this reference has our contact information. If not, the reference still belongs to you. Take what is useful and apply it well. The structural decisions made before an enforcement matter arrives are almost always worth more than the ones made after.

Cara C. Passaro and Rob Smith

Shareholder and Firm President, Stich Angell, P.A.

Founder and Principal, Energy Compliance, Inc.

Executive Summary

Executive Summary

Compliance consulting engagements are routinely contracted by procurement and operations personnel with little or no counsel involvement, and the contracts show it. Privilege framing is missing or wrong. Indemnification and risk allocation favor the consultant. Termination provisions box the entity in. Knowledge-transfer obligations are absent, and deliverable standards are vague. The entity finds each gap only when a specific situation exposes it, often in the middle of an enforcement matter, when the gap costs the most.

This reference covers why counsel belongs in the consulting contract from the start, how the engagement structure sets up privilege and work-product protection, the scope language that protects the entity, deliverable standards that hold up at audit, termination and transition rights, indemnification and insurance that match the entity's real exposure, the consultant-as-witness problem, and counsel's role after signing. Chapter 8 closes with a one-page checklist counsel can take into the negotiation.

• The compliance consulting contract is a legal document with operational consequences. Counsel review before signing is structural, not optional.
• Privilege and work-product protection depend on why and at whose direction the work is done. The contract is where that is set up. Adding it later is harder and sometimes does not work.
• Scope that is specific, bounded and auditable separates contracts that protect the entity from contracts that expose it.
• The deliverable standards in the contract become the standards the entity uses to defend the work at audit. Vague standards produce vague defenses.
• Termination, transition and knowledge-transfer obligations keep the entity from becoming captive to the consultant.
• Standard-form indemnification and liability terms usually favor the consultant. Counsel renegotiates them to fit the entity's actual exposure.
• In enforcement, the consultant may become a witness. The contract should settle cooperation, confidentiality and privilege duties before that question becomes urgent.

Chapter 1

Why Counsel Should Be in the Consulting Contract

1.1 A Legal Document, Not a Purchase Order

A compliance consulting contract has legal consequences on several fronts at once. It either establishes privilege framing for the consultant's work or it does not. It allocates risk between the entity and the consultant for whatever problems the engagement produces. It defines what the entity is buying and what the consultant must deliver. It decides what happens if the entity needs to end the engagement early. Each of those is a legal question, and each needs counsel before the contract is signed.

Compliance teams routinely sign these contracts without real counsel review. The contract is treated as a procurement item, and the consultant's standard form goes out the door with a few edits. Later the entity discovers the contract did not cover something it needed, and by then the leverage to negotiate is gone.

1.2 When the Contract Gets Tested

The legal layer matters most in exactly the situations where the entity needs the consultant most: an enforcement matter that makes the consultant's prior work relevant, recommendations challenged at audit, an engagement that has to end early, or knowledge that has to move in-house before the consultant leaves. Each one exposes whatever the contract did or did not require.

1.3 A Small Investment Up Front

Counsel review before signing deals with the predictable problems while they can still be fixed. The investment is small: a few hours of attorney time, and a signed contract that reflects the entity's interests instead of the consultant's form. Our judgment is that programs that build this into every consulting engagement have markedly fewer problems across their engagement portfolio than programs that sign first and sort out the legal issues later.

Chapter 2

The Engagement Structure: Privilege and Agency Considerations

2.1 Why Structure Decides Protection

The engagement structure goes a long way toward deciding whether the consultant's work product, communications and analysis can be protected or will be produced. Two bodies of law do the work. The attorney-client privilege can reach a non-lawyer who helps counsel give legal advice. In United States v. Kovel, the Second Circuit held that what is vital is that the communication be made in confidence for the purpose of obtaining legal advice from the lawyer; if the advice sought is the consultant's own rather than the lawyer's, no privilege exists. The D.C. Circuit applied the same logic to internal investigations in In re Kellogg Brown & Root, holding that communications by and to non-attorneys serving as agents of attorneys are protected, and that the privilege applies so long as obtaining or providing legal advice was one of the significant purposes of the investigation, even when a regulation required it.

Work-product protection is the second layer. Federal Rule of Civil Procedure 26(b)(3) protects documents prepared in anticipation of litigation by or for a party or its representative, and the rule names a party's consultant expressly. FERC's own discovery rule, Rule 402(b), protects material prepared in anticipation of litigation unless the other side shows substantial need and that it cannot obtain substantially equivalent material by other means without undue hardship. Even when it orders that discovery, the presiding officer will prevent disclosure of an attorney's mental impressions, conclusions, opinions or legal theories. That matters here: if a NERC enforcement matter goes to a contested hearing, Appendix 4C, Attachment 2, Section 1.5.8 lets participants use the discovery methods in FERC Rules 402 through 409. Both protections are qualified. Work product can be reached on a showing of substantial need and undue hardship, and neither protection covers ordinary business work. In United States v. Adlman, the Second Circuit made the point directly: documents prepared in the ordinary course of business, or that would have been created in essentially similar form irrespective of the litigation, are not work product.

None of this is created by a label on the engagement letter. The purpose of the work, who directs it, and when it starts decide the question. The contract is where the entity sets those facts up deliberately. In our view, retrofitting privilege framing onto an engagement structured without it is much harder and sometimes does not work, because the purpose and direction of work already done cannot be changed after the fact.

2.2 The Direct Engagement Structure

In the direct structure, the entity engages the consultant, the consultant works under the entity's direction, and the work is generally not privileged. This suits routine compliance support that does not anticipate an enforcement matter. The advantage is simplicity. The cost is that the consultant's work product is ordinary business material: if an enforcement matter arrives, the entity will have little ground to withhold it. Every registered entity must provide NERC or the Compliance Enforcement Authority with the documents, data and information needed to monitor and enforce compliance (NERC Rules of Procedure Section 401.3; 18 C.F.R. § 39.2(d)).

2.3 The Counsel-Direction Structure

In the counsel-direction structure, counsel engages the consultant, or the consultant works under counsel's direction as counsel's agent, to help counsel analyze legal exposure and give legal advice. Built and run correctly, this structure gives the entity a sound basis to claim privilege and work-product protection over the consultant's analysis. It fits engagements tied to actual or anticipated enforcement matters, internal investigations conducted under privilege, and other legally sensitive work.

The paperwork has to say so explicitly: the agency relationship, the legal-advice purpose, the privilege framing, and the confidentiality duties that follow from it. The conduct has to match the paperwork. A consultant engaged through counsel who in practice takes direction from operations and delivers operational advice is, in our view, a weak basis for a privilege claim.

2.4 The Master Framework and the Conversion Mechanism

Programs that use the same consulting firm repeatedly benefit from a master engagement framework that sets the firm's standing arrangement with the entity. The framework typically uses the direct structure for routine work and includes a mechanism for moving a specific matter to the counsel-direction structure when a defined trigger occurs. The mechanism is the operational discipline that makes the arrangement work. Without it, the conversion happens well after the matter that needs it has begun, and by then the protection is at risk.

From the Practice

Purpose and direction, not labels, decide whether the consultant's work can be protected. The structure is set at contracting.

The direct structure suits routine work, and its work product is ordinary business material.

The counsel-direction structure suits matter-related work and gives the entity a basis to claim privilege and work-product protection, provided the conduct matches the paperwork.

A master framework carries both structures and a conversion mechanism. The mechanism is what makes it work in practice.

Chapter 3

Scope Definition: Specific, Bounded, Auditable

3.1 Why General Scope Hurts the Entity

Scope language is one of the most consequential parts of a compliance consulting contract and one of the most poorly drafted. Many contracts describe the scope broadly enough to cover almost anything the consultant might do. That helps the consultant, who can bill against an open scope, and hurts the entity, which cannot enforce specific deliverables, cannot push back when the consultant expands the work, and cannot defend the deliverables at audit against a clear baseline.

Effective scope language has three properties. It is specific about what the consultant will do. It is bounded about what the consultant will not do. And it is auditable: the scope can be tested against actual delivery, and any variance can be identified objectively. The consultant's form rarely does any of this.

3.2 Specific

Specificity covers the work itself. The contract names the compliance areas the engagement covers, the deliverables the consultant will produce, the timeline for each, and the quality standard each must meet. Compliance supplies the substance; counsel makes the language enforceable rather than aspirational.

3.3 Bounded and Auditable

Boundedness covers what the engagement does not include. The contract says plainly that the consultant is not engaged for matters outside the defined scope, that any expansion requires a written change order with a corresponding fee adjustment, and that the consultant's recommendations are limited to the defined scope. That protects the entity from consultant-driven scope creep, one of the patterns we see most often in compliance consulting.

From the Practice

A bounded scope with a written change-order requirement is the entity's main protection against scope creep.

Auditability covers how the entity will evaluate the engagement. The contract states how scope completion will be measured, how variances will be documented, and what counts as acceptable performance. The entity can then manage the engagement as it goes.

Chapter 4

Deliverable Standards and Audit Defensibility

4.1 Deliverables Become Evidence

Compliance consulting engagements produce material the entity relies on as part of its compliance posture: procedure documents, evidence frameworks, risk assessments, Mitigation Plans and training materials. Any of it may end up in front of an auditor, who will judge it on its merits without regard to the engagement that produced it. The contract should set standards that make the deliverables defensible at audit, not just acceptable to the entity on the day they arrive.

4.2 What Audit-Defensible Means

Audit-defensible deliverables are technically accurate at the level the Reliability Standard requires and executable by the entity's actual personnel. They are consistent with related deliverables, written in language that can be defended in front of a regulator without translation, and supported by the evidence the standard requires, preserved in a form the entity can produce on demand. None of that is automatic in a standard consulting contract. The contract has to require it.

Counsel and compliance both write these standards. Compliance specifies technical accuracy and executability. Counsel specifies language precision and audit defensibility. The consultant either accepts the standard or negotiates changes, and the negotiation is itself a signal about how the consultant thinks about quality. A consultant who resists clear deliverable standards is often telling you its deliverables would not have met them.

From the Practice

An acceptance protocol with a defined review period and explicit, documented acceptance keeps flawed deliverables from being accepted by default.

4.3 The Acceptance Protocol

The contract should also set a deliverable acceptance protocol. The entity has a defined period to review each deliverable and identify deficiencies. Deficiencies go through a defined remediation process. Acceptance is documented, and it never happens by default: the entity affirmatively records it. That protects the entity from a flawed deliverable the consultant later argues was accepted because nobody objected. The protocol is administrative, and it pays for itself the first time it is used.

Chapter 5

Termination, Transition, and Knowledge Transfer

5.1 Termination Rights

Termination provisions in standard consulting contracts often favor the consultant and push the entity toward a captive relationship. The entity may terminate only for cause, under a high standard, after long notice-and-cure periods. It may owe the full contract value regardless of what was delivered, with limited rights to use the work product afterward.

Effective termination provisions let the entity end the engagement without cause, on reasonable notice, owing only for work actually delivered through the termination date. The entity keeps full rights to use the work product after termination. Disputes about pre-termination work are resolved under a defined process that does not require the entity to keep the engagement running while the dispute plays out. Counsel should hold firm when the consultant resists; the alternative traps the entity in an engagement that has stopped producing value.

5.2 Transition Support

Transition provisions cover the end of the engagement, whether by termination or completion. The consultant should be obligated to support the entity's transition for a defined period afterward. That means handing over documentation, walking the entity through any frameworks the consultant introduced, and cooperating with a successor or the internal team. Without these provisions, the entity can end the engagement and find that the institutional knowledge left with the consultant and has to be rebuilt.

From the Practice

Knowledge transfer runs throughout the engagement, not just at the end. The contract obligation keeps the entity from becoming captive by default.

5.3 Knowledge Transfer Throughout

The consultant should keep a record of decisions, frameworks and reasoning in a form the entity can understand and use after the consultant leaves, and the transfer should happen throughout the engagement, not only at the end. This answers the pattern described in EC-WP-702, The Hidden Cost of Over-Staffed Support, where institutional knowledge ends up held in the heads of individual consultants who will not be on the next engagement. A contractual obligation keeps that dependency from developing as a by-product of the work.

Chapter 6

Indemnification, Insurance, and Allocation of Risk

6.1 What the Standard Form Usually Says

Standard compliance consulting contracts typically carry indemnification, limitation-of-liability and insurance terms that favor the consultant and shift to the entity risk that should sit with the consultant. The entity indemnifies the consultant against third-party claims. The consultant's liability is capped at a low multiple of the fee. The consultant's insurance is limited and may not reach the kinds of harm a compliance failure can cause.

6.2 What Counsel Should Negotiate

Counsel renegotiates these terms to fit the entity's real exposure. The consultant indemnifies the entity for breach of contract, professional negligence and misuse of confidential information. The liability cap rises to a level that reflects potential damages, often a multiple of fees well above the standard form. None of these are standard. Each is negotiable, and counsel should press for it.

6.3 Remedies for Inadequate Work

Risk allocation also has to deal with consultant work that turns out to be inadequate or wrong. The contract should define the consultant's responsibility for inadequate deliverables, and the remedies should include re-performance at the consultant's cost, damages for harm caused by reliance on the work, and termination rights if the inadequacy is material. Standard forms often disclaim all of it, leaving the entity to carry the cost of bad work it paid for.

From the Practice

Liability caps should reflect potential damages, not form defaults.

6.4 Insurance Terms

The contract should require the consultant to carry professional liability insurance with defined minimum limits that applies to the work being performed, with the entity as additional insured where the policy form allows it. It should require certificates of insurance and notice to the entity of any material change in coverage. These terms are routine to negotiate and very protective when a claim arises.

Chapter 7

The Consultant-as-Witness Question

7.1 How the Consultant Becomes a Witness

When an enforcement matter arises and the consultant has worked on the entity's compliance program, the consultant may become a witness. The consultant's knowledge, records, communications with the entity and work product can all become relevant. Material the entity holds falls within its obligation to give the Compliance Enforcement Authority the information needed to monitor and enforce compliance (NERC Rules of Procedure Section 401.3). If the matter goes to a contested hearing, participants can use the FERC discovery methods that Appendix 4C, Attachment 2, Section 1.5.8 adopts, including interrogatories, document requests and depositions. Under Section 1.5.8(b)(3), though, the Hearing Officer and Hearing Body can compel appearance or production only from a Participant or a Registered Entity, so hearing discovery cannot compel a consultant that is neither. That is why the cooperation clause is important. The consultant's posture then matters operationally: availability for interviews, willingness to work with the entity's defense, and how its people describe the work. The contract should settle this before a matter arises.

7.2 Cooperation Obligations

The contract should require the consultant to cooperate with the entity in any regulatory matter that involves the consultant's work. That means making personnel available for witness preparation and interviews, providing documentation on request, and supporting the entity's positions to the extent the consultant's actual knowledge supports them. The obligation should survive the end of the engagement for a defined period and include the consultant's reasonable best efforts to keep the people who did the work available. Without it, cooperation depends on the consultant's goodwill, and goodwill varies.

7.3 Confidentiality That Survives the Engagement

The consultant's duty to keep the entity's information confidential should continue indefinitely after the engagement ends. That keeps the consultant from becoming a source of information about the entity in later matters or in public. The obligation should be specific enough to enforce, with exceptions limited to legally compelled disclosure, and then only with prior notice to the entity.

Two regimes deserve naming in the clause. First, the NERC Rules of Procedure define Confidential Information in Section 1501 and set handling duties in Section 1500. Second, if the consultant will see BES Cyber System Information for high or medium impact BES Cyber Systems, the entity's CIP-011-3 information protection program governs that information for high and medium impact systems, and its CIP-004-7 Requirement R6 access management program governs provisioned access for high impact systems and medium impact systems with External Routable Connectivity. The contract should require the consultant to work within those programs. CIP-004-8 and CIP-011-4.1 are approved and subject to future enforcement on July 1, 2028, so contracts that run past that date should track the new versions.

7.4 Privilege Duties Under Counsel Direction

If the engagement was structured under counsel direction, the contract should bind the consultant to maintain the privilege framing, to assert privilege on the entity's behalf for communications that fall within it, and to coordinate with entity counsel on any privilege question. The consultant should not be allowed to disclose privileged work product on its own, even at a regulator's request, without the entity's consent or a binding order. A disclosure the entity did not authorize puts the protection at risk. Where a disclosure goes to FERC, Federal Rule of Evidence 502(a) limits how far a resulting waiver reaches in later federal or state proceedings, and 502(b) addresses inadvertent disclosure. These provisions protect the privilege architecture the engagement was structured to create.

From the Practice

The consultant may become a witness in an enforcement matter. Settle the consultant's duties in the contract before that becomes urgent.

Cooperation duties cover personnel availability, documents on request, and support for the entity's positions where the facts support them.

Privilege duties bind the consultant to maintain the framing, assert privilege for the entity, and make no independent disclosure of privileged work product.

Chapter 8

Counsel's Ongoing Role During the Engagement

8.1 Counsel Does Not Leave at Signing

Counsel's involvement in a compliance consulting engagement is often treated as a one-time event at contracting. The contract is signed, and counsel steps away until the next contract or until something goes wrong. That wastes what counsel can contribute and produces problems that earlier involvement would have prevented. The defensible model keeps counsel involved at defined points throughout the engagement.

8.2 Deliverable Review and Check-Ins

Counsel should review any deliverable with legal implications, particularly characterization documents, Mitigation Plans and self-assessment frameworks. Review at the deliverable stage is faster and more effective than review after a problem surfaces. It can be brief when the deliverable raises no concerns, and it leaves a documented checkpoint showing counsel saw and approved the work.

Counsel should also hold engagement-status check-ins on a defined cadence, especially for engagements that run longer than a few months. Each check-in asks whether the work is staying within scope, whether the consultant is performing as the contract requires, whether new legal issues have surfaced, and whether a change order or amendment is needed. The check-ins are light, and they stop the slow drift that sets in when counsel is absent between signing and the first problem.

8.3 Event Triggers

Counsel's role intensifies when specific events occur:

• The consultant's work surfaces a potential compliance issue.
• The regulator opens an inquiry that touches the consultant's work area.
• The entity prepares for an audit that will test the consultant's work product.
• The engagement approaches renewal or termination.

Each of these should be defined in advance as a counsel-engagement trigger and acted on consistently. Where a trigger points toward a possible enforcement matter, it is also the moment to use the conversion mechanism from Chapter 2. The structural choice is the same one that runs through the rest of the legal-compliance framework: counsel is integrated, not summoned.

8.4 The Checklist Counsel Brings to Signing

From the Practice

Counsel's role does not end at signing. The engagement needs legal oversight at defined trigger points.

Deliverable review, periodic check-ins and event-triggered review set the cadence. Each is light and prevents predictable problems.

Glossary

Glossary

Attorney-client privilege. Protection for confidential communications made for the purpose of obtaining or providing legal advice. It can extend to a non-lawyer who helps counsel give that advice.

Work-product protection. Qualified protection for material prepared because of anticipated litigation by or for a party or its representative, including a consultant. Ordinary business documents are not covered, and an opposing party can overcome it by showing substantial need and that it cannot obtain the substantial equivalent without undue hardship.

Kovel arrangement. Shorthand, from United States v. Kovel, for engaging a non-lawyer expert to help counsel give legal advice, so the expert's communications can be privileged.

Direct engagement structure. In this paper, an engagement contracted and directed by the entity for routine compliance support.

Counsel-direction structure. In this paper, a consulting engagement in which the consultant works for or under the direction of counsel, as counsel's agent, to support legal advice on an actual or anticipated matter.

Conversion mechanism. In this paper, the clause in a master framework that moves a matter to the counsel-direction structure when a defined trigger occurs.

Compliance Enforcement Authority (CEA). NERC or the Regional Entity in their respective roles of monitoring and enforcing compliance with the NERC Reliability Standards (NERC Rules of Procedure, Appendix 2).

Notice of Penalty. A notice prepared by NERC and filed with FERC, following approval by NERC of a Notice or other notification of Confirmed Violation or a settlement agreement, stating the penalty or sanction imposed or agreed to (NERC Rules of Procedure, Appendix 2).

Mitigation Plan. An action plan developed by the registered entity to correct a noncompliance with a Reliability Standard and prevent its recurrence (NERC Rules of Procedure, Appendix 2).

Confidential Information. The categories of protected information defined in Section 1501 of the NERC Rules of Procedure, including Critical Energy Infrastructure Information and Critical Electric Infrastructure Information.

BES Cyber System Information (BCSI). Information about BES Cyber Systems protected under CIP-011-3, with access managed under CIP-004-7 Requirement R6.

Additional insured. A party other than the policyholder added to a policy so it can claim coverage.

How Energy Compliance Can Help

How Energy Compliance Can Help

A consulting contract that protects the entity is the starting point. The work done under it still has to hold up. Energy Compliance, Inc. and Stich Angell, P.A. work as one team, so the privilege structure, the scope and the deliverable standards are set up together and run together.

Integrated legal-compliance services

Through the Legal Series practice, Energy Compliance and Stich Angell support registered entities across the full enforcement lifecycle. Every engagement is led by a named senior practitioner on the compliance side and by a named partner at Stich Angell on the legal side. Integrated legal-compliance services include, but are not limited to:

• Notice of Penalty response strategy and execution
• Internal investigation conducted under privilege
• Document production and privilege log management
• Witness preparation for Regional Entity interviews
• Settlement negotiation with Regional Entity counsel
• Self-Report drafting and legal review
• FERC submission preparation and review
• Legal-compliance operating framework design
• Counsel-led after-action review and lessons integration

The practice is organized in four areas. Enforcement Defense: Notice of Penalty response and settlement strategy. Privilege Counsel: internal investigation and document production under privilege. Regulatory Advisory: FERC submissions and engagement with Regional Entity counsel. Legal-Compliance Integration: operating frameworks built before enforcement arrives. Each engagement is scoped to the entity's role, function, regulatory posture, and the procedural stage of the matter.

Compliance services that fit this paper

• Compliance program management. Scope, deliverable standards and knowledge transfer written into the work from the first day, with the program owned inside the entity.
• Audit defense. Preparation and support when consultant-built procedures and evidence are tested at audit.
• RSAW production. Reliability Standard Audit Worksheets drafted to the deliverable standards in Chapter 4.

WattOps Compliance

WattOps Compliance is EC's NERC compliance evidence platform (wattopscompliance.com). It keeps the evidence behind a consultant's deliverables in a form the entity can produce on demand, which is the evidence standard Chapter 4 asks the contract to require. EC will run one standard at one facility through WattOps at no cost (CIP standards excluded).

RenewOps

RenewOps is EC's renewable operations monitoring and analytics platform, with a Data Center module. For renewable, storage and data center operators whose consultants rely on operations data, it keeps that monitoring and analytics work with the entity when the engagement ends.

Contact

If your next consulting contract is on someone's desk, send it to us before it is signed. We will tell you what it protects and what it leaves open.

Website: energycomplianceinc.com · Email: [email protected]

Phone: 763.438.4427

About the Author

About the Author

Rob Smith is the Founder and Principal of Energy Compliance, Inc., with more than thirty years in the industry on every side of the system. He began in control-room operations as a Reliability Coordinator, Transmission Operator, and Power System Operator across RTO/ISO and utility control centers. On the regulator side, he was a senior compliance auditor and subject matter expert for NERC Reliability Standards. He audited grid facilities, evaluated mitigation adequacy, participated in risk-based oversight of utility mitigation activities, and supported the development of violation notifications and settlements in FERC-directed enforcement actions. He conducted a regulatory audit in the Sultanate of Oman against the Sultanate's Sector Law and Grid Code.

He founded Energy Compliance, Inc. to deliver senior regulator-side compliance authority without the layered staffing and billable-hour overhead of larger firms.

Education: MBA, Energy Management, University of Mary; MSL, Compliance Law, Fordham Law University; BAS, Energy Management, Bismarck State College; BAS, Mechanical Engineering, Metallurgy minor, University of Florida; BAS, Criminology, St. Petersburg College (State Law Enforcement Certification); AAS, Power Plant Technology, Bismarck State College; AAS, Electrical Transmission System Technology, Bismarck State College.

Certifications: NERC Lead Auditor training; previously NERC-certified at the Reliability Coordinator level; 1st Class A Boiler Engineer License, Minnesota.

Co-author: Cara C. Passaro, Stich Angell, P.A.

Cara C. Passaro is Shareholder and Firm President at Stich Angell, P.A. She has represented clients throughout the upper Midwest since 2001, is licensed to practice in the Minnesota and North Dakota state and federal courts, and is recognized as a Super Lawyer. Her practice covers construction, premises liability, products liability, transportation and energy compliance representation, and her representative cases include decisions of the Minnesota Supreme Court and the Minnesota Court of Appeals. Cara serves as the named legal author of the Energy Compliance, Inc. Legal Series and is the partner engagement lead for the Stich Angell side of the integrated practice.

About Energy Compliance, Inc.

About Energy Compliance, Inc.

Energy Compliance, Inc. is an independent consulting and advisory firm based in Bloomington, Minnesota, focused exclusively on electric reliability, cybersecurity reliability, and regulatory compliance for organizations connected to the North American Bulk Electric System.

Our work supports registered entities, including Generator Owners and Operators, Transmission Owners and Operators, Reliability Coordinators, Balancing Authorities, and Distribution Providers, across NERC Reliability Standards, FERC orders, RTO/ISO market participation rules, Regional Entity oversight, and state regulatory frameworks.

Energy Compliance partners with Stich Angell, P.A. for legal matters arising in the NERC enforcement lifecycle, including Notice of Penalty response, settlement negotiation, internal investigation under privilege, and the integrated legal-compliance operating frameworks registered entities need before enforcement arrives. Defensible Compliance. Disciplined Defense. The integrated practice replaces the sequential model in which compliance and legal engage separately and meet only after a matter has escalated.

Engagements are overseen by a senior practitioner on the compliance side and by a named partner on the legal side. We do not staff for billable hours. We staff for outcomes. Our deliverables are written to be operationally executable and audit-defensible, not to manufacture activity.

Energy Compliance is not affiliated with, sponsored by, or endorsed by the North American Electric Reliability Corporation, the Federal Energy Regulatory Commission, or any Regional Entity.

About Stich Angell, P.A.

Stich Angell, P.A. is a full-service civil litigation firm. Since 1971, its lawyers have represented businesses, individuals and organizations across a broad range of civil practice areas, including products liability, construction, transportation, professional negligence, insurance law and appellate practice. Its civil trial attorneys are among the most highly respected in Minnesota, and although it is a Minnesota firm, it represents clients throughout the country. Stich Angell has extended its civil litigation practice into energy compliance representation, including NERC and FERC enforcement matters, in partnership with Energy Compliance, Inc.

Stich Angell, P.A. is located in Bloomington, Minnesota, and can be reached at (612) 333-6251 or at stichlaw.com. To engage the integrated legal-compliance practice, contact Energy Compliance, Inc. at 763.438.4427 or Stich Angell at (612) 333-6251.

Sources and Authorities

Sources and Authorities

• Federal Power Act § 215, 16 U.S.C. § 824o, Electric Reliability (Legal Information Institute). https://www.law.cornell.edu/uscode/text/16/824o
• 18 C.F.R. § 39.2, Jurisdiction and applicability (eCFR, accessed October 25, 2026). https://www.ecfr.gov/current/title-18/chapter-I/subchapter-B/part-39/section-39.2
• 18 C.F.R. § 39.7, Enforcement of Reliability Standards (eCFR, accessed October 25, 2026). https://www.ecfr.gov/current/title-18/chapter-I/subchapter-B/part-39/section-39.7
• 18 C.F.R. § 385.402, Scope of discovery (FERC Rule 402) (eCFR, accessed October 25, 2026). https://www.ecfr.gov/current/title-18/chapter-I/subchapter-X/part-385/subpart-D/section-385.402
• North American Electric Reliability Corporation, Rules of Procedure, effective November 28, 2023, Section 401.3 (Data Access) and Section 1500 (Confidential Information). https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/nerc-rop.pdf
• NERC Rules of Procedure, Appendix 2, Definitions Used in the Rules of Procedure, effective June 27, 2024. https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/appendix-2.pdf
• NERC Rules of Procedure, Appendix 4C, Compliance Monitoring and Enforcement Program, effective May 19, 2022, including Attachment 2, Hearing Procedures, Section 1.5.8. https://www.nerc.com/globalassets/who-we-are/rules-of-procedure/appendix-4c.pdf
• NERC Reliability Standard CIP-004-7, Cyber Security, Personnel & Training (effective January 1, 2024). https://www.nerc.com/globalassets/standards/reliability-standards/cip/cip-004-7.pdf
• NERC Reliability Standard CIP-011-3, Cyber Security, Information Protection (effective January 1, 2024). https://www.nerc.com/globalassets/standards/reliability-standards/cip/cip-011-3.pdf
• NERC, Reliability Standards, CIP family listing (CIP-004-8 and CIP-011-4.1 subject to future enforcement July 1, 2028), accessed October 25, 2026. https://www.nerc.com/standards/reliability-standards/cip
• Federal Rule of Civil Procedure 26, Duty to Disclose; General Provisions Governing Discovery, including Rule 26(b)(3) (Legal Information Institute). https://www.law.cornell.edu/rules/frcp/rule_26
• Federal Rule of Evidence 502, Attorney-Client Privilege and Work Product; Limitations on Waiver (Legal Information Institute). https://www.law.cornell.edu/rules/fre/rule_502
• United States v. Kovel, 296 F.2d 918 (2d Cir. 1961) (Caselaw Access Project). https://static.case.law/f2d/296/cases/0918-01.json
• In re Kellogg Brown & Root, Inc., 756 F.3d 754 (D.C. Cir. 2014) (Caselaw Access Project). https://static.case.law/f3d/756/cases/0754-01.json
• United States v. Adlman, 134 F.3d 1194 (2d Cir. 1998) (Caselaw Access Project). https://static.case.law/f3d/134/cases/1194-01.json
• Energy Compliance, Inc., EC-WP-702, The Hidden Cost of Over-Staffed Support.
• Stich Angell, P.A., Cara C. Passaro attorney profile, accessed October 25, 2026. https://stichlaw.com/cara-c-passaro/
• Stich Angell, P.A., About Us, accessed October 25, 2026. https://stichlaw.com/about-us/
• Stich Angell, P.A., Expertise, accessed October 25, 2026. https://stichlaw.com/expertise/