WIXLIB

Compliance Audit ReportCompliance Operations and Planning (FERC Order 693)CPS EnergyNERC ID # NCR04038Public VersionConfidential Information (Including Privileged andCritical Energy Infrastructure Information)Has Been RemovedLead Region:Texas Reliability Entity, Inc. (Texas RE)Audit Dates:March 16, 2015 - March 19, 2015Audit Location:Texas Reliability Entity, Inc. offices, Austin, TXReport Date:May 15, 2015Prepared By:Audit Team LeaderJurisdiction:United StatesPossible Violations Identified: None805 Las Cimas Parkway, Suite 200Austin, Texas 78746Tel: 512. 583.4900TEM 10.0.6

Confidential Information(Including Privileged and Critical Energy Infrastructure Information)Has Been RemovedTABLE OF CONTENTS1.0Executive Summary . 32.0Audit Process . 42.1Objectives . 42.2Scope . 42.3Confidentiality and Conflict of Interest . 52.4Methodology . 52.5Company Profile . 52.6Audit Specifics . 62.7Audit Participants . 63.0Audit Results . 73.1Audit Findings . 73.2Other Findings . 84.0Areas of Concern and Recommendations . 85.0Compliance Culture . 8Page 2 of 9CPS Energy Compliance Audit Report 3/16/2015 - 3/19/2015Date of Report: May 15, 2015

Confidential Information(Including Privileged and Critical Energy Infrastructure Information)Has Been Removed1.0EXECUTIVE SUMMARYTexas Reliability Entity, Inc. (Texas RE) conducted an audit with CPS Energy, NCR04038. The offsite compliance audit was conducted from March 16 - 19, 2015. At the time of the audit, CPS Energywas registered for the functions of Generator Owner (GO) and Generator Operator (GOP). The NorthAmerican Electric Reliability Corporation (NERC) Reliability Standards that were selected through theappropriate Electric Reliability Organization (ERO) processes for 2015 were reviewed based on CPSEnergy’s registration as a GO and GOP and the associated risks of a GO and GOP. AdditionalReliability Standards or additional Requirements within the Reliability Standards were added to theaudit scope based upon the judgment of Texas RE.The charter (or objective) of the audit was to evaluate the set of tools and resources available to controlroom operators for monitoring system operations and status including examining the entity'scommunication performance for accuracy and timing in comparison to actual capability and status.The audit team assessed CPS Energy’s compliance with NERC Standards and Requirements that bestapply to two interconnection-wide risk elements: Monitoring and Situational Awareness, andOperational Communication. These two risk elements were selected by Texas RE from a larger list ofknown risk areas by associating risk elements’ cause and effect with functional registrations and NERCStandards. CPS Energy’s functional registration, configuration, inherent risk, and internal controlswere analyzed to adjust the final scope to fit the specific characteristics of CPS Energy with respect tothe two selected risk elements. The audit team determined that the audit charter was fulfilled, and nosignificant concerns were found with respect to CPS Energy. The various emergency plans,communication protocols, training, situational awareness tools, procedures, interviews andcoordination protocols reviewed by the audit team indicated a managed and controlled approach withrespect to the two risk elements. A complete results discussion is included in the Findings sectionbelow.All references to the CIP audit as part of this engagement have been redacted from the public versionof this report.The audit team consisted of seven representatives from Texas RE. The audit team reviewed theevidence and documentation provided by CPS Energy and conducted interviews with CPS Energy’spersonnel to assess compliance with selected Standards applicable to CPS Energy at this time.There were a total of six NERC Reliability Standards included in the Compliance Operations andPlanning scope of the audit consisting of 11 Requirements.The audit team evaluated CPS Energy for compliance with 12 Requirements based on the 2015 EROCompliance Monitoring and Enforcement Program (CMEP) Implementation Plan and the associatedcompliance processes. The team assessed compliance with the NERC Reliability Standards for thefollowing periods summarized in Table 1 2-2.1bTOP-006-2VAR-002-3Page 3 of 9Table 1: Summary of Audit Scope PeriodsStart of Audit PeriodEnd of Audit 20143/19/2015CPS Energy Compliance Audit Report 3/16/2015 - 3/19/2015Date of Report: May 15, 2015

Confidential Information(Including Privileged and Critical Energy Infrastructure Information)Has Been RemovedCPS Energy submitted evidence for the team’s evaluation of compliance with Requirements. The teamreviewed and evaluated all evidence provided to assess compliance with Reliability Standards selectedas applicable to CPS Energy for this audit.Based on the evidence provided, no findings were noted for the Compliance Operations and PlanningStandards and applicable Requirements within the scope of this audit.The team notified CPS Energy of 2 recommendations.There were no open or recently completed mitigation plans for the NERC registered functions includedin the scope of this audit. Therefore, none were reviewed by the audit team.The Texas RE audit team lead certifies the audit team adhered to all applicable requirements of theNERC Rules of Procedure (ROP).2.0AUDIT PROCESSThe compliance audit process is detailed in the NERC ROP and the 2015 ERO CMEP ImplementationPlan, available at www.nerc.com. The NERC CMEP generally conforms to the United StatesGovernment Accountability Office (GAO) – Generally Accepted Government Auditing Standards(GAGAS).2.1ObjectivesAll registered entities are subject to audit for compliance with all Reliability Standards applicable to thefunctions for which the registered entity is registered.1 The audit objectives are: Independently review CPS Energy’s compliance with the Requirements of the NERC ReliabilityStandards that were selected as applicable to CPS Energy based on CPS Energy’s registeredfunctions included in the scope of this audit Validate compliance with applicable NERC Reliability Standards from the 2015 ERO CMEPImplementation Plan and associated compliance processes Evaluate how CPS Energy addressed the risk elements associated with this audit’s charter Validate evidence of self-reported violations and previous self-certifications, confirmcompliance with other Requirements of the NERC Reliability Standards, and review the statusof associated mitigation plans Observe and document CPS Energy’s compliance culture Review the status of open mitigation plans2.2ScopeThe scope of this NERC compliance audit included the NERC Reliability Standards from the 2015 EROCMEP Implementation Plan and associated compliance processes. The Standards and Requirementsin scope for this audit are listed in Table 2 below:Table 2: Compliance Operations and Planning Audit ScopeStandardsRequirementsEOP-005-2R151NERC CMEP, paragraph 3.1, Compliance Audits.Page 4 of 9CPS Energy Compliance Audit Report 3/16/2015 - 3/19/2015Date of Report: May 15, 2015

Confidential Information(Including Privileged and Critical Energy Infrastructure Information)Has Been AR-002-32.3R2, R3, R5R3, R6, R7R3, R14R1R2Confidentiality and Conflict of InterestConfidentiality agreements and code of conduct documentation for the Regional Entity staff aregoverned by Texas RE’s Delegation Agreement with NERC and Section 1500 of the NERC ROP. CPSEnergy was informed of Texas RE’s obligations and responsibilities under the agreement andprocedures. The work history for each audit team member was provided to CPS Energy, who wasgiven an opportunity to object to a team member’s participation on the basis of a possible conflict ofinterest or the existence of other circumstances that could interfere with an audit team member’simpartial performance of duties. CPS Energy had not submitted any objections by the stated objectiondue date and accepted the audit team member participants without objection. There were no denialsor access limitations placed upon this audit team by CPS Energy.2.4MethodologyOnce an audit date was set by Texas RE, CPS Energy was sent an audit notification package and theReliability Standard Audit Work Sheets (RSAWs) for the NERC Standards determined to be in scope.CPS Energy provided pre-audit evidence at the time requested, or as agreed upon, by Texas RE.Additional evidence could be submitted until the agreed-upon deadline prior to the exit briefing. Afterthat date, only data or information that was relevant to the content of the report or its finding could besubmitted with the agreement of the audit team lead.The audit team reviewed the documentation provided by CPS Energy and requested additionalevidence and sought clarification from subject matter experts (SMEs) during the audit. Evidencesubmitted in the form of policies, procedures, emails, logs, studies, data sheets, etc. were validated,substantiated, and cross-checked for accuracy as appropriate. Where sampling is applicable to aRequirement, the sample set was determined by a specific methodology, along with professionaljudgment.Findings were based on the facts and documentation reviewed by the audit team, the team’sknowledge of the Bulk Electric System (BES), the NERC Reliability Standards, and professionaljudgment. All findings were developed based upon the consensus of the team.The audit team verbally shared its preliminary results with CPS Energy’s management. The audit teamconducted an exit briefing immediately following the audit with CPS Energy.2.5Company ProfileCPS Energy is the nation’s largest municipally-owned energy utility providing both natural gas andelectric service. CPS Energy was acquired by the City of San Antonio in 1942 and serves more than741,000 electric customers and 331,000 natural gas customers in and around the seventh-largest cityin the nation. CPS Energy has a 1,514-square-mile service area and serves customers in BexarCounty and portions of Atascosa, Bandera, Comal, Guadalupe, Kendall, Medina, and Wilson Counties.Page 5 of 9CPS Energy Compliance Audit Report 3/16/2015 - 3/19/2015Date of Report: May 15, 2015