4/20/2020 Understanding Enterprise Risk Management for Utilities © Copyright 2007, CCRO. All rights reserved. 19 of systems so that in the event of a specific attack on the system, the transmission operator will repair and restore service as soon as possible. Transmission operators, and subsequently control area operators, are regulated by both the FERC and their regional energy reliability councils. FERC is responsible for regulating market practices that include the rates that can be charged for the various control area services, which are known as ancillary services. The NERC regions are responsible for setting the guidelines by which these systems must operate, and the related fines and penalties for their failure to comply. On the operations side, if a utility does not operate their control area efficiently and economically, they will not earn an adequate rate of return, while at the same time could also face penalties for inappropriate operations. Finally, there are operational risks associated with utilities that own and operate generation assets. For most of these utilities, the costs to run these plants are embedded in their revenue requirements. If forced outages or variable and fixed O&M costs are more than expected, the company may not earn its allowed rate of return. Some regulatory authorities incentivize utilities to operate their plants efficiently through rate mechanisms known as Incentive Rate making, where cost savings are shared between ratepayers and utilities. Unfortunately, not all utilities have this option, which places those who don’t in the unenviable position of having to pass on any costs savings to the customer while at the same time absorbing cost overruns. Some regulators allow for recovery of catastrophic failure of assets, but only if the utility can prove in hindsight that all operations were executed within industry best practices and that the most effective remediation options were employed. This paradigm requires utilities to be diligent about operations while they optimize margin. Operational Risk Operational risks are associated with inadequate or failed internal processes, people, and systems. Ultimately a utility is responsible for hedging all risks on customers’ behalf by exercising best practices for supply management, asset operation and risk mitigation to maintain a reliable and low cost supply of energy. As such, a measure of a utility’s competency at anticipating these risks is an effective hedging strategy. Without pass-through options, a utility is driven to hedge against possible extreme cases. A good operational risk strategy is regulatory recovery, whereby a partnership between a utility and their regulatory authority allows for ways to mitigate risks and options to recoup costs should they materialize. If, for example, processes and procedures are not followed, investments are poorly made, supporting information is not collected, or individuals overlook tasks assigned, the costs incurred may be disallowed. The possibility exists that a utility’s costs could far exceed their expectations, leading to increased scrutiny on the part of the regulators. Adding to this concern is a utility’s need to address safety risk. Utilities operate in an environment that plays host to a critical network of generation, transmission and distribution systems, where a temporary lapse of employee attention can have catastrophic implications for the employees as well as individuals and the infrastructure within the surrounding community.