Utilities are the industry where the regulator sets the price, the public cannot refuse the product, and a failure of the asset can start a wildfire, freeze a city or black out a region. Internal audit’s job is shaped by all three. The revenue the company may earn is decided in a rate case in which every dollar of cost must be shown to have been prudently incurred, which makes cost accounting and capital project records regulatory evidence rather than management information. The reliability of the grid and the safety of the pipeline are governed by mandatory standards with penalties measured per day of violation, enforced by auditors from the reliability organization and the state commission who read internal audit’s work. And the assets (generation, transmission, distribution, pipelines, dams, substations) are run by operational technology that was designed before anyone imagined it would be attacked, by a workforce whose safety is itself a regulated outcome.
This guide explains how the function works at electric, gas and water utilities and the energy companies around them: why utility audit is different, the regulatory frame, the capital program, reliability and operational technology, trading and fuel procurement, customers and programs, the shape of the universe, how regulators use internal audit, what the audit committee sees, careers and pay, the failures that recur, and a worked example from Larkspur Energy, the investor-owned electric and gas utility used in the energy examples on this site. The capital projects guide covers the construction audits that dominate a utility’s plan, and the manufacturing guide the operational technology security that utilities share with plants.
In this guide
- Why utility internal audit is different
- The regulatory frame
- Rate cases, regulatory accounting and prudence
- The capital program that is the business
- Reliability, NERC and critical infrastructure protection
- Pipeline, dam, nuclear and wildfire safety
- Operational technology and physical security
- Energy trading, fuel and power procurement
- Customers, billing and programs
- The shape of a utility’s audit universe
- How regulators and NERC auditors use internal audit’s work
- What goes to the audit committee
- Careers and pay in utility internal audit
- Failures that recur
- A worked example: Larkspur Energy’s FY26 audit year
- Questions about internal audit in energy and utilities
- Related guides
Why utility internal audit is different
Six features shape the function. Regulated revenue: a utility earns an allowed return on the capital it has prudently invested (the rate base) plus recovery of prudent operating costs, set by a state commission in rate cases and by FERC for transmission and wholesale, so that the classification of a cost between capital and expense, between affiliates, and between jurisdictions is a revenue decision, and regulatory accounting (ASC 980) creates assets and liabilities that exist only because a regulator promised future recovery or refund. Mandatory reliability standards: since the Energy Policy Act of 2005 made the North American Electric Reliability Corporation the electric reliability organization (certified by FERC in 2006), the reliability standards and the critical infrastructure protection standards are enforceable with penalties that can exceed a million dollars a day per violation, and the compliance program is audited by regional entities on a cycle. Safety as the product: gas pipeline integrity, dam safety, nuclear safety, wildfire mitigation and worker safety are regulated outcomes whose failure is catastrophic and criminal in the worst cases. Capital intensity: a utility spends its depreciation and more every year on the system, so capital projects are the business and their records are rate case evidence. Operational technology: the grid and the pipeline are run by control systems that are now targets of nation-state actors. Public and political visibility: rates, outages, storms and environmental decisions are matters of public debate, with consumer advocates and intervenors who read the utility’s filings closely. The function that fits combines regulatory accounting knowledge, engineering literacy, cybersecurity skill and the capital project audit discipline, and it works beside a compliance function built around NERC and the commission.
The regulatory frame
| Regime | Who it reaches | What it requires | Internal audit’s angle |
|---|---|---|---|
| State public utility commissions | Retail electric, gas and water utilities | Rate cases and cost of service; prudence of costs; service quality and reliability metrics; integrated resource plans; affiliate transaction rules; customer protections; storm cost recovery; wildfire mitigation plans in western states | Audit the cost records, allocations and project files that become rate case evidence; prudence review readiness |
| FERC | Interstate transmission, wholesale power and gas pipelines; holding companies | Uniform System of Accounts (18 CFR Part 101); formula rates and transmission rate filings; Standards of Conduct separating transmission from marketing functions; market manipulation rules; hydroelectric licensing and dam safety; approval of mergers and affiliate arrangements | Audit USofA compliance, formula rate inputs and Standards of Conduct controls |
| NERC reliability standards and CIP (enforced through regional entities) | Registered entities: transmission owners and operators, generator owners and operators, balancing authorities, distribution providers above thresholds | Operations and planning standards (vegetation management, protection systems, cold weather preparedness, emergency operations) and critical infrastructure protection standards CIP-002 to CIP-015 (asset categorization, security management, personnel, electronic and physical perimeters, systems security, incident response, recovery, configuration and vulnerability management, information protection, supply chain, physical security of key substations, internal network security monitoring) | Audit the compliance program, evidence quality and self-reporting; CIP controls in depth |
| TSA pipeline security directives (since 2021, renewed annually) | Critical pipeline owners and operators | Cybersecurity implementation plans, incident reporting to CISA within 24 hours, assessments, architecture requirements | Audit the implementation plan’s operation |
| PHMSA (pipeline safety) | Gas transmission and distribution; hazardous liquid pipelines | Integrity management programs (transmission and distribution), operator qualification, the gas transmission rules expanded between 2019 and 2022, damage prevention, leak detection and repair rules | Audit integrity management records, inspections and repair timeliness |
| Nuclear Regulatory Commission | Nuclear plant licensees | Quality assurance (10 CFR 50 Appendix B), cybersecurity (10 CFR 73.54), security, emergency preparedness, reactor oversight process | Nuclear oversight is largely a licensed QA function; internal audit covers the business side and coordinates |
| Environmental: EPA and state agencies | Generation, pipelines, operations | Clean Air Act permits and emissions monitoring, coal combustion residuals, water discharge, greenhouse gas reporting, remediation obligations | Audit monitoring data integrity and permit compliance |
| Wildfire regimes (California and other western states) | Electric utilities in high-risk areas | Wildfire mitigation plans approved by the state; vegetation management, system hardening, public safety power shutoff protocols, inspections | Audit plan execution and inspection records; the liability is existential |
| Market rules (ISOs and RTOs; CFTC) | Participants in organized wholesale markets; traders | Market participation rules, settlements, credit requirements; derivatives rules | Audit trading controls and settlements |
| SOX and SEC rules (listed utilities) | Public holding companies | ICFR; cyber incident disclosure; climate disclosures as applicable | The SOX program with regulatory accounting at its core |
| Tax and incentive rules | Renewable developers and owners | Investment and production tax credits with changing eligibility and phase-outs under 2022 and 2025 federal legislation; prevailing wage and domestic content requirements | Audit credit qualification documentation |
Rate cases, regulatory accounting and prudence
A rate case sets the revenue requirement: operating expenses plus depreciation plus taxes plus a return (the allowed rate of return times the rate base, which is the depreciated original cost of plant in service plus working capital less deferred taxes and contributions). Every component is contested by commission staff and intervenors, and the utility bears the burden of showing costs were prudently incurred. For internal audit this creates a permanent engagement: the cost records that will be filed (plant accounting under the Uniform System of Accounts, retirement units, the capitalization policy, allowance for funds used during construction, depreciation studies), the allocations that divide costs between jurisdictions, customer classes, regulated and unregulated affiliates and holding company services (the cost allocation manual and the affiliate rules that forbid cross-subsidy), the regulatory assets and liabilities under ASC 980 (deferred storm costs, deferred fuel, environmental remediation, decommissioning, rate refunds) whose recognition depends on the probability of recovery, the riders and trackers that recover specific costs outside the base rate (fuel clauses, energy efficiency, storm securitization) with their own true-ups and audits, and the project files that will be examined in a prudence review years after the spending, where the question is whether a reasonable utility manager would have made the decision with the information available at the time. The audit tests classification and capitalization against policy and the USofA, allocation methodology and its consistent application, affiliate charges against the manual and the commission’s rules, regulatory asset support and the probability assessments, tracker true-ups, and the documentation of major decisions (the contemporaneous record of alternatives considered and reasons, which is what prudence reviews read). The fixed assets guide covers plant accounting generally and the financial close guide the close that regulatory accounting complicates.
The capital program that is the business
Utilities spend more on capital than almost any other industry relative to revenue: grid modernization, substation and line replacement, undergrounding and hardening, renewable generation and storage, gas main replacement, smart meters, and the information systems behind them, often funded in part by federal infrastructure programs and recovered through rate base over decades. The capital program is therefore the center of the audit universe. Program-level audits test portfolio governance (the capital plan’s approval, prioritization against risk models, the budget-to-actual by program, the reallocation of funds between projects), project estimating and approval (stage gates, estimate classes, contingency), and the processes that every project shares (procurement of engineering and construction services under master agreements, unit-cost contracts for distribution work, materials management and the transformer and switchgear supply constraints of recent years, construction management and inspection, work order closing and unitization to plant accounts, which is where capital becomes rate base). Project-level audits follow the capital projects guide’s program (change orders, pay applications, cost-plus billing, schedule, closeout) with the utility-specific additions of AFUDC, retirement accounting and the prudence record. The recurring findings are work orders left open for years (delaying depreciation and distorting rate base), unitization errors, contractor billing under unit-cost contracts for units not installed, and project files that would not survive a prudence review.
Reliability, NERC and critical infrastructure protection
Registered entities must comply with NERC’s reliability standards and demonstrate compliance to their regional entity through periodic audits, spot checks and self-certifications, with self-reporting of violations expected and credited. The operations and planning standards cover protection system maintenance, vegetation management near transmission lines (FAC-003), facility ratings, emergency operations, and, since the Winter Storm Uri outages of February 2021, cold weather preparedness and generator winterization (the EOP-012 series). The CIP standards are the cybersecurity program for the bulk electric system: CIP-002 categorizes cyber systems by impact, CIP-003 covers low-impact systems and policy, CIP-004 personnel and training, CIP-005 electronic security perimeters and remote access, CIP-006 physical security of cyber systems, CIP-007 systems security management (ports, patching, malware, logging, credentials), CIP-008 incident response, CIP-009 recovery, CIP-010 configuration change management and vulnerability assessment, CIP-011 information protection, CIP-012 control center communications, CIP-013 supply chain risk management (effective 2020), CIP-014 physical security of critical transmission stations, and CIP-015 internal network security monitoring, approved by FERC in Order No. 907 on 26 June 2025 with compliance for control centers beginning three years after its September 2025 effective date and other entities two years later, and with FERC directing an extension to electronic access control and physical access control systems. A utility’s NERC compliance function owns the program (evidence collection, internal controls, self-certifications, the audit relationship); internal audit assesses the program’s effectiveness and tests the controls behind the evidence, which is where the gap usually is: evidence that demonstrates compliance at a point in time, produced for the auditor, over controls that do not operate between audits. The cybersecurity programs, vulnerability management and incident response guides give the testing methods the CIP standards’ requirements map to.
| CIP standard | Subject | What internal audit tests beyond the compliance evidence |
|---|---|---|
| CIP-002 | Categorization of BES cyber systems by impact | Completeness of the asset inventory against network discovery; categorization decisions documented and reviewed after changes |
| CIP-004 | Personnel risk assessments, training, access management and revocation | Revocation within 24 hours tested against HR terminations and badge data; access reviews substantive |
| CIP-005 | Electronic security perimeters; interactive remote access | Firewall rule bases reviewed against documented need; remote access through intermediate systems with multifactor authentication; vendor access |
| CIP-007 | Ports and services, patching, malware prevention, logging, account management | Patch evaluation within 35 days and mitigation plans operating; logs reviewed; shared and default accounts governed |
| CIP-008 and CIP-009 | Incident response and recovery plans | Plans exercised; lessons learned implemented; backups tested |
| CIP-010 | Configuration baselines, change management, vulnerability assessments | Baseline deviations detected; changes authorized and tested; transient devices controlled |
| CIP-013 | Supply chain cyber risk management for BES cyber systems | Vendor assessments performed before procurement; contract terms; vendor remote access and notification |
| CIP-014 | Physical security of critical transmission stations | Risk assessments and third-party verification; security plan implementation after the 2022 substation attacks |
| CIP-015 | Internal network security monitoring (compliance from 2028 for control centers) | Implementation plan and the monitoring, retention and protection controls as they are built |
Pipeline, dam, nuclear and wildfire safety
Safety regimes are where a utility’s compliance failures become catastrophes, and internal audit’s role is to test the programs that engineers run. Gas pipeline safety under PHMSA requires integrity management programs for transmission (high-consequence area identification, assessment and reassessment intervals, repair criteria) and distribution (risk-based programs for mains and services, with the aging cast iron and bare steel inventories that drive main replacement), operator qualification, damage prevention (locating and marking), leak surveys and repair, and recordkeeping that must be traceable, verifiable and complete; the audit tests the records and the timeliness of assessments and repairs against the rules. Dam safety under FERC’s hydro licensing requires inspections, emergency action plans and remediation. Nuclear safety is run by a licensed quality assurance function under the NRC’s oversight process, and internal audit’s role is coordination and coverage of the business processes around the plant. Wildfire mitigation, following the 2018 Camp Fire that drove PG&E into bankruptcy in 2019 and the 2023 Maui fires that led to multibillion-dollar settlements by Hawaiian Electric, is now a regulated program in several western states: approved mitigation plans with vegetation management, inspections, system hardening, situational awareness and public safety power shutoff protocols, whose execution the audit tests against the plan and the inspection records, because a utility that cannot show it did what its plan said has no defense. Worker safety (OSHA, with electrical and gas-specific hazards) completes the set. The environmental and climate risk audits guide covers the environmental programs alongside.
Operational technology and physical security
Beyond the CIP standards’ scope (which covers the bulk electric system and leaves most distribution systems, gas operations and water systems to other regimes or none), utilities run operational technology everywhere: distribution management systems, advanced metering infrastructure, SCADA for gas and water, generation control systems, and building controls. The May 2021 ransomware attack on Colonial Pipeline, which halted the largest US fuel pipeline for days after an attack on its business systems and led to the TSA directives, showed that the IT and OT boundary is the point of failure, and the nation-state intrusions into US utility networks reported in 2024 and 2025 showed the adversary’s patience. The audit program follows the manufacturing guide’s OT section (segmentation, asset inventory, controlled remote access, compensating controls, backups of configurations, monitoring, incident response with safe operations) applied to every OT environment the CIP standards do not reach, and it adds physical security: substations (after the December 2022 attacks on substations in North Carolina), control centers, generating stations, gas facilities and the vehicle fleet, with CIP-014 as the model for the critical sites and a risk-based program for the rest. The cyber resilience and business continuity management guides cover the recovery side, which for a utility is the restoration of service.
Energy trading, fuel and power procurement
Utilities and energy companies buy and sell fuel, power and environmental products in wholesale markets and hedge them with derivatives, and the controls are those of a trading business inside a regulated one. The energy trading and risk management system records deals from capture through confirmation, valuation, settlement and accounting; the risk function sets limits (volumetric, value at risk, credit); the middle office confirms and values independently; the back office settles; and the regulatory layer adds FERC’s market manipulation rules and Standards of Conduct (transmission function employees may not share non-public transmission information with marketing employees), ISO market rules and settlements, CFTC rules for derivatives, and the fuel and purchased power clauses through which prudent procurement costs pass to customers and imprudent ones do not. The audit tests deal capture completeness (recorded deals against broker and counterparty confirmations), independent valuation and the curves used, limit monitoring and breach escalation, credit exposure and collateral, settlements against ISO statements, hedge accounting and the fuel clause filings, the Standards of Conduct controls (information barriers, training, posting), and the procurement of fuel and purchased power against the integrated resource plan and the commission’s expectations. Winter Storm Uri’s price spikes in February 2021 showed what a fuel procurement and hedging failure costs; the market risk and value at risk guides cover the risk measures, and the treasury audit guide the derivatives and hedge accounting controls.
Customers, billing and programs
A utility bills millions of customers monthly from meter data under tariffs the commission approved, and the customer side of the universe covers metering and meter data management (advanced metering infrastructure, estimated reads, meter accuracy testing), billing accuracy against tariffs and riders (rate changes implemented correctly; bill calculation re-performed), credit and collections under consumer protection rules (disconnection moratoria, payment plans, deposit rules), customer data privacy (usage data and the state rules on it), low-income and energy efficiency programs funded through riders and reported to the commission (eligibility, vendor payments, savings claims verified by evaluators), net metering and distributed generation interconnection, customer service metrics the commission tracks, and the call center and digital channels. Billing errors in a utility are systematic (a tariff coded wrongly bills every customer on it wrongly) and public (the commission orders refunds and the press reports them), which makes the billing system’s change control and the rate implementation testing standing engagements. The order-to-cash guide covers the generic process the utility billing cycle regulates, and the data privacy audit guide the customer data program.
The shape of a utility’s audit universe
| Domain | Representative entities (Larkspur Energy, 112 in total) | Typical rating and cycle |
|---|---|---|
| Regulatory and rates (12) | Rate case preparation and cost of service; regulatory accounting (ASC 980) and regulatory assets; cost allocation manual and affiliate transactions; FERC formula rate inputs; USofA compliance and plant accounting; fuel and purchased power clause filings; riders and trackers (energy efficiency, storm securitization); depreciation studies; regulatory commitments tracking; integrated resource plan; prudence file readiness; tariff implementation | Allocations, affiliate transactions, clause filings and plant accounting High (annual) |
| Capital program (14) | Capital portfolio governance; project estimating and stage gates; grid modernization program; transmission line and substation projects; gas main replacement program; renewable generation and storage projects; AMI program closeout; engineering and construction master agreements; unit-cost distribution contracts; materials management and transformer supply; construction management and inspection; work order closing and unitization; AFUDC; storm restoration cost capture | Portfolio governance, the two largest programs, unit-cost contracts and unitization High |
| Reliability and NERC (10) | NERC compliance program governance and evidence; CIP-002 inventory; CIP-004 access; CIP-005 and CIP-007 technical controls; CIP-010 configuration; CIP-013 supply chain; CIP-014 physical security; vegetation management (FAC-003); protection system maintenance; cold weather preparedness; event analysis and self-reporting | CIP controls and vegetation management High (annual) |
| Safety and environment (11) | Gas transmission integrity management; distribution integrity management; damage prevention and locating; leak survey and repair; operator qualification; wildfire mitigation plan execution; worker safety program; environmental permits and emissions monitoring; coal plant retirement and decommissioning (2028); environmental remediation liabilities; dam safety (two hydro facilities) | Integrity management, wildfire and worker safety High |
| Operations and OT (12) | Distribution management and outage management systems; SCADA for gas; generation control systems; OT network segmentation and asset inventory; OT remote access; physical security of substations and control centers; storm response and mutual assistance; fleet; facilities; emergency management; system restoration planning; drone and inspection programs | OT segmentation, remote access, physical security and storm response High |
| Energy supply and trading (8) | Power and fuel procurement; energy trading controls and the ETRM system; risk limits and credit; ISO settlements; hedge accounting; Standards of Conduct; renewable energy credits and environmental products; power purchase agreements | Trading controls, settlements and Standards of Conduct High |
| Customer (10) | Metering and meter data management; billing accuracy and rate implementation; credit and collections; customer data privacy; low-income programs; energy efficiency programs and vendor payments; net metering and interconnection; call center and digital channels; customer service metrics reporting; unclaimed property | Billing, rate implementation and programs High |
| Corporate (35) | Financial close and SOX; payroll and union agreements; pension and benefits; procurement (non-capital) and accounts payable; treasury and debt covenants (securitization bonds); tax (incentive credits, property tax); insurance and claims; legal and litigation (wildfire exposure); human resources; IT general controls; corporate cybersecurity; data governance; business continuity; ERM; third-party risk; AI use; political and lobbying compliance; records management; ethics and hotline; the internal audit function; and others | SOX, cybersecurity, third-party and pension High |
How regulators and NERC auditors use internal audit’s work
Three sets of outside auditors examine a utility and each reads internal audit’s work. The state commission‘s staff and consultants audit the utility in rate cases, in management audits (several states require periodic management and operations audits of their utilities by independent consultants, who request internal audit’s reports as a starting point), in fuel clause and rider audits, and in investigations after storms and incidents; a utility whose internal audit function has already tested the allocation manual and the clause filings answers faster and with fewer adjustments. The regional entity‘s NERC compliance auditors examine registered entities on a three-year cycle (more often for larger ones), review the entity’s internal controls as part of the risk-based approach adopted in the 2010s, and give credit for self-identified and self-reported violations, so that a strong internal audit program over CIP and operations standards produces fewer and lesser penalties. PHMSA and state pipeline safety inspectors review integrity management records and have cited internal audit findings in their own. The relationship follows the banking pattern described in the internal audit in banking guide: candor about coverage, coordination of requests, and issue validation of the regulators’ findings. A utility’s compliance function (NERC, commission, pipeline safety) is the second line, and the assurance mapping guide shows how the board sees who covers what.
What goes to the audit committee
Beyond the standard reporting, a utility’s audit committee receives the capital program assurance results (portfolio governance, major project status, unitization backlog, prudence readiness), the regulatory accounting and allocation findings with their rate case implications, the NERC compliance program’s status including self-reports and potential violations, the safety program results (integrity management, wildfire, worker safety) often shared with a board safety or operations committee, OT and corporate cybersecurity status, trading and procurement controls, billing accuracy and customer program findings, the status of regulator findings and commitments, and ICFR. Utility boards commonly have separate committees for nuclear, safety or operations, and the function’s reporting is allocated among them with the audit committee retaining the whole. The audit committee annual agenda and board risk reporting guides give the calendar and the risk pack.
Careers and pay in utility internal audit
Utility functions hire accountants with regulatory accounting backgrounds, engineers who moved into project controls, compliance or audit, cybersecurity specialists with OT exposure, and operations staff who know the field; the CIA, CPA and CISA are the credentials, with NERC compliance training, project management credentials and OT security certifications as sector additions. Pay sits at the general market’s middle to upper-middle (the salary guide‘s ranges apply, with large investor-owned utilities paying well and public power and cooperatives somewhat less), with the stability and benefits of a regulated business and defined-benefit pensions still common. Career paths run into regulatory affairs and rates, project controls and capital program management, compliance leadership (the NERC compliance officer role is a common destination), finance and the controller’s office, and operations management for those with engineering backgrounds. The career ladder and exit opportunities guides cover the general paths.
Failures that recur
| Failure | How it shows | What the function should do |
|---|---|---|
| Evidence without controls | NERC audit passes on evidence binders; a violation self-reported a month later because the control never ran between audits | Test the control’s operation across the period, not the evidence produced for the auditor |
| Work orders open for years | Rate base and depreciation distorted; unitization backlog in the thousands | Annual closing and unitization audit with aging analytics |
| Prudence files that cannot be reconstructed | A commission disallows costs because the alternatives considered were never recorded | Test decision documentation at stage gates while the project runs |
| Affiliate charges by habit | Holding company costs allocated by a formula nobody has reviewed in a decade | Annual cost allocation manual audit |
| OT outside CIP ignored | Distribution and gas SCADA flat-networked; vendor modems in substations | OT asset inventory and segmentation audit across all environments |
| Wildfire plan on paper | Inspections recorded as complete; vegetation clearances not met | Field verification of inspection records |
| Unit-cost contractor billing unverified | Units billed that were never installed | Field verification sampling tied to payment |
| Tariff changes implemented wrongly | Systematic billing errors and commission-ordered refunds | Rate implementation testing before every change |
| Trading limits monitored by the traders | Breaches unreported; a storm’s price spike unhedged | Independent middle office; limit breach testing |
A worked example: Larkspur Energy’s FY26 audit year
Larkspur Energy is the investor-owned utility used in the energy examples on this site: a vertically integrated electric and gas company serving 1.4 million electric and 600,000 gas customers in two states, with $5.2 billion of revenue, generation from gas, wind and solar plus one coal plant retiring in 2028, two small hydro facilities, transmission and distribution systems that make it a NERC-registered transmission owner and operator and generator owner, a $1.9 billion annual capital program, and a listed holding company. Its twenty-person internal audit function reports to the audit committee, works beside a NERC compliance function of fourteen and a regulatory affairs department that runs rate cases in both states, and maintains a 112-entity universe. The FY26 plan covered 34 entities in about 27,000 hours, with 2,400 hours co-sourced (OT security testing, a construction cost audit specialist, regulatory accounting expertise for the formula rate).
| Engagement (hours) | What it found | Outcome |
|---|---|---|
| Work order closing and unitization (680) | 4,100 completed capital work orders open beyond the 90-day policy, $212 million of plant in construction work in progress that should have been in service, delaying depreciation and understating rate base in the pending rate case by an estimated $9 million of annual revenue requirement; unitization errors in 6 percent of a sample | High; closing campaign over two quarters; the rate case update filed with corrected plant balances; monthly aging to the capital committee |
| Unit-cost distribution contracts (520, 160 co-sourced) | Field verification of 240 billed units across three contractors: 11 units billed and not installed, 23 billed at a higher unit type than installed ($410,000 over the sample period); the inspection sign-off process relied on the contractor’s as-built | High; credits recovered; independent inspection sampling tied to payment approval; one contractor’s invoices audited back two years |
| Cost allocation manual and affiliate transactions (440, 120 co-sourced) | Holding company service costs allocated by a 2016 formula using employee counts that had shifted toward the unregulated renewables subsidiary; the regulated utility over-absorbed about $3.2 million a year | High; allocation factors updated with the commission notified; the manual’s annual review made a controlled process |
| NERC CIP controls (CIP-004, 005, 007, 010) (900, 300 co-sourced) | Compliance evidence complete for the last regional audit; the audit’s period testing found access revocations for 6 of 120 terminated or transferred personnel completed after the 24-hour requirement, firewall rule base with 31 rules lacking documented need, and patch evaluations within 35 days for 94 percent of applicable patches with mitigation plans missing for the rest | High; potential violations assessed with compliance and self-reported to the regional entity (two accepted as compliance exceptions with minimal risk); the control operation gaps fixed |
| Gas distribution OT and remote access (560, 240 co-sourced) | Gas SCADA, outside CIP scope, segmented from the corporate network; three vendor cellular modems providing remote access to regulator stations undocumented; SCADA server backups never restore-tested | High; modems removed and access routed through the controlled jump host; restore tests quarterly |
| Wildfire mitigation plan execution (480) | Vegetation inspection records showed 100 percent completion of the high-risk circuit cycle; field verification of 60 spans found clearance deficiencies on 7 that the records had marked compliant; the inspection contractor’s quality assurance sampled 1 percent | High; the 7 spans remediated; contractor QA raised to 5 percent with utility field verification; the finding disclosed in the plan’s compliance report |
| Fuel clause filing (380) | Fuel and purchased power costs reconciled to the ledger and the ISO settlements; one gas transportation contract’s demand charges allocated to the clause when the tariff required base rate recovery ($1.1 million) | Medium; corrected in the true-up; the commission staff’s audit later accepted the correction |
| Rate implementation (two tariff changes) (300) | Bill calculations re-performed for 400 customers across rate classes after each change: one time-of-use rider’s shoulder period coded with the wrong hours, affecting 38,000 customers by small amounts in both directions | High; corrected and refunded within the quarter; pre-implementation testing made mandatory |
| Energy trading controls and Standards of Conduct (520) | Deal capture complete against confirmations; limit monitoring independent; two transmission function employees had access to a marketing shared drive in breach of the information barrier | Medium; access removed; posted on the FERC site as required |
| Storm restoration cost capture (360) | A spring storm’s $48 million of restoration costs documented for securitization filing; mutual assistance crew invoices from two utilities lacked time records for 9 percent of hours billed | Medium; records obtained; the filing supported |
| Coal plant retirement and decommissioning estimate (300) | Decommissioning cost estimate from 2021; regulatory asset for the remaining plant balance supported; environmental remediation (coal ash) estimate not updated for the 2024 rule changes | Medium; estimates refreshed with engineering; disclosure reviewed |
The chief audit executive’s annual report framed the year for the committee in rate case and reliability terms: the unitization and allocation findings had changed the utility’s filed position, the unit-cost and wildfire findings had corrected records a commission or a court would have read, and the CIP period testing had turned potential violations into self-reports with minimal penalties. The committee asked that the field verification approach used for wildfire inspections and unit-cost billing become a standing program, and funded the two field auditors it required. The capital projects, cybersecurity and fixed assets guides carry the methods the engagements used.
Questions about internal audit in energy and utilities
What does internal audit do at a utility?
It audits the regulatory accounting and allocations that become rate case evidence, the capital program and its contractors, NERC reliability and CIP compliance controls, pipeline and wildfire safety program execution, operational technology and physical security, energy trading and procurement, customer billing and programs, and the corporate processes every company has, reporting to the audit committee and coordinating with the commission’s and NERC’s auditors.
What are the NERC CIP standards?
The critical infrastructure protection standards CIP-002 to CIP-015 that registered electric entities must follow for the cybersecurity and physical security of bulk electric system cyber systems: categorization, security management, personnel, electronic and physical perimeters, systems security, incident response, recovery, configuration and vulnerability management, information protection, supply chain, substation physical security and, from 2028, internal network security monitoring. Violations carry penalties that can exceed a million dollars a day.
What is regulatory accounting?
Accounting under ASC 980 for rate-regulated entities, which recognizes regulatory assets (costs a regulator has promised to let the utility recover in future rates) and regulatory liabilities (amounts to be refunded), alongside the FERC Uniform System of Accounts that governs how utilities record plant and expenses. Classification, allocation and recovery decisions directly affect the revenue a utility may earn.
What is a prudence review?
A commission’s examination, often years after the spending, of whether a utility’s costs were prudently incurred: whether a reasonable manager, with the information available at the time, would have made the same decision. Costs found imprudent are disallowed from rates. Internal audit tests whether project files record the alternatives considered and the reasons for decisions while the project runs.
How is utility internal audit different from the NERC compliance function?
The compliance function owns the reliability compliance program: evidence, internal controls, self-certifications and the regional entity relationship. Internal audit assesses the program’s effectiveness and tests whether the controls behind the evidence operate across the period, which is where violations hide, and covers the rest of the utility’s risks.
Why are capital projects so central to utility audit?
Because utilities earn their return on prudently invested capital, spend more on capital than almost any other industry relative to revenue, and must defend every project’s costs in rate cases. Project records are rate case evidence; work orders that stay open distort rate base and depreciation; and contractor billing under unit-cost contracts is verifiable only in the field.
Related guides
- How to audit capital projects and construction — the program behind the capital audits.
- How to audit fixed assets — plant accounting and unitization.
- How to audit the financial close — the close regulatory accounting complicates.
- Auditing cybersecurity programs — the methods CIP requirements map to.
- Patch and vulnerability management audit — CIP-007 and CIP-010 testing.
- Incident response audit — CIP-008 and the TSA directives.
- Auditing cyber resilience — restoration of service.
- How to audit business continuity management — storm and emergency response.
- Internal audit in manufacturing — operational technology security shared with plants.
- Market risk — the risk measures trading controls rely on.
- How to audit treasury — derivatives and hedge accounting.
- How to audit order-to-cash — the billing cycle’s generic process.
- Data privacy audit — customer usage data.
- Environmental and climate risk audits — permits, emissions and remediation.
- Third-party risk management program — contractors and CIP-013 suppliers.
- Assurance mapping — compliance, safety and audit coverage for the board.
- Internal audit in banking — the model for working with regulators who read your reports.
Leave a Reply