Alberta Energy
Regulator (AER)

Third-Party Review
23RFP-CS016
Third-Party Review Report
September 11, 2023

Table of Contents

3

Executive Summary

4

Project Overview

13

Board of Directors Response

This document is intended solely for the information and internal use of The Audit and Finance Committee of the Board of Directors of the Alberta
Energy Regulator and is not intended to be and should not be used by any other person or entity. No other person or entity is entitled to rely, in any
manner, or for any purpose, on this document.
The procedures performed comprise an advisory engagement, which is not subject to Canadian Auditing Standards or Canadian Standards on Review
or Assurance engagements. Consequently, no opinion or conclusion intended to convey assurance are expressed. Had additional p rocedures been
performed, other matters may have come to our attention that would have been reported.

© Deloitte LLP and affiliated entities.

Alberta Energy Regulator (AER) | Third-Party Review | 23RFP-CS016

2

Executive Summary
The Board of Directors of the Alberta Energy Regulator (AER) engaged Deloitte
LLP (Deloitte) to review the actions taken by the AER following the issuance ofan Environmental Protection Order (EPO) to Imperial Oil Limited (Imperial) on
February 6, 2023. The scope of our review included several areas such as
incident response processes, communication, emergency response, incident
investigation protocols, compliance, and enforcement processes. Deloitte
performed interviews with internal stakeholders, and as arranged by the AER,
Deloitte also interview First Nations and Métis stakeholders (herein referred toas “Indigenous Peoples”), and reviewed relevant policies and procedures basedon leading practice principles from Deloitte's Global Framework for Crisis andIncident Response.
The review found that while the AER followed the internal policies, standards,
procedures, and/or processes. Opportunities for improvement were identified
when these were compared to Deloitte's Crisis and Incident Response
Framework. We noted:
1. The AER has procedures in place for responding to incidents andemergencies, but the Kearl incidents highlighted the need for more detailed
processes and clearer communication protocols with Indigenous People andexternal stakeholders.

2. The AER needs to standardize and clarify the terms "incident" and"emergency" and establish formal documented procedures for internal
communication and escalation to management and the Board for each.

4. In light of the importance of the role played by the Engagement andCommunication team of AER in communicating incidents throughengagement and media, opportunities for improvement in communication
processes, documentation, and verification. Recommendations include
developing thorough communication protocols, assigning roles forcommunicating with local communities, and verifying stakeholders’ andIndigenous Peoples’ receipt of communications.
5. Opportunities for improvement in providing additional detail and guidance,
specifying timelines, and updating risk criteria for Statutory Decision Makers(SDMs).
In conclusion, our review has identified opportunities for improvement that will
clarify and mature processes, and procedures as well as streamline the AER's
governance system for incident and emergency management.
The AER staff, management, and Board of Directors have been highly supportive
throughout the review process, demonstrating their commitment to actioning
change.
It has been a pleasure to work with the AER staff, management, and Board of
Directors, as well as the representatives from the Indigenous Peoples
interviewed and the Regional Municipality of Wood Buffalo (RMWB). We
appreciate their openness, cooperation, and constructive feedback, which havecontributed to the results of this Review.

3. Improvement opportunities within the Alberta EDGE system for triaging
incidents and emergencies by severity and providing more clarity on
identifying when items being reported are incidents or emergencies.

© Deloitte LLP and affiliated entities.

Alberta Energy Regulator (AER) | Third-Party Review | 23RFP-CS016

3

Project Overview© Deloitte LLP and affiliated entities.

Alberta Energy Regulator (AER) | Third-Party Review | 23RFP-CS016

4

Background, Objective and Scope
Background:Scope

The Audit and Finance Committee (AFC) of the Board of Directors(Board) of the AER engaged Deloitte as a third-party to assess (hereinreferred to as “Review”) the AER’s actions surrounding the Kearlseepage and spill.

The scope of the Review included:• Risk Evaluation and Incident Communication• Incident and Emergency Response• Incident Notification• Incident Investigation Protocol• Investigation Communication (internal and external) Protocols• Compliance and Enforcement Processes• Board Reporting and Communications• Review of relevant policies and procedures

Objective

Out of Scope

The objective of the Review was to review and provide
recommendations on the AER’s policies, standards, procedures andcommunication processes for emergency response, incident reporting,investigation and action specifically during the period of the Kearlincidents between May 19, 2022, and issuance of the EPO.

The scope of the review did not include:• Development of process maps
• Interviewing Imperial employees and directors• Identifying and/or reviewing gaps in Imperial’s response• Public communication support, including responding to public
inquiries• Forensic analysis of the response to the Kearl seepage and spill

An Environmental Protection Order (EPO) was issued February 6, 2023,
by the Alberta Energy Regulator (AER) to Imperial Oil Limited (Imperial)in response to two containment incidents at the Kearl Oil Sands
Project (Kearl). Kearl is an Imperial owned and operated oil sands site
in the Athabasca Oil Sands Region of Alberta, 45 kilometers northeastof Fort McKay.

Deloitte commenced work on the Review on May 16, 2023. The remainder of this report provides the results of the Review.
© Deloitte LLP and affiliated entities.

Alberta Energy Regulator (AER) | Third-Party Review | 23RFP-CS016

5

Approach and Methodology
Approach

Methodology

The following activities were performed as part of Deloitte’s approach to the Review:

Our workplan leveraged Deloitte’s Global Framework for Crisis and Incident
Response, which is based upon leading practice principles and includes the following:• Confirmed the objective, scope requirements, priorities, and timing with the AFC.
• Leveraging our Internal Audit approach, developed a workplan based on Deloitte’s
Global Framework for Crisis and Incident Response (the "C&IR Framework").
• Performed internal interviews with AER personnel to understand the AER’s
policies, standards, procedures and the actions taken in relation to the Kearl Lake
seepage and spill.

• Performed interviews arranged by the AER, with external stakeholders, including,Indigenous Peoples and the RMWB.
• Reviewed the relevant AER policies, standards and procedures based on the resultsof information gathered in interviews and compared against the C&IR Framework.
• Reported opportunities for improvement.

© Deloitte LLP and affiliated entities.

Alberta Energy Regulator (AER) | Third-Party Review | 23RFP-CS016

6

Results
Based on procedures performed in relation to the Kearl incidents, our review found that the AER followed the existing policies, standards, procedures, and/or processes. AER was
also supportive of the Review process and have expressed their commitment to actioning change. While no areas of non-compliance against existing policies, standards, procedures
and/or manuals were noted compared to the C&IR Framework there were opportunities for improvement identified which are outlined below.

Sound practices identified

Improvement themes identified

Based on the pace of change, social trends and reconciliation action plans, it is expectedthat gaps and improvements emerge from evolving expectations. Our review identified
the following sound practices at AER:

Based on interviews conducted, and responses from internal stakeholders, Indigenous
Peoples, and the RMWB, the following themes emerged:

Adherence to stated policies, standards, procedures, and/or processes
Based on procedures performed, we have concluded that while the AER followed its
stated practices in response to the Kearl incidents.

Engagement:
We experienced no challenges in securing commitment from employees, seniorleaders, and the Board for interviews and documentation. Several employees soughtout our teams to share thoughts and information related to our scope of work.

Commitment to change:
We observed the Board and management of the AER reinforcing their statedcommitments to regulating the life cycle of oil, oil sands, natural gas and coalprojects in a manner that protects public safety and the environment.
© Deloitte LLP and affiliated entities.

Policies and procedures: The content within the AER's policies, standards,
procedures, and manuals for emergency response, incident reporting, investigation
contain sections of information and guidance which is dated and not in line with the
C&IR Framework and/or the expectations of external stakeholders interviewed.
Terminology and clarity in documentation: While policies and procedures exist, thelevel of detail of criteria, definitions and related guidance leaves much up to thereader's interpretation and the potential for inconsistent application, resulting fromvarying reader interpretation where greater clarity is required.
Board reporting requirements: While management utilizes tools to communicate
with stakeholders, including the Board, such as Executive Notifications, existing
policies and procedures do not include escalation criteria and/or timelines forreporting incidents or emergencies to the Board.
Communication and stakeholder engagement: Although it is the duty holder who islegally required to report a release to anyone who “may be directly affected by therelease”*, the AER’s process and timelines in place for communication with external
stakeholder groups does not explicitly consider the expectations of Indigenous
Peoples.
*Environmental Protection and Enhancement Act, Section 110
Alberta Energy Regulator (AER) | Third-Party Review | 23RFP-CS016

7

Timeline of AER Actions for the Kearl Incident
Our review identified the following timeline of events:

February 6, 2023

May 19, 2022

Executive Notification was issued,
including to the Board, regarding
the release of the process affectedwater.

December 22, 2022

The AER was notified through the EDGE systemthat discoloured water was observed at Kearl.

June 28 to July 15, 2022

From May 27 to 29, 2022
Further assessment, analysis and testing
performed by Imperial and results shared with
AER for review.

AER received the Imperial action plan, requests
changes and updates, and received updated
plan.

Imperial submitted Source Control Action Plans,a Preliminary Delineation and Remediation
Action Plans.

February 4, 2023

September 2, 2022
The AER issued a notice of noncompliance issued
to Imperial under EPEA Approval 46586-01-00,
Sections 4.2.1 and 4.2.3.

June 3, 2022
Imperial reports to the EDGE system further
information regarding the seepage incident,
which is provided to the AER. This information
June 8, 2022
was discussed with AER Subject Matter Experts(SMEs).
AER requested Action
Plan from Imperial.

The AER’s SDM* issued the EPO to
Imperial covering both theseepage and spill incidents.

November 29, 2022
Imperial presented their geochemical
modelling results confirming that theprocess affected water and CSTleachate are mixing with groundwater.

The AER received an Edge callsheet of an overflow (spill) ofprocess affected water fromthe DP4 pond.

January 31, 2023
The seepage incident is triaged to
the AER Major Investigations
Team.

February 8, 2023
The overflow (spill) of process
affected water from the DP4
pond incident is triaged to the AER
Major Investigations Team.

Ongoing monitoring on Imperial actions by AER, including consultations with AER SMEs.

February 7, 2023

May 30, 2022
AER details to Imperial therequirements of information to beshared with AER for review andoversight.

August 3, 2022
The AER approved the revised
Imperial’s Action Plans.

August 26, 2022

May 20, 2022
The AER inspector visited Kearl site andinspected the seep areas.

June 6, 2022
AER performs additional inspectionof the seep areas.

December 5, 2022

February 1, 2023

The AER requested from Imperial
Source Control Action Plans,
Delineation and Remediation
Action Plans.

Drafting of the EPO by
AER begins, including
legal review, andinternal consultations.

AER SMEs advices that
discoloured water is most
likely from the Kearl site.

Board Chair notifies Board thatan EPO has been issued toImperial covering bothincidents.

February 5, 2023
The AER inspector visits Kearlsite and inspects spill location.
Spill is noted to be larger thanreported and that spill had left
the Kearl site.

*Statutory Decision Maker© Deloitte LLP and affiliated entities.

Alberta Energy Regulator (AER) | Third-Party Review | 23RFP-CS016

8

Perspectives from Indigenous Peoples
As a part of the third-party review, Deloitte interviewed representatives* from the Mikisew Cree First Nation, the Fort Chipewyan Métis Nation, the Willow Lake Métis Nation, theFort McMurray 468 First Nation, the Athabasca Chipewyan First Nation, the Fort McKay First Nation, the McMurray Métis Local 1935, and the Fort McKay First Nation. All respondents
expressed significant concern with the gap in communications around the event, especially in the context of one email to a single point of contact to the communities in May 2022with no additional follow-up until the EPO was issued in February 2023. For nine months a developing event with offsite impacts was being managed and no additional
communications were formally provided to regional Indigenous and First Nations communities. The following is a summary of what we were told by interviewees related to the inscope areas of our Review:
Notification, Communication and Information Access• Expectations around communication and incident
Consultation and Engagement
notifications from Indigenous Peoples are heightened and• The AER's policies and procedures related to the in-scope
evolving.
areas are not evolving with Indigenous Peoples• Request for an enhanced notification process taking into
expectations.
consideration types of notifications, method of• The AER should differentiate between a rights holder, andcommunication and mechanisms to keep contact lists up toa stakeholder in their policies and procedures to betterdate.
address the unique needs, rights, and perspectives of each
• When provided, information is often technical in naturegroup.
and not easily understandable by community members.
• The AER website is difficult to navigate and findinformation relevant to communities.
• Communities want to be aware of information relevant tothem and not necessarily just more information.
Risk Assessment and the AER Oversight• There is a common feeling that previous incidents are notconsidered when dealing with project applications,assessments, and incidents.
• Indigenous Peoples feel that assessment processes often
lack crucial tests and have limited scope.

© Deloitte LLP and affiliated entities.

Strengths and Positive Practices• Recent increase in communication, including executive
leadership, following the EPO.
• Bi-weekly updates on the Kearl Incidents with AER staff.

Alberta Energy Regulator (AER) | Third-Party Review | 23RFP-CS016

9

Observations and Improvement Opportunities Identified
The following observations and opportunities for improvement were identified:Observations

Opportunities for Improvement

1. Risk Evaluation and Incident Communication
The AER has procedures in place for responding to incidents and emergencies, which involve receiving
reports through the EDGE system and evaluating the severity of the incident. In May 2022, an incident
was reported to the AER regarding discoloured water around the Kearl lease boundary. An inspector
visited the site the following day initiating the incident response process, which progressed for several
months while conclusive results for testing were determined. During this period, the AER issued a
Notice of Non-Compliance to Imperial on September 2, 2022. While the AER followed existing policies
and procedures, it should consider more detailed processes for handling incidents and emergencies.
This includes clearer communication protocols with Indigenous Peoples and external stakeholders, theuse of clearer terminology, and more clearly documented procedures for internal communication andescalation to management and the Board.

•

Create more detailed incident and emergency processes covering reporting, inspection,
evaluation, communication, escalation, resolution, and post-incident review.

•

Create detailed call-out protocol and procedures outlining who, when, and how tocommunicate internally and externally during emergencies. These plans should address
various communication channels and timelines for updates.

•

Adhere to the Incident Response Officer's (IRO) guidelines and provide the information
to the different stakeholders on a timely basis.

•

Standardize and clarify the terms "incident" and "emergency" across policies,
procedures, and manuals.

•

Establish formal documented procedures for internal communication and escalation to
management and the Board for incidents and emergencies.

•

Revise and update the AER's Emergency Management Program Manual for noted
observation areas.

•

Provide specific guidelines for inspectors and licensees regarding sample collection,
methods, responsibilities, locations, frequency, and handling protocols.

•

Incorporate and elaborate on the definition of "waterbody," explicitly indicating its
coverage with regards to groundwater, either inclusion or exclusion, within the Incident
Response Handbook.

•Specify if Directive 071* applies to Oil Sands mining, e.g., Kearl incidents.

2. Incident and Emergency Response
The AER has guidelines in place for responding to incidents and emergencies, including the Incident
Response Handbook, Emergency Management Program Manual, and Compliance and Enforcement
Program. The AER's role is to ensure that duty holders respond effectively to incidents. While the AER
followed existing policies for the Kearl incidents, there are opportunities for improvement, including
providing more detailed guidance and timeliness for responding to escalating incidents, defining what
constitutes an emergency, and outlining sampling responsibilities, expectations, and/or
requirements for inspectors and licensees after an incident is reported.

*Directive 071: This directive sets out the requirements for emergency preparedness and response for sites regulated under th e Oil and Gas Conservation Act, Pipeline Act, Oil Sands Conservation Act, and Geothermal Resource Development Act.
© Deloitte LLP and affiliated entities.

Alberta Energy Regulator (AER) | Third-Party Review | 23RFP-CS016

10

Observations and Improvement Opportunities Identified (cont’d)Observations

Opportunities for Improvement

3. Incident Notification
The Alberta EDGE system is operated by the Ministry of Transportation and is responsible for being
the point of contact for all energy, environmental, and industrial emergencies, incidents, andcomplaints reporting. Incidents are triaged and classified by the EDGE system based on severity andforwarded to relevant parties, such as inspectors or other governmental bodies. During the Kearlincident in May 2022, the EDGE system was notified, and the severity was assessed by EDGE as a“minor impact”. The AER followed existing policies and procedures, but there are opportunities for
improvement, such as clarifying triage criteria for defining incidents versus emergencies andupdating call handling procedures for use by the EDGE system.

•

Define precise incident criteria for the AER Triage Table for EDGE.

•

Review and update the AER Triage Table for lessons learned from this incident for theAlberta EDGE system operated by the Ministry of Transportation to use.

•

Ensure timely notification of Indigenous Peoples and all relevant stakeholders, including
those potentially affected, by incorporating them into the incident notification and triage
process.

•

Develop a systematic method to re-evaluate incident categorization, including for seepage
and spills.

•

Create clear guidelines and timelines for engaging with Indigenous Peoples for more timely
and relevant communication during incident response.

•

Set clear timelines for incident response processes to ensure appropriate response time.

•

Formulate explicit guidelines for sharing information with Indigenous Peoples,stakeholders, and the right holders during incident response process, considering theirdiversity.

•

Specify if Directive 071 applies to Oil Sands mining, e.g., Kearl incidents.

4. Incident Investigation Protocol
The AER Compliance and Enforcement personnel conduct inspections and testing to verify
compliance and issue notices of noncompliance, orders, sanctions, or penalties. In the Kearlseepage incident, inspectors visited the area within 24 hours of the receiving the call sheet from the
EDGE system and followed incident response protocols. The AER followed existing policies andprocedures, but there are opportunities for improvement, including outlining when incidents andemergencies should be re-evaluated, specifying timeliness of incident response processes, andbalancing investigation integrity with stakeholder transparency expectations.

*Directive 071: This directive sets out the requirements for emergency preparedness and response for sites regulated under th e Oil and Gas Conservation Act, Pipeline Act, Oil Sands Conservation Act, and Geothermal Resource Development Act.
© Deloitte LLP and affiliated entities.

Alberta Energy Regulator (AER) | Third-Party Review | 23RFP-CS016

11

Observations and Improvement Opportunities Identified (cont’d)Observations

Opportunities for Improvement

5. Investigation Communication (Internal & External) Protocol
The AER's Engagement and Communication team plays a critical role in incident and investigation
processes, including communicating with stakeholders, and issuing public media releases. During
the Kearl incidents, the AER followed existing policies and procedures, but there are opportunities
for improvement in structured communication processes, documentation, and verification of
stakeholder communication.

•

Develop thorough communication protocols prioritizing efforts, identifying risks, andchoosing channels based on severity.

•

Create protocols for engaging Indigenous Peoples and external stakeholders (for example,
municipalities, and/or the public), specifying types of incident response, incidents,
investigations and emergencies which require communication, and the frequency,
methods, content, and responsible parties for such.

•

Assign roles for communicating with local communities and inhabitants in the affectedareas.

•

Verify stakeholders' receipt of initial and subsequent communications.

•

Clearly define "significant impacts" in Expedited EPO process. Provide examples for
guidance.

•

Following the complete process of evidence gathering, set time limits for Standard EPO
process.

•

Develop objective criteria that the SDMs can use to assess and determine the specificactions to take based on actual and potential risk factors.

•

Include "Perceived Risk" factor in the decision-making process to address concerns related
to public safety, the environment, or orderly deployment.

•

Create clear guidelines for Board communication, specifying shared information,communication frequency, timing, and preferred methods.

•

Establish an escalation protocol for incidents and emergencies, defining the chain ofcommand and steps to escalate information to the Board.

6. Compliance and Enforcement Processes
The Compliance & Liability Management Manual provides a framework for addressing noncompliance issues, with SDMs delegated decision-making authority for compliance assurance. The
Statutory Decision-Making Guide serves as a resource for making these decisions, including theissuance of EPOs decisions once they are made by the SDMs. While the AER followed existingprocedures for the Kearl incidents, there are opportunities for improvement in the Order
Procedures and Statutory Decision-Making Guide, particularly in providing additional detail andguidance, and updating risk criteria.

7. Board Reporting and Communications
The AER's internal procedures do not contain processes for communication to the Board, including
guidelines for sharing information or specifics about timing and communication methods. There
are opportunities to develop policies and procedures for communication with the Board of
Directors.

*Directive 071: This directive sets out the requirements for emergency preparedness and response for sites regulated under th e Oil and Gas Conservation Act, Pipeline Act, Oil Sands Conservation Act, and Geothermal Resource Development Act.
© Deloitte LLP and affiliated entities.

Alberta Energy Regulator (AER) | Third-Party Review | 23RFP-CS016

12

Board of Directors Response© Deloitte LLP and affiliated entities.

Alberta Energy Regulator (AER) | Third-Party Review | 23RFP-CS016

13

Board of Directors Response
The following was provided by the Board of Directors of AER in response to the results of Deloitte's review.

The Board of Directors of the AER accepts Deloitte's findings and recommendations from their review of the AER's internal actions in response to the Kearl incidents.
We would like to thank Deloitte for their thorough, independent review and AER staff for their openness, transparency and willingness to identify weaknesses and improvements in
our current systems and processes.
We would also like to thank the Regional Municipality of Wood Buffalo and the Indigenous communities who took the time to give Deloitte their feedback to help the AER improve.

The Board notes that there was no non-adherence with internal policies, standards, procedures and/or processes in response to the Kearl incidents, and that protecting public safety andthe environment was paramount in our peoples' actions. We expect nothing less.
However, Deloitte identified a number of out-of-date policies, standards, procedures and processes that need improving,as well as a need for greater transparency, consistency and timeliness in our communications. In particular, our communications failed to meet the expectations of communities
who live close to the operations we regulate.
We are committed to move swiftly to correct the deficiencies identified by Deloitte, as well as working collaboratively with local communities to address concerns raised in the report.

Consequently, we have instructed AER management to prepare a detailed action plan to address these deficiencies and concerns. We have also asked Deloitte to assess the outcomes of
the action plan in the coming months, and the Board will proactively report these results publicly.

© Deloitte LLP and affiliated entities.

Alberta Energy Regulator (AER) | Third-Party Review | 23RFP-CS016

14

About Deloitte
Deloitte provides audit and assurance, consulting, financial advisory, risk advisory, tax, and related services to public and private clients spanning multiple industries. Deloitte serves four out of five Fortune
Global 500® companies through a globally connected network of member firms in more than 150 countries and territories bringing world-class capabilities, insights, and service to address clients’ mostcomplex business challenges. Deloitte LLP, an Ontario limited liability partnership, is the Canadian member firm of Deloitte Touche Tohmatsu Limited. Deloitte refers to one or more of Deloitte Touche
Tohmatsu Limited, a UK private company limited by guarantee, and its network of member firms, each of which is a legally separate and independent entity. Please see www.deloitte.com/about for a
detailed description of the legal structure of Deloitte Touche Tohmatsu Limited and its member firms.
Our global Purpose is making an impact that matters. At Deloitte Canada, that translates into building a better future by accelerating and expanding access to knowledge. We believe we can achieve thisPurpose by living our shared values to lead the way, serve with integrity, take care of each other, foster inclusion, and col laborate for measurable impact.

To learn more about how Deloitte’s approximately 312,000 professionals, over 12,000 of whom are part of the Canadian firm, please connect with us on LinkedIn, Twitter, Instagram, or Facebook.
© Deloitte LLP and affiliated entities.