FERC’S Merger Review and Postmerger Oversight to Prevent Cross- Subsidization in Utility Holding Company Systems Are Limited

FERC has made few substantive changes to either its merger review  process or its postmerger oversight as a consequence of its new  responsibilities and, as a result, does not have a strong basis for ensuring  that harmful cross-subsidization does not occur. To review mergers and  acquisitions, FERC officials told us that they do not intend to make  changes to their process other than to require companies to disclose any  existing or planned cross-subsidization and explain why it is in the public  interest, and to certify in writing that they will not engage in harmful cross- subsidization. For postmerger oversight, FERC intends to continue to rely  on its existing enforcement mechanisms, as expanded by EPAct, to detect  potential cross-subsidies—primarily companies’ self-reporting of  noncompliance and a limited number of compliance audits. However,  FERC does not formally consider the risks posed by various companies in  determining which companies to audit—a consideration that financial  auditors and other experts told us is important when auditing with limited  resources. We also found that where affiliate transactions were audited,  the resulting audit reports sometimes lacked clear and useful information.

		FERC’s Merger and Acquisition Review Relies Primarily on Company Disclosures and Commitments Not to Cross-Subsidize

FERC’s merger review process requires companies to submit evidence  that a merger or acquisition will not result in unapproved cross- subsidization, and its ability to prevent cross-subsidization depends largely  on commitments by the merging parties rather than independent analysis.  FERC-regulated companies that are proposing to merge with or acquire a  regulated company must submit a public application for FERC to review  and approve. As part of its review of these applications, FERC is now  responsible for ensuring that mergers do not result in harmful cross- subsidies. To do this, FERC attempts to ensure that mergers will not result  in:    any transfer of facilities between or issuance of securities by a  traditionally regulated public utility to an affiliate;    any new financial obligation by a traditionally regulated public utility  for the benefit of an affiliate; or    any new affiliate contract between a nonutility affiliate company and a  traditionally regulated public utility company, other than agreements  subject to review by FERC under the Federal Power Act.
To fulfill this new responsibility, FERC established an additional  requirement that the merging companies submit new information as part  of their application for merger or acquisition approval, referred to as  “Exhibit M.” Exhibit M requires companies to describe organizational and  financial information, such as affiliate relationships and any existing or  planned cross-subsidies. If cross-subsidies already exist or are planned,  companies are required to describe how these are in the public interest by,  for example identifying how the planned cross-subsidy benefits utility  ratepayers and does not harm others. Further, in FERC’s recent  supplemental merger policy statement, issued July 20, 2007, FERC  provided additional guidance on certain types of transactions that are not  likely to raise concerns about cross-subsidization—termed “safe harbors.”  FERC also requires company officials to attest that they will not engage in  unapproved cross-subsidies in the future and specifically requires the  merger application, including Exhibit M, to be signed by a person or  persons having appropriate knowledge and authority.
FERC’s merger or acquisition decision is based on a public record that  starts with an initial application. This record includes the filing of the  initial application. FERC’s review process also allows stakeholders or  other interested parties, such as state regulators, consumer advocates, or  others to submit information and arguments to this public record for  FERC to consider. FERC officials told us that they evaluate the  information in the public record for the application and do not separately  develop or collect evidence or conduct separate analyses of a proposed  merger beyond what is submitted as part of the record. FERC officials told  us that they can, and sometimes do, request that applicants provide  additional information or conduct additional analysis. In addition, FERC  may require a public hearing before making a decision. Whether or not a  hearing is held, officials noted that they are required to make their  decision based on the evidence that is in the public record. On the basis of  this information, FERC officials told us that they will determine which, if  any, existing or planned cross-subsidies may be allowed, which is then  detailed in the final merger or acquisition order.
According to experts, FERC is generally supportive of mergers. FERC  officials largely acknowledged this perspective, telling us that under law  and regulation, FERC must approve mergers that are consistent with the  public interest. These officials also said that FERC believes it has broad  flexibility in determining what is consistent with the public interest,  particularly in light of changing conditions in the industry and, as such, it  does not read the statute as creating a presumption against mergers. On  the other hand, FERC officials said that FERC was not prepared to  presume that all mergers were beneficial but that it was the merger  applicant’s responsibility to demonstrate that the merger was consistent  with the public interest by, for example, demonstrating how it improves  efficiency or lowers costs while not harming competition.
Between the time EPAct was enacted in 2005 and July 10, 2007, FERC has  reviewed or was in the process of reviewing 15 mergers or potential  mergers (see table 1). FERC has not rejected any merger applications. In  nine cases, FERC approved the merger without condition. In three cases,  FERC approved the merger with conditions, for example, requiring the  merging parties to provide further evidence of ratepayer protection  consistent with FERC-approved “hold harmless” provisions. One merger  was withdrawn by the merging parties prior to FERC’s decision. The two  other applications are still pending.

		FERC’S Postmerger Oversight Relies on Its Existing Enforcement Mechanisms and Lacks a Risk-Based Approach

FERC officials in the Office of Enforcement intend to use the same tools  to enforce prohibitions on cross-subsidization that they currently use for  other enforcement actions. In general, the Office of Enforcement relies on  two primary tools—self-reporting and a limited number of compliance  audits. However, we found that FERC does not use a formal risk-based  approach to guide its audit planning—the active portion of its oversight  efforts to detect cross-subsidization—or deploy its limited audit resources.  As such, FERC’s actions do not provide a strong basis for ensuring the  detection of potentially harmful cross-subsidization.
The first detection tool that FERC emphasizes is that companies self- police their own affiliate transactions and intercompany relationships and  voluntarily self-report instances of harmful cross-subsidization to FERC.  FERC’s policy statement on enforcement emphasizes such voluntary  internal compliance and reporting as well as cooperation with FERC in  order to detect and correct violations. A company’s actions in following  this policy, along with the seriousness of a potential violation, help inform  FERC’s decision on the appropriate level of potential penalty to impose on  violating companies. FERC indicates that it places great importance on  company’s proactive self-reporting because it believes that companies are  in the best position to detect and correct both inadvertent and intentional  violations of FERC orders, rules, and regulation. According to FERC  officials, companies can actively police their own behavior through a  formal program for internal compliance, internal audits, and through  annual external financial audits.
Since the enactment of EPAct, when Congress formally highlighted its  concern about cross-subsidization, no companies have self-reported any of  these types of violations. FERC officials said that FERC had approved 12  settlements with natural gas and electric entities, none of which involved  violations of the PUHCA 2005 provisions in EPAct. In these cases, FERC  has assessed civil penalties totaling $39.8 million on the companies.  FERC officials told us that because it can now levy much larger fines—up  to $1 million per violation per day—they expect companies to become  more vigilant in monitoring their behavior.
Regarding FERC’s reliance on self-reporting, key stakeholders have raised  several concerns about this approach. First, because FERC’s rules related  to affiliate transactions are broad, company managers may not always be  fully aware of how these rules apply to specific affiliate transactions.  According to market experts, including a November 2007 report issued by  a former FERC Commissioner on behalf of a broad consortium of energy  companies, FERC’s rules are often written broadly and it is unclear what  standards of conduct FERC uses to oversee transactions between  companies. This can result in utility managers being unaware that specific  transactions may violate current FERC policies. One controller we met  with told us that these broad rules can be counterproductive in  encouraging company compliance and self-reporting because it is difficult  to determine if the rules are actually being violated. Second, internal  company audits tend to focus on areas of highest perceived risk and, as a  result, may not focus specifically on affiliate transactions. Internal  auditors with whom we spoke told us that they have relatively small staffs  and are responsible for auditing a wide range of matters within a  corporation and, as such, they focus their efforts on areas they believe  pose the highest risk to the company. They said this approach means that  they rarely focus on affiliate transactions, unless those transactions  represent a large financial exposure to the company’s potential  profitability. Finally, financial audit firms we spoke with told us their work  primarily focuses on auditing financial statement balances and related  disclosures. These audits focus on providing an opinion about whether the  financial statements present fairly, in all material respects, the financial  position and operations of the company. As such, they said that their work  with regard to affiliate transactions is limited to the related disclosures  rather than determining if harmful cross-subsidization was occurring. Only  in cases where transactions could have a material effect on the overall  financial statements of a company would they conduct detailed testing and  review pricing arrangements. Compounding these concerns, and FERC’s  belief that the threat of large fines will encourage companies to self-report,  companies expressed uneasiness over FERC’s use of its new penalty  authority on self-reporting companies. One company official noted that  some of the recent penalties for companies that self-reported violations  were large and would “chill” companies’ willingness to self-report  violations. In addition, state commissions expressed concerns about a  reliance on self-reporting of cross-subsidies and reported that effective  oversight would require regular and rigorous audits of affiliate  transactions.
As a second way to detect potential harmful cross-subsidization, FERC  plans to conduct a limited number of compliance audits of holding  companies each year. Since enactment of PUHCA 2005 provisions in  EPAct, FERC has not completed any audits to detect whether cross- subsidization is occurring. In our review of FERC processes for planning  these audits, however, officials with the Division of Audits in the Office of  Enforcement told us that FERC conducts audit planning for 1 fiscal year at  a time. On the basis of this approach, FERC’s current audit plan for these  matters in 2008 will audit three companies—Exelon Corporation,  Allegheny, Inc., and the Southern Company. The overall objective of these  audits will be to determine whether these companies are inappropriately  cross-subsidizing or granting special preference to affiliates or burdening  utility assets for the benefit of nonutility affiliated companies. Such  compliance audits, officials told us, will determine whether companies are  complying with FERC rules for the pricing of affiliate transactions, among  other things. FERC’s audit plan is not designed to address the number of  audits FERC will conduct beyond 2008, or at what companies it will  conduct them since the planning for 2009, for example, will not be done  until sometime later in 2008. In addition, based on discussions with FERC  officials, the development of its audit plan is informal and developed in an  ad hoc manner to address the specific audits for a given year. Specifically,  these officials said that the plan is developed through informal discussions  between FERC’s Office of Enforcement, including its Division of Audits,  and relevant FERC offices with related expertise, including the Office of  General Counsel, the Office of Energy Markets Regulation, and the new  Office of Electric Reliability. FERC officials also told us that the plan is  reviewed by top agency officials and approved by the Chairman.
While FERC’s audit plan for 2008 reflects insights of key FERC staff, it  does not formally consider the risks posed by individual companies, or the  overall universe of companies, in determining which companies to audit or  how many audit resources to deploy. FERC officials told us that while they  do not specifically consider the individual or collective risks posed by  companies in a formal manner, they believe that their discussions with  knowledgeable staff provide a reasonable picture of risk. However, on the  basis of our discussions with FERC staff, this picture of risk may be  somewhat limited in that it is informed only by the views of a few key staff  and does not seek input from stakeholders, such as the financial  community or state commissions, or reflect analysis of key data on risk.
To obtain a more complete picture of risk, FERC could more actively  monitor company-specific data to develop a picture of the risks posed by  the companies it regulates—something it currently does not do. To partly  address this, FERC recently required certain affiliates to begin gathering  comprehensive financial information in 2008 and filing the first of what  will be annual financial reports by May 2009. According to a FERC audit  official, after a year or 2 of data collection, analysis, and conducting  audits, it will be in a much better position to plan, conduct, and report the  results of its audits of affiliate relationships and potential cross- subsidization. In addition, this official said that FERC does not typically  review certain publicly available financial information, such as bond  ratings and stock prices for companies that FERC regulates or their  affiliates. According to bond rating companies, they actively monitor  companies’ operating and financial condition to identify the key risks  faced by companies and reflect these risks in the ratings they assign to the  company’s debt. Further, state officials agreed that such information may  help provide a view of the financial condition of specific companies, or the  overall industry, and how they may be changing. In support of the use of  this information, some state regulators told us that such information has  been helpful to them in identifying when companies may engage in  unlawful cross-subsidies. Finally, some state officials said that because  they regulate companies on a day-to-day basis, they have considerable  expertise and knowledge that may prove useful to FERC. Thus, unless  FERC changes its view about the usefulness of such data, it will continue  to lack available information that may be potentially useful in assessing  risk.
The importance of formally considering risk when carrying out  compliance oversight is highlighted by prior GAO reports. In these  reports GAO identified instances where other agencies, such as SEC, the  Department of Homeland Security, and the Environmental Protection  Agency could use and have used risk-based approaches to inspect for  compliance with regulations. In some cases, agencies have developed and  used statistical models to estimate an entity’s (e.g., a company’s) risk of a  violation and as a means to target limited audit resources. In other cases,  we have recommended that agencies continue to devote some resources  to auditing entities on a random basis but use the data collected from  these random audits to update statistical models so that the agency can  continue to identify high-risk entities. Furthermore, according to financial  auditors and other experts we spoke with, risk assessments are an  important consideration in targeting audits and allocating resources to  detect noncompliance. Without a sufficient assessment of risk, it may be  difficult for FERC to convince companies, states, and other market  stakeholders that it can adequately and consistently detect cross- subsidization.
At present, without a risk-based approach to guide its audit planning and  deploy its limited audit resources, FERC may not be effectively allocating  its staff to audit the companies it regulates. FERC’s Division of Audits  currently has a total of 34 full-time staff, including 21 accountants/  auditors, 6 energy industry analysts, 3 economists, 2 engineers, 1 attorney,  and 1 support staff. FERC has determined that of the 149 companies that  have been identified as holding companies, 36 of them are currently  subject to its PUHCA 2005 authority and it plans to allocate 9 of its  available staff to these audits in 2008. Officials in the Division of Audits  told us that they believe a typical audit would involve three to four audit  staff—an auditor-in-charge and one or two auditors. Other companies and  state auditors involved in auditing affiliate transactions told us that these  audits can be difficult and require significant use of auditors with  specialized skills and experience. These auditors also told us that  examining affiliate transactions can be resource intensive since  determining whether a transaction is unfair may require detailed analysis  of the transaction and the market for the good or service that was the  subject of the transaction. At its planned 2008 audit rate of 3 companies, it  would take FERC 12 years to audit each of these companies once. In  commenting on the report, FERC noted that the number of audits in future  years may change. Nevertheless, FERC may face additional companies,  some of which may require more complex audits. According to financial  and industry experts we spoke with, the elimination of PUHCA 1935 is  likely to attract companies previously restricted from owning utilities to  consider mergers or acquisitions. For example, some experts told us that  foreign companies, corporate conglomerates, and private equity  companies are considering mergers or acquisitions of U.S. utilities. In  addition to companies subject to FERC’s oversight under the PUHCA 2005  provisions of EPAct, FERC also has audit responsibilities for the electric  reliability organization, the North American Electricity Reliability  Corporation, which oversees issuing and enforcing rules, such as  compliance with reliability standards, focused on ensuring reliable  electricity supplies. At present, there are about 4,700 companies that could  potentially be audited for compliance with FERC’s rules, regulations, and  orders regarding reliability, transmission, and electricity pricing rules.  FERC officials said some overlap exist between categories, such as  investor-owned utilities and electric suppliers with market-based rate  authority. In addition, according to FERC, Federal Power Act section 215  companies would initially be audited and overseen by the new Regional  Reliability Organization and the related regional entities. FERC officials  also said that they intend to audit about 100 of these companies during  2008. The universe of companies that FERC is responsible for auditing is  identified in 10 categories in table 2. Because of the magnitude of  companies it oversees and the range of rules it enforces, FERC  enforcement and audit officials described their offices as resource  constrained and acknowledged that the Office of Enforcement has not yet  adopted a formal, risk-based approach to target these resources.

		FERC’s Postmerger Audit Reports on Affiliate Transactions Often Lack Clear Information

FERC’s publicly available audit reports pertaining to affiliate transactions  are not clear and, thus, their usefulness in terms of public transparency  and disclosure is limited. Although FERC has not yet completed any  affiliate transaction audits or yet issued any reports under EPAct, officials  with the Division of Audits told us that they intend to rely on their existing  “exception-based” audit reporting policy. A FERC official told us their  “exception-based” audit reporting policy means audit reports would only  reflect the audit findings and recommendations associated with the audit  issues on which FERC found the company to be out of compliance. In  contrast, if an audit does not result in FERC taking an enforcement action  due to noncompliance, the audit report does not provide information on  the methodology the auditors used nor their findings. Thus, FERC’s public  audit reports may not always fully reflect key elements such as objectives,  scope, methodology, and the specific audit findings. Federal government  auditing standards, developed by GAO and referred to as Generally  Accepted Government Auditing Standards (GAGAS), stipulate that audit  reports contain this basic information, and other information as well, in  order to comply with GAGAS. According to FERC officials, they are not  required to comply with GAGAS, but “follow the spirit” of these standards  because they provide a good framework for performing high-quality  audits. In our review of 18 recent FERC audit reports pertaining to  affiliate transactions, we found that they did not always identify any  findings on affiliate transactions or have any recommendations. Further,  the audit reports sometimes lacked key information, such as the type,  number, and value of affiliate transactions at the company involved and  the percentage of all affiliate transactions tested, or the test results. A  FERC official conceded that FERC past audit reports on affiliate  transactions do not always meet GAGAS standards because they are not  required to do so. However, without this information, it may be difficult  for regulated companies to understand the nature of FERC’s oversight  concerns and to conduct internal audits to identify potential violations  that are consistent with those conducted by FERC—key elements in  improving companies’ self-reporting. Further, financial audit firms,  internal auditors, and auditors at state commissions told us that they  typically review prior related audits, including those done by FERC, as  part of their preparation for a new audit. To the extent that FERC audit  reports lack information on the work they performed, they limit the  usefulness of these audits for future auditors as well as miss an  opportunity to improve FERC’s audit practices and transparency to state  regulators and other companies and stakeholders. Furthermore, without  such information in the audit report, we and other stakeholders, such as  state commissions, cannot confidently and credibly determine that the  auditor’s efforts to detect abusive affiliate transactions and cross- subsidization were sufficient. A recent report prepared by a former FERC  Commissioner on behalf of a wide range of industry stakeholders  expressed concern that FERC increase the transparency of its audits and  investigations in order to, among other things, help individual market  participants to improve their internal compliance programs and correct  deficiencies before they cause harm to consumers.

	States Vary in Their Capacities to Oversee Utilities

States utility commissions’ views of their oversight capacities vary, but  many states foresee a need for additional resources to respond to changes  from EPAct. Almost all states have specific authority to review and either  approve or disapprove mergers and acquisitions. Despite this authority,  many states’ commission staff expressed concern over their ability to  regulate the resulting companies. Almost all states report they have some  type of authority over affiliate transactions, although many states report  reviewing or auditing few of these transactions. Further, although almost  all states can access the books and records of the utility to substantiate  costs and other relevant data, many states report they cannot obtain such  access to these books and records at the holding company or other  affiliated nonutility companies. Almost half of the states report they need  additional staff and funding to respond to changes stemming from EPAct.

		Almost All States Have Merger Approval Authority but Many States Express Concern about Future Regulation of the Resulting Companies after Merger Approval

On the basis of our survey of state commission staff, all but 3 states (out  of 50 responses) have authority to review and either approve or  disapprove mergers. The types of authority states have vary, however. For  example, one state noted that, technically, it could only disapprove a  merger and, as such, the state allows a merger by taking no action to  disapprove it. Three states noted their state legislatures had not provided  them direct merger review authority, but they were able to use other  commission authority to conduct such reviews.
State commissions responding to our survey noted that the most important  factors they consider in evaluating mergers or acquisitions are the effects  on regulated rates and the quality of retail service (e.g., no significant  problems with service interruptions for consumers). The next most  important factors were the commission’s ability to regulate the resulting  company and the effect on the financial complexity of the company that  would result from the merger. Staff from one state told us in additional  narrative comments that they were concerned that with the passage of  EPAct utilities will become larger, more complex, and located in  geographically diverse areas. They specifically expressed concerns over  the challenges of allocating costs between various entities due to the  potential for centralization of services in these types of resulting  companies.
Table 3 below lists the 4 top factors rated as either of very great  importance or great importance out of 15 factors we asked states to rate in  their evaluation of proposed mergers and acquisitions.
In recent years, the difficulty and increased complexity of regulating  merged companies has been cited by two state commissions denying  proposed mergers in their states. For example, a state commission official  in Montana told us the commission denied a merger in July 2007, between  Northwestern Company and Babcock and Brown Infrastructure, an  Australian company, even though it had been approved by FERC. This  merger involved a Montana regulated utility, whose headquarters was  located in South Dakota and was being bought by a foreign-owned holding  company. According to this official, the commission denied the merger  partly due to concerns about regulating the utility under such a corporate  combination. He noted concerns that no top corporate officials would be  located in Montana and that the time zone differences with the Australian  company made contact with those officials more difficult in dealing with  regulatory issues. As a result of the denial by the state commission, the  merger was not allowed to proceed. In a different proposed merger in  Oregon, state utility commission officials told us they denied the proposed  merger in March 2005 between Portland General Electric, one of their  regulated utilities and the Texas Pacific Group, a private equity fund  company. They noted under their implementation of Oregon’s statutes,  mergers must meet two standards: (1) they must provide net benefits to  consumers and (2) they cannot harm consumers. Officials in Oregon noted  that the state commission was concerned that consumers could be harmed  because regulating the resulting company would be more difficult due to  the financial complexity of the new ownership arrangement. In addition,  the commission was concerned that consumers faced potential harm due  to risks posed by high levels of debt and the private equity firm’s short- term business plan. Although an application had been made for a review at  FERC it was withdrawn in April 2005 prior to FERC review.
State commission views regarding potential mergers and acquisitions are  of increasing importance in the financial community, as well. Officials  from the financial community noted they believe state commissions may  be highly suspicious of some of the new corporate structures being  proposed, especially the role of private equity firms. They also noted that  some commissions have expressed significant concerns over the  formation of vast utility companies operating in multiple states. As a result  of these and other concerns, these officials reported that some companies  potentially interested in merging with or acquiring utilities have been  reluctant to propose transactions so far.

		Most States Have Authorities over Affiliate Transactions, but Many States Report Auditing Few Transactions

Almost all states report having authorities over affiliate transactions or  regular reporting of such transactions, or both. Nationally, 49 states noted  they have some type of affiliate transaction authority. These authorities,  however, vary from prohibitions against certain types of transactions, or  prior approval by the commission for transactions over a certain dollar  amount, to less restrictive requirements such as allowance of the  transaction without prior review. In some cases state commission  authorities permit them to disallow these transactions at a later time if  they were inappropriate. In fact more than half the states (27) reported  that under their authority, affiliate transactions did not require prior  commission approval, but could be reviewed and disallowed later. Such a  disallowance would result in the cost of the transaction not being passed  on to consumers or being recovered from the company. Only 3 states  reported that affiliate transactions always needed prior commission  approval.
Nearly all states (41) require utilities to report affiliate transactions at least  annually, or more frequently. These reports varied, however, in frequency  of reporting, types of transactions requiring reporting, and the detail of  reporting. For example, some states required reporting all transactions at  least annually, while others required reporting of only certain types of  transactions or just reporting the total dollars spent by each affiliate.  Several of the state commissions we interviewed noted the importance of  strong state authority over affiliate transactions. Staff in one state noted  their commission must preapprove any affiliate transactions over $25,000  and conditions for approval were stringent. In some instances the state’s  attorney general stepped in to stop companies from going ahead with  affiliate transactions that had not been preapproved.
Some states are concerned that they may not have sufficient authorities to  oversee affiliate transactions, after the repeal of PUHCA 1935. In our  survey, some state commissions expressed a need to increase their  authority over affiliate transactions. During the course of our work one  state took action to increase its authority. In 2006, the California  commission strengthened existing affiliate transactions authorities, partly  due to concerns related to the repeal of PUHCA 1935. The new rules  clarified the scope of allowable utility affiliate transactions and tightened  the rules on when and how specific services, such as, legal services could  be shared between affiliates and the regulated utility.
Despite various authority governing the prior authorization and disclosure  of affiliate transactions, many states responding to our survey reported  they audit few if any affiliate transactions or dedicate much staff time to  reviewing these transactions. The majority of states reported they have  audited 1 percent or less of these transactions over the last 5 years and  dedicated no staff time to reviews or audits over the last year. Table 4  shows that many states are not performing reviews or audits of affiliate  transactions.
Since the passage of EPAct several aspects of monitoring of affiliate  transactions were raised as key challenges by several state commissions  responding to our survey and during our interviews. For example, an  attorney from one state utility commission expressed concerns about  having enough resources and expertise to enforce existing authorities. He  noted that holding company and affiliate transactions can be very complex  and time-consuming to review. He noted these reviews are resource  intensive, since determining whether a transaction is unfair may require  detailed analysis of the transaction and the market for the good or service  that was subject of the transaction. Another expert, with extensive  experience with FERC and several state public utility commissions noted  that on the basis of his experience, states do not generally have the  resources to effectively review affiliate transactions, particularly when  they are multistate in nature. Similarly, a consultant whose firm does  numerous affiliate transaction audits in many states, noted in a March 2007  FERC technical conference on related issues that many states, even when  they have significant authority, lack staff to review transactions. Further,  he noted that state commissions often lack the staff expertise to  adequately address the accounting and financial operations aspects of  these affiliate relationships as well as the risks inherent to audits of  affiliate transactions  Some states, however, do put special emphasis on auditing affiliate  transactions. All four states we visited routinely audit affiliate  transactions. Commission officials in one of these states told us they  commit the equivalent of 2.5 full time employees to auditing affiliate  transactions for reasonableness (e.g., prices appear to be correct). If they  find unreasonable transactions the commission can adjust future  electricity rates to correct for the problem (e.g., they disallow some or all  of the value of the transaction and remove that amount from prices that  consumers pay). Their goal is to audit each utility every 2 years and they  estimate that over the last 5 years they have audited 100 percent of all  utility affiliate transactions. As part of their audits the staff requests SEC  filings, monitors credit reports, and reviews other related financial data.  However despite this effort, representatives from two consumer groups in  this state expressed concerns that affiliate transactions are so complex  that the state commission just does not have enough resources to fully  audit these transactions. Two additional states commissions we  interviewed contract with outside auditors to do specific audits of the  affiliate transactions of the state’s regulated utilities biennially. State  commission staff in one of these states noted their audits review company  affiliate transactions for appropriateness and proper pricing. The purpose  of the audits is to show the transactions were made fairly to the utility and  that ratepayers are not paying more than they should. One auditor who  had done affiliate transaction audit work for another state we visited  described that state’s approach to auditing affiliate transactions as being  very aggressive in that their audits involved significant data analysis and  the reports contained considerable detail about the findings.

		Some States Report Not Having Access to Holding Company Books and Records

All states regularly require financial reports from utilities and are able to  obtain access to the financial books and records of these utilities that  document costs, but access beyond the utility varies. All 49 states that  responded to this survey question, noted that they require utilities to at  least provide financial reports. Most states (41) only require such reporting  by the utility but 8 states require reports that also include the holding  company or both the holding company and the affiliated companies. Of the  48 states that responded to our questions about the frequency of required  reporting, 35 require annual reports; 6, quarterly reports; and 7, monthly  reports.
Although all states but 1 report having access to the books and records of  the utilities in their states, some report they do not have such access to  other companies within the holding company. Nearly one-third of the  states reporting said they do not have access to the books and records of  the utility holding company. Similarly, over 40 percent of the states  reporting said they do not have such access to affiliated nonutility  companies. Table 5 shows state commission access to different parts of  holding companies.
Utility experts also expressed concerns over state commissions’ access to  the books and records of holding companies or other affiliate companies  either through state authority or through assistance by FERC. Lack of  such access, these experts noted, may limit the effectiveness of state  commission oversight and result in harmful cross-subsidization because  the states cannot link financial risks associated with affiliated companies  to their regulated utility customers. Experts expressed concern over state  commission authority. For example, the president of an audit company,  who currently works with two-thirds of the utility commissions across the  country and completed many affiliate audits, noted that there is a lack of  clear authority in some states to gain access to the key records in other  states, even though the utility shares common services across the states  that bear upon the utilities transactions. Similarly, one commission official  told us that it is difficult to get access using state authority alone. He noted  that holding companies can set up numerous roadblocks for staff to access  the records. Consistent with this view, in comments to our survey  concerning key challenges since the passage of EPAct one state noted a  concern about the responsiveness of a parent holding company based out  of state to specific in-state inquiries.
While the PUHCA 2005 provisions of EPAct provide states with additional  access to books and records, some states expressed reservations relating  to the level of protection this offered their states. In response to our  survey, 8 states noted that access to books and records, if they had to gain  assistance through FERC, offered little or no protection to their states,  while another 14 states noted this offered only some protection. In  contrast, only 3 states noted that FERC assistance in gaining access  offered great protection. Commission staff in one state told us that  obtaining such information requires state commissions to be very specific  in identifying the necessary information. However, this commission staff  noted that it may be difficult to develop such detailed knowledge.  According to this state commission staff, such a detailed requirement to  access information may limit their ability to conduct adequate and timely  affiliate transaction audits. A utility expert who has experience with both  FERC and state commissions also noted that states often follow leads and  do not always know the specific information to support a detailed request.  As a result of the potential need to develop a series of detailed requests, it  may take longer to complete an audit. He stated this creates significant  risks for states and their ratepayers as the full scope of utility transactions  cannot be understood without seeing the entire trail of these transactions  through the holding company and affiliate books and records.

		States Foresee Needing Additional Resources

States and other officials expressed concerns that the state commissions  do not currently have sufficient resources and may need additional  resources to respond to the changes from EPAct. Since states have gained  over 2 years of experience since EPAct was passed, many believe they  now need additional resources to carry out their responsibilities.  Specifically, as seen in table 6, 44 percent of the states responded to our  survey that they need additional staffing or funding, or both, to deal with  the changes from EPAct. Further, 6 out of 30 states raised staffing as a key  challenge in overseeing utilities since the passage of EPAct. One state, for  example, noted monitoring of affiliate relationships as a key challenge,  particularly in light of its current staff and resources. Since the passage of  EPAct, 8 states have proposed or actually increased staffing.
Staffing concerns were also mentioned as problems by officials at the  commissions or by representatives of consumer groups in 3 of the 4 states  we visited as well others. For example, an official from the one of these  state’s commissions noted that the state, in response to tighter budgets,  had reduced staffing levels across-the-board including the utility  commission and that the median age of the commission staff was now 56  and could soon face a wave of retirements. In addition, representatives of  two consumer groups in another state expressed concerns that the  commission does not have enough resources to oversee or audit affiliate  transactions. In addition an official from a national credit-rating agency  expressed concern that some state commissions may not fully appreciate  the degree of difficulty they could face with existing staffs in the years  ahead.

	Conclusions

The repeal of PUHCA 1935 further opened the door for new and different  corporate combinations, including the ownership of utilities by complex  international companies or equity firms, potentially providing needed  investment to the utility industry. However, this potential to increase  investment comes at the potential cost of making regulation more difficult.  Further, the introduction of new types of investors, with incentives that  may be at odds with traditional utility company services, could change the  utility industry into something quite different than the industry that FERC  and the states have overseen for decades. Despite these evolving changes,  FERC continues to rely to a considerable degree on companies to self- certify that they will not cross-subsidize and self-report when they do. On  the basis of our discussions with industry, state regulators, and audit  experts, this reliance on self-enforcement—backed up by a few audits— does little to convince consumers and other market stakeholders that  FERC’s oversight is sufficiently vigilant.
As FERC and states approve mergers, the responsibility for ensuring that  cross-subsidization will not occur shifts to FERC’s Office of Enforcement  and state commission staffs. However, in the case of FERC this presents a  challenge because FERC lacks a formal way of allocating resources to the  areas of highest potential risk—leaving audit resources deployed in an ad  hoc manner. Without a risk-based audit approach, FERC may not allocate  its scarce audit resources to the right areas, potentially allowing cross- subsidization to go undetected. In addition, since states generally review  only a very small percent of affiliate transaction to identify potential cross- subsidization and many reported resource constraints, some states’  detection of cross-subsidization may be limited.
By reassessing its audit approach, how it shares the results of its audits,  and its resources, FERC could take important steps to demonstrate its  commitment to ensure that companies are not engaged in cross- subsidization at the expense of consumers. Absent such a reassessment,  the potential exists for FERC to approve the formation of companies that  are difficult and costly for it and states to oversee and potentially risky for  consumers and the broader market.

	Recommendations for Executive Action

We recommend that the Chairman of the Federal Energy Regulatory  Commission (FERC) take the following actions:  1.  Develop a comprehensive, risk-based approach to planning audits of  affiliate transactions in holding companies and other corporations that  it oversees to more efficiently target its resources to highest priority  needs and to address the risk that affiliate transactions pose for utility  customers, shareholders, bondholders, and other stakeholders.  2.  As an aid to developing this risk-based approach, FERC should  develop a better understanding of the risks posed by each company by  doing the following:  a.  Monitoring the financial condition of utilities to detect significant  changes in the financial health of the utility sector, as some state  regulators have found it useful to do. To do this, FERC could  leverage analyses done by the financial market and develop a  standard set of performance indicators.  b.  Developing a better means of collaborating with state regulators to  leverage resources already applied to enforcement efforts and to  capitalize on state regulators’ unique knowledge. As part of this  effort, FERC may want to consider identifying a liaison, or liaisons,  for state regulators to contact and to serve as a focal point(s).  3.  Develop an audit reporting approach to clearly identify the objectives,  scope and methodology, and the specific findings of the audit,  irrespective of whether FERC takes an enforcement action, in order to  improve public confidence in FERC’s enforcement functions and the  usefulness of audit reports on affiliate transactions for FERC, state  regulators, affected utilities, and others.  4.  After developing a more formal risk-based approach, reassess whether  it has sufficient audit resources to perform these audits. If FERC  believes that it does not have sufficient resources to conduct adequate  auditing of the companies that it oversees within its existing staff and  budget, FERC should provide this information to Congress and request  additional resources.

	Agency Comments and Our Evaluation

We provided a draft of our report to FERC for review and comment. We  received written comments from FERC’s Chairman and that letter and our  detailed response is presented in appendix II. In his comments, the  Chairman strongly disagreed with the report finding that FERC does not  have a strong basis for ensuring that utilities do not engage in harmful  cross-subsidization and noted that he believed the report contained  inaccuracies and misunderstandings. We disagree with the Chairman’s  characterization of our report and note that the letter’s assertions about  some aspects of FERC’s operations are, in fact, quite different than the  views of numerous commission staff and experts with whom we met over  the course of the past year as well as FERC’s own Policy Statement on  Enforcement. In addition, we believe that the repeal of PUHCA 1935  represents an important change in the context of FERC’s regulation of the  industry and, in light of this change, FERC should err on the side of a  “vigilance first” approach to preventing potential cross-subsidization by  enhancing its current approach to audit planning and reevaluating audit  resources. Overall, we believe our report presents a fair and balanced  presentation of the facts and issues associated with FERC’s oversight and,  as a result, encourage the Chairman to fully consider our  recommendations. FERC also provided technical comments, which we  incorporated, as appropriate.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 14 days from the  report date. At that time, we will send copies to the Chairman of the  Federal Energy Regulatory Commission (FERC) and other interested  parties. We will also make copies available to others upon request. In  addition, the report will be available at no charge on the GAO Web site at  http://www.gao.gov.
If you or your staff have any questions about this report, please contact me  at (202) 512-3841, or gaffiganm@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. GAO staff who made major contributions to this report are  listed in appendix III.

Appendix I: Scope and Methodology

In this report, we agreed to determine: (1) the extent to which FERC  changed its merger or acquisition review process and postmerger or  acquisition oversight to ensure that potential harmful cross-subsidization  by utilities does not occur, and (2) the views of state utility commissions  regarding their current capacity, in terms of regulations and resources, to  oversee utilities.
Overall, to address the objectives we reviewed relevant reports, examined  existing data, interviewed key officials and collected new data and  information from 49 states and the District of Columbia. We interviewed  and obtained documentation, when applicable, from a wide range of  stakeholders including federal and state officials, industry officials, and  various other special groups and organizations. We interviewed federal  agency officials at FERC, the Department of Justice, the Federal Trade  Commission, and the Securities and Exchange Commission (SEC). We  obtained views from organizations including the National Association of  Regulatory Utility Commissioners (NARUC), American Antitrust Institute,  National Regulatory Research Institute, American Public Power  Association, Electricity Consumers Resource Council, Edison Electric  Institute, and Public Citizen. In addition, we obtained information and  views on the effects of the Energy Policy Act of 2005 (EPAct) on  investment in the utility industry from two national credit reporting  agencies, Standard and Poor’s and Fitch Ratings, and the investment  advisor Goldman Sachs Company.
To specifically determine how FERC has changed its merger review  processes and postmerger oversight to prevent cross-subsidization  affecting utilities, we reviewed the Energy Policy Act of 2005 and the  Public Utility Holding Company Act of 2005 (PUHCA 2005) provisions in  EPAct related to FERC’s review of mergers and acquisitions, access to the  books and records of companies in holding company systems, and  assessment of civil penalties on companies that violate its rules. We  reviewed information on the number, identity, and outcome of mergers  that FERC has reviewed, audits of affiliate transactions that FERC has  conducted, and civil penalties that FERC has assessed since passage of the  2005 legislation. We interviewed officials in FERC’s Office of Enforcement,  Office of Energy Markets and Reliability, and Office of General Counsel  concerning their plans to implement the statutory provisions of EPAct,  including the PUHCA 2005 provisions and their development or update of  new and existing rules, policies, and procedures regarding merger review,  law enforcement, and audits. We performed a limited review of selected  FERC merger orders and audit reports, including 18 completed audit  reports the commission identified as pertaining to affiliate transactions, to  assess FERC’s practices for reviewing mergers and conducting audits to  prevent cross-subsidization.
To address the second objective and gain insight into states’ views on their  current capacities to oversee utilities, we visited four states, California,  New Jersey, Oregon, and Wisconsin and conducted an Internet-based  survey with staff from the public utility commissions in the 50 states and  District of Columbia. In our site visits we met with officials from the public  utility commissions, representatives of two utilities in each state, in some  cases the utilities’ internal and external audit firms, and we also obtained  views from representatives of consumer protection groups. We obtained  information on the state’s authorities, actions, and resources relating to  mergers, affiliate transactions, financial reporting, and access to company  records. We gathered opinions relating to the federal regulatory changes  and current or planned enforcement by FERC. We selected these states  through a literature search, discussions with representatives of NARUC, a  national organization representing state utility commissions, and from  some initial discussions with selected states. We chose several states to  visit that had strong protections related to holding companies/affiliates  and utilities prior to the repeal of PUHCA 1935. We also selected two  states of the four that were considering additional consumer protections  directly due to the repeal of PUHCA 1935. We also discussed key issues  with commission officials from Kansas and Montana.
Since little detailed information existed that summarized the authorities,  actions, and resources of all the states’ regulatory oversight related to  utilities and holding companies, we supplemented our audit work with a  survey of the staff of the 50 states’ and District of Columbia’s public utility  commissions. The survey was developed between September and  December 2006. Because we administered the survey to all of the state  public utility commissions, our results are not subject to sampling error.  However, the practical difficulties of conducting any survey may introduce  other types of errors, commonly referred to as nonsampling errors. For  example, differences in how a particular question is interpreted, the  sources of information available to respondents in answering a question,  or the types of people who do not respond can introduce unwanted  variability into the survey results We included steps in the development of  the survey to minimize such nonsampling error.
To reduce nonsampling error, we had cognizant officials at NARUC review  the survey to make sure they could clearly comprehend the questions. We  also pretested the survey with two states to ensure that (1) the questions  were clear and unambiguous, (2) terminology was used correctly, (3) the  survey did not place an undue burden on commission officials, and (4) the  survey was comprehensive and unbiased. In selecting the pretest sites, we  sought the advice of NARUC and selected states that had different types of  regulatory requirements. We made changes to the content and format of  the final survey based on the pretests.
We conducted the survey using a self-administered electronic  questionnaire posted to GAO’s Web site on the Internet. To ensure that we  would obtain information from commission staff most knowledgeable, we  first obtained a list of key contacts from NARUC. We sent e-mail  notifications to the Chairmen of the public utility commissions informing  them of the purpose of our survey and requesting that they make any  changes on the contact list provided to us by NARUC that would be most  appropriate. After we made changes to our contact list, we sent e-mail  notifications to alert the appropriate officials of the forthcoming survey.  These were followed by another e-mail containing unique passwords and  usernames that enabled officials to access and complete the survey and  notifying officials that the survey was activated. Although the survey was  available on the Web until June 30, 2007, we followed up with officials first  through e-mail reminders and then by telephone to encourage them to  respond. We received survey responses from 49 states plus the District of  Columbia (each state could only provide one response). One state did not  respond due to other high priorities at the time of our survey. We edited all  completed surveys for consistency, but it was agreed we would not follow  up with states relating to specific responses, but only to encourage them  to send us their survey.
Detailed survey results are available at:  http://www.gao.gov/special.pubs/gao-08-290sp.

Appendix II: Agency Comments and Our Response

	GAO Comments

The following are GAO’s responses to the Federal Energy Regulatory  Commission’s comments on our draft report as outlined in its January 22,  2008, letter.  1.  Our statement in the summary Highlights of the draft report referring  to Energy Policy Act (EPAct) shifting sole responsibility from the  Securities and Exchange Commission (SEC) to Federal Energy  Regulatory Commission (FERC) was not intended to imply that, prior  to the passage of EPAct, FERC had no role in regulating public  utilities. We simply wanted to point out that, after EPAct, sole  responsibility for oversight of potential cross-subsidies rested with  FERC. We revised the Highlights text to clarify the historical roles of  FERC and SEC. Other information in the draft report accurately  reflected each agency’s role.  2.  As a point of clarification, we make no explicit or implicit  recommendation regarding “resurrecting” the Public Utility Holding  Company Act of 1935 (PUHCA 1935). We share FERC’s apparent view  that this was not the intent of Congress and the President in repealing  PUHCA 1935. Our report focused on FERC’s new role as the sole  federal agency responsible for enforcing prohibitions against cross- subsidization.  3.  We acknowledge that FERC has executed the administrative steps to  begin implementing EPAct, made changes such as adding a “code of  conduct” for utilities and their affiliates as well as other changes  discussed in the letter within the short time frames provided under  law—and recognized this in our draft report. However, as we noted in  our draft report, our view and the view expressed by FERC staff we  met with during our investigation is that FERC’s overall merger review  process remains largely unchanged except that FERC now requires  companies to attest in writing that they will not engage in unauthorized  cross-subsidization. We commend FERC for its ongoing outreach  efforts, such as conferences to solicit stakeholders’ views, but we  maintain that those efforts have, so far, resulted in few changes to  FERC’s merger review process. Accordingly, we made no change to  our draft report in response to this comment.  4.  The Chairman of FERC said that we incorrectly conclude that the  commission intends to rely on self-reporting as the primary  enforcement mechanism to prevent cross-subsidization but did not  explain what mechanism(s) FERC will use to detect potential cross- subsidization. To be clear, our draft report stated that once a merger  has taken place, FERC intends to rely on its existing enforcement  mechanisms—primarily (1) companies’ self-reporting and   (2) compliance audits—to detect potential cross-subsidization. In  addition, the draft report stated that FERC officials also said they used  their “hotline” reporting system to identify potential violation of FERC  rules. Throughout the course of our audit work, key FERC staff,  including those involved in enforcement, noted that self-reporting was  a central element in enforcing FERC’s overall enforcement approach,  including all of the statutes, orders, rules, and regulations the  commission enforces. FERC officials also provided a copy of FERC’s  October 25, 2005, Policy Statement on Enforcement—which  prominently features self-reporting—in the context of our discussion  of how FERC planned to enforce the prohibitions on cross- subsidization. We share the views of the Chairman that self-reporting is  not an effective method to reliably detect cross-subsidization. The  Chairman also said that we may be confusing self-reports regarding  standards of conduct violations with self-reports regarding cross- subsidization. We have not confused these two distinct reporting  mechanisms as our report focuses on concerns related to potential  cross-subsidization. As the draft report also discusses, the second key  mechanism that FERC intends to use to detect potential cross- subsidization, and its only proactive enforcement component, is a  limited number of compliance audits. We believe that audits provide  tremendous potential value in enforcing the prohibitions against  unauthorized cross-subsidization (delineated in detail by FERC on  pages 3 through 7 of the Chairman’s letter and addressed in our  comment 3), especially in light of FERC’s new role as the federal  agency primarily responsible for the oversight of public utilities. We  believe that audits of companies and transactions should play a key  role in the FERC’s overall enforcement strategy, particularly in the  area of cross-subsidization. With regard to preventing potential cross- subsidization through rate reviews, we are aware of this process and  recognized in our draft report that FERC retains a limited ratemaking  role and, as such, may have opportunities to establish cost recovery  rules prospectively in these proceedings. We added additional  language to our draft report to indicate that FERC may examine costs  incurred by utilities for rates it still sets and, in so doing, decide which  costs may be lawfully included in rates charged to customers. We also  recognize that FERC allows third parties to report potential violations  using its hotline or by filing a complaint that the terms of the approved  rates are being violated. We revised our draft report to better reflect  that such reports and complaints may lead to a FERC investigation.  However, because we have no way of knowing (1) whether third  parties will be a reliable enforcement tool, (2) how likely FERC is to  conduct rate setting procedures, and (3) FERC’s plans currently reflect  only 3 audits, we remain concerned that FERC is overly reliant on self- reporting.  5.  We relied on FERC officials to identify the universe of companies it  could audit and how many it planned to audit for the information  contained in our draft report. In addition, we included suggestions  from FERC staff regarding caveats to its audit responsibilities and  overlaps raised in the Chairman’s letter. For example, the draft report  noted that there was overlap between the various categories and that  the Regional Reliability Organization, according to FERC, would be  responsible for the initial audits of these 1,510 companies.  Nonetheless, we moved our table note to the body of the report to  emphasize these overlaps and the fact that the number of potential  audit candidates could be lower than the universe of 4,700 companies  identified by FERC. It is important to note, however, that some of the  audits may be quite different and require different resources than  audits of affiliate transactions. For example, audits of compliance with  reliability rules may focus on whether companies have conducted  sufficient training of staff, not addressing the unique accounting issues  associated with affiliate transactions. While this change in the text of  the report may help the reader better understand overlaps in the  universe of companies, it is still not clear from the Chairman’s  comments how many audits will ultimately be required of these  companies, the nature of the audits or the resources needed, and how  they would affect the resources available for audits of affiliate  transactions. Regarding the frequency of audits, our draft report states,  “At its planned 2008 audit rate of 3 companies, it would take FERC 12  years to audit each of these companies once.” We recognize that the  current audit rate may change since such determinations are made  annually, but we use these data—as provided by FERC—as the best  available at the time of our review. We added an explicit notation that  the number of audits may change to further clarify the statement  already in the report.  6.  The Chairman stated that the draft report incorrectly portrays FERC’s  method of selecting audit candidates as informal and that FERC  actually uses a variety of methods to assess the individual and  collective risks posed by companies it oversees. However, during the  course of our year-long engagement, including discussions with key  FERC officials, the process was described as informal and did not  mention the other mechanisms described in the Chairman’s letter. In  addition, FERC staff, when we asked for a record of a risk-based  analysis or the criteria FERC would have used to conduct such an  analysis, were unable to provide them and told us audit selections  were based on informal discussions with knowledgeable senior FERC  staff. Although FERC officials may individually consider risk as they  discussed audit planning in these informal discussions—and we noted  in the draft report these officials believe their judgments provide a  reasonable picture of risk—such considerations are not sufficiently  formal or systematic and could change as staff in key positions change.  In our view, a risk-based audit planning approach should be  sufficiently rigorous and systematic to ensure that it reliably and  consistently guides FERC in assessing individual company risks and  the overall risks posed by the companies collectively and making audit  selections accordingly. Furthermore such an approach should be  flexible enough to meet FERC’s current and expected future auditing  demands now that it is solely responsible for detecting potential cross- subsidization. We noted in our draft report that some federal agencies  develop their own statistical measures of risk, derived in some cases  from models although there are other methods. It may or may not be  appropriate for FERC to use this type of tool but we want FERC to be  aware that there are other ways of more formally considering risk in  agency decision making. In any case, designing a formal risk-based  approach will take time and effort and FERC may want to consider  consulting with outside experts. It was our intent, by excluding these  statistical methods from our recommendation, to provide the  Chairman with flexibility on how best to implement a more formal,  risk-based approach. With regard to FERC’s comment about its  outreach to states during audits, we commend FERC for these efforts  when conducting compliance audits, but also believe FERC could  benefit from the states’ expertise and knowledge earlier in the process  when determining which companies to audit. We continue to believe  that our recommendation, if implemented, would improve the  likelihood that the audits will be most effective. As such, we made no  change to our draft report in response to these comments.  7.  We are aware that FERC has established many expectations and  rules—through both the company attestation process and its generic  prohibitions on cross-subsidization—but we have concerns as to  whether FERC has devoted enough attention to the formidable task of  enforcing those rules by detecting violations. We recognize the  importance of company attestations that they will not engage in cross- subsidization for use in developing a formal record from which FERC  can potentially take enforcement actions. We share FERC’s view that  companies should honor their commitments to the federal  government, but know that staff turnover at these companies can be  high, and that financial and other circumstances of companies can, and  do, change. Because of this, and other factors, we believe that it is  important to recognize the value of these company attestations in  creating a record, but also believe that it is important to be vigilant and  proactive in looking for potential violations. As a result, we made no  change to the draft report in response to this comment. With regard to  the Chairman’s related comment about FERC’s generic rules, we agree  that these rules delineate FERC’s expectations for compliance;  however, while these rules define potential violations, they do not  detect them. Therefore, they must be coupled with vigilant  enforcement mechanisms, such as audits to detect potential cross- subsidization. It is these mechanisms that the draft report concludes  are inadequate in FERC’s approach. We made no change to our draft  report for this comment. With regard to the Chairman’s comment  about rate review, we discuss this point in our response to comment 4.  8.  As noted above in comment 6, we are pleased that FERC includes  discussions with state regulators when it conducts audits, however we  believe FERC could further benefit from their expertise when selecting  which companies to audit. With regard to financial indicators, as noted  in the draft report, we believe that the deterioration of a company’s  financial condition may raise the potential for financial abuses. In that  regard, how the financial community values a company’s stocks or  bonds is used as a high-level example of financial indicators that could  be helpful to FERC. We do not suggest in our report that FERC should  examine only stock and bond values; rather, we suggest that FERC  should be gauging risk by, among other things “monitoring the  financial condition of utilities.” Companies’ financial data is a window  into their risks and an opportunity to leverage the financial  community’s research. Such research is not strictly limited to stock  and bond prices; it could include other appropriate metrics, such as  financial ratios. In implementing our recommendation, FERC may  wish to consult with financial experts to develop a set of useful  metrics to monitor. We believe, as do others we spoke with in states  and the financial community, that such indicators could provide  additional insights into the risk posed by individual companies and the  financial health of the overall industry. We made no change to our  draft report in response to these comments.  9.  As the Chairman indicates, FERC is in the process of implementing our  recommendation to improve the usefulness of its audit reports. We  discussed the need to improve the transparency of its audit  requirements and actions during our discussions with FERC audit  officials and encourage FERC to fully implement this recommendation.  10. As noted in the draft report, we believe that FERC should develop a  formal risk-based audit planning approach to help inform its decisions  about which companies to audit but also to assist it in better  leveraging its resources. The development of such an approach could  also help FERC determine whether it needs additional audit staff  resources to fulfill its oversight responsibilities, particularly given that  SEC no longer conducts such audits. We continue to encourage FERC  to assess its resources for auditing and enforcement efforts and did not  change our recommendation.  11. We agree that the Public Utility Holding Company Act of 2005 (PUHCA  2005) provisions in EPAct grant states the authority to obtain this  information directly. Our statements related to state commissions’  access to books and records of utilities, holding companies, and  affiliate companies was not intended to imply that states must go  through FERC for access to this information. However, the draft report  points out that this is the perception or experience in some states. For  example, in response to our state survey, 14 states reported their state  commission did not have access to these records at the holding  company and 20 states reported this problem for affiliated nonutility  companies. Further, as we reported, officials from companies that  conduct audits for the states noted difficulties in obtaining access to  out-of-state companies’ books and records. We did not evaluate states’  reasons for these views. Since there seem to be misunderstandings or  misinformation about the access granted under the PUHCA 2005  provisions in EPAct, FERC could play an important role in clarifying  these authorities or providing assistance in response to states’  concerns, or both. In response to this comment, we clarified the  language related to states’ access to companies’ books and records.  12. The intent of our discussion of mergers in the draft report is not to  criticize FERC’s merger review decisions or the conditions FERC  placed on mergers. Rather, our intent is to provide some perspective  on the number and status of FERC’s merger reviews and their  disposition. Nonetheless, we note that FERC has been supportive of  mergers—a point repeated by numerous FERC staff—and that FERC  believes that it has certain obligations to approve mergers. Regarding  FERC’s concern that the draft report does not recognize that “new  types of investors” have acquired U.S. utilities before the repeal of  PUHCA 1935, the draft report described such transactions in its  discussion of changes to the strict limitations in this act. As such, we  recognize that while PUHCA 1935 placed limitations on what types of  companies could control utilities, some investors were allowed to  invest into the utility industry if they met certain financial  requirements (see GAO-05-617). Because these financial requirements  placed limits on the companies outside the utility sector, the number  of these types of investments was limited. In our discussions with  financial experts, we found that, with the repeal of PUHCA 1935, more  companies from outside the utility sector are considering utility  mergers or acquisitions, or both, which could broaden the pool of  potential investors. We revised the text of the report to better reflect  these considerations.  13. As a point of clarification, our report conveys the views of state  commission staff; we did not analyze state commissions’ auditing  efforts or other state regulations or responsibilities. As such, we make  no criticism of state commissions with regard to auditing, or any other  areas of state regulation or responsibility. With this in mind, FERC  should be aware that it is the view of state regulators––not based on  evaluation by GAO––that state commissions are generally not  conducting extensive compliance audits because of limited staff and  other factors. On numerous occasions, FERC officials noted that state  regulators, outside audit firms, and others are conducting audits of  affiliate transactions; however, based on our discussions with each of  these groups, we did not find this to be the case. We believe FERC  should consider this information as it develops a formal risk-based  audit planning approach, therefore we did not change the draft report  in response to this comment.  14. With regard to accurately representing the percentage of companies  that FERC plans to audit in 2008, FERC determined that 36 of 149  holding companies are subject to its authority under the PUHCA 2005  provisions in EPAct and told us it planned to audit 3. Although we  agree that certain exemptions are required by statute, we did not  conduct a legal analysis of these exceptions and waivers required by  law nor did we review FERC’s evaluation of these applications to  determine if the 36 holding companies (of the 149) accurately reflect  the potential universe of companies to be audited. Because we did not  make these evaluations, we revised the Highlights page of the draft  report to reflect that FERC said it would audit 3 of the 36 companies it  regulates, as we more fully described in the body of the report.  15. We revised footnote number 2 in the draft report to further clarify  what authority FERC has with respect to Texas.  16. We disagree that the draft report suggests that, before the passage of  EPAct 2005, the commission was not concerned with cross- subsidization. The draft explicitly stated that preventing cross- subsidization has been a long-standing responsibility of FERC and that  preventing it at the point of merger review is new. As such, we made  no change to the report in response to this comment.  17. We note that our draft report did not have an objective to determine  the adequacy of FERC’s merger review and, as such, makes no finding  regarding the quality of the FERC’s review. The draft report describes  the record-based analysis noted in the Chairman’s comment, and  participants’ possible roles, and states that FERC does not  independently develop such information—a point that was repeatedly  noted by FERC officials; rather, its review is limited to reviewing the  record. We agree that FERC must make its decisions based on this  record, and that it can take additional steps to make sure the evidence  provided is sufficient. We clarified the language in the report to note  that FERC can request that applicants provide additional information  and perform its own independent analysis of record evidence.  18. During our review, we sought input from many stakeholders and  involved parties. The report referenced by the Chairman’s comments  provides one insight as to how industry perceives FERC’s actions but  does not provide the sole insight, and we disclosed the report’s author  and interest group affiliation so that the readers are aware of their  interests. Similarly, the company official cited in the Chairman’s next  comment reflects one example of concerns expressed by companies.  In either case, we recognize—as should any reader of this report—that  stakeholders have specific interests in FERC’s decisions and  operations. However, it is important to note that some of the industries  FERC regulates are expressing opinions similar to views we have  developed independently during the course of our work in this area— namely that FERC needs to provide greater transparency of its  enforcement functions. Furthermore, it is also worth noting that the  need for greater transparency has been a theme over the last several  years for GAO’s work regarding FERC, which has previously  recognized this and made strides toward improving transparency. It is  encouraging to point out that the Chairman recently acknowledged a  similar view and committed FERC to improving the transparency of its  enforcement functions. We made no change to our draft report in  response to these comments.  19. The draft report contained language stating that EPAct provided FERC  specific postmerger access to books, accounts, memos, and financial  records of utility owners and their affiliates and subsidiaries, therefore  we made no change to our draft report in response to this comment.  Regarding the comment about “compliance with PUHCA 2005”, we  deleted the language in the draft report related to company  compliance.  20. We are not advocating that FERC allow nonfederal parties, such as  FERC-regulated companies, to determine auditing priorities and agree  that this would pose significant risks. We believe our recommendation  that FERC seek input from stakeholders, such as the financial  community and state commissions––many of whom have more  frequent or more recent dealings with the utilities, or may have more  recent audit experience with these companies, or both––may be an  opportunity for FERC to better leverage these resources. Such input,  along with the other information sources already at FERC’s disposal,  could help inform FERC’s decisions but should not substitute for the  risk-based decision-making criteria that we recommend FERC develop  as part of a risk-based audit planning approach. We made no change to  our draft report in response to these comments.  21. We recognize that the current FERC staffing choices, as they relate to  auditing, leave few resources available to cover a broad range of  potentially auditable entities. It is clear that the context within which  the FERC audit staff are operating has changed in important ways and  may require a reassessment of FERC resources, therefore we  recommended that FERC seek additional resources, if needed. It is in  this vein that we have outlined a path for FERC to make such a  reassessment and to report its results to Congress so that it could  potentially consider such a request. In addition, as noted in earlier  comments, the development of a risk-based audit planning approach  could also help FERC allocate its existing resources most efficiently  and effectively. We made no change to our draft report in response to  these comments.  22. Our draft report states that FERC has not yet completed any affiliate  transaction audits under the PUHCA 2005 provisions of EPAct, but  notes that FERC intends to rely on its existing, “exception-based,”  reporting that it used for other types of audits. As noted in the draft  report, our examination of FERC reports issued under this exception- based reporting policy raised concerns. As a point of clarification, our  concern about this policy is meant to provide constructive criticism so  that future reports on affiliate transactions could be more transparent  and useful to FERC staff, states, and market participants. We made no  change to our draft report in response to these comments.

Appendix III: GAO Contact and Staff Acknowledgments

	GAO Contact

	Staff Acknowledgments

In addition to the contact named above, key contributors to this report  included Dan Haas, Jon Ludwigson, Randy Jones, and Tony Padilla.  Important assistance was also provided by Lee Carroll, Brad Dobbins,  Kevin Dooley, Dan Egan, Gloria Hernandez-Saunders, Allison O’Neill,  Glenn Slocum, Jay Smale, and Barbara Timmerman.

Summary:
Why GAO Did This Study

Under the Public Utility Holding Company Act of 1935 (PUHCA 1935) and other laws, federal agencies and state commissions have traditionally regulated utilities to protect consumers from supply disruptions and unfair pricing. The Energy Policy Act of 2005 (EPAct) repealed PUHCA 1935, removing some limitations on the companies that could merge with or invest in utilities, leaving the Federal Energy Regulatory Commission (FERC), which already regulated utilities, with primary federal responsibility for regulating them. Because of the potential for new mergers or acquisitions between utilities and companies previously restricted from investing in utilities, there has been considerable interest in whether cross-subsidization--unfairly passing on to consumers the cost of transactions between utility companies and their "affiliates"--could occur. GAO was asked to (1) examine the extent to which FERC changed its merger and acquisition and post merger review and oversight processes since EPAct to protect against cross-subsidization and (2) survey state utility commissions about their oversight.

What GAO Found

FERC has made few substantive changes to its merger review processes and does not have a strong basis for ensuring that utilities do not engage in harmful cross-subsidization. FERC officials told us that they plan to require merging companies to disclose existing or planned cross-subsidization and to certify in writing that they will not engage in cross-subsidization, but do not plan to independently verify such information. Once mergers have taken place, FERC intends to rely on its existing enforcement mechanisms--primarily companies' self-reporting noncompliance and a limited number of compliance audits--to detect potential cross-subsidization. FERC officials told us that they believe the threat of large fines, as allowed by EPAct, will encourage companies to investigate and self-report any non-compliance. In addition, FERC officials told us that, for 2008, FERC developed its plans to conduct compliance audits of 3 of the 36 holding companies it regulates based on informal discussions between senior agency officials and staffs in key offices. However, FERC does not formally use a risk based approach that considers factors, such as companies' financial condition or history of compliance. A risk-based audit approach is an important consideration in efficiently allocating its limited resources to detect non-compliance. In addition, we found that FERC's public audit reports often lacked a clear description of the audit objectives, scope, methodology, and findings--inhibiting their use in improving transparency with stakeholders or helping FERC staff improve their audit practices. State utility commissions' views of their oversight capacity varied, but many reported a need for additional resources, such as staff and funding, to respond to changes in their oversight after the repeal of PUHCA 1935. State regulators in all but a few states reported that utilities must seek state approval for proposed mergers. State regulators reported being mostly concerned about the impact of mergers on customer rates, but 25 of 45 reporting states also noted concerns that the resulting, potentially more complex company could be more difficult to regulate. Most states reported having some type of audit authority over the transactions between utilities and their affiliated companies, but many states currently review or audit only a small percentage of these transactions, with 28 of the 49 reporting states auditing 1 percent or less over the last five years. On the other hand, some states reported that they require periodic, specialized audits of affiliate transactions. In addition, although almost all states require financial reports from utilities and report they have access to utility companies' financial books and records, many states reported they do not have such direct access to the books and records of affiliated companies. While EPAct provides state regulators the ability to obtain such information, some states expressed concern that this access is narrow and could require them to be extremely specific in identifying needed information, thus potentially limiting their audit access. From a resources perspective, 22 of the 50 states reporting said that they needed additional staffing and funding to a carry out their oversight responsibilities.