FERC has made few substantive changes to either its merger review process or its postmerger oversight as a consequence of its new responsibilities and, as a result, does not have a strong basis for ensuring that harmful cross-subsidization does not occur. To review mergers and acquisitions, FERC officials told us that they do not intend to make changes to their process other than to require companies to disclose any existing or planned cross-subsidization and explain why it is in the public interest, and to certify in writing that they will not engage in harmful cross- subsidization. For postmerger oversight, FERC intends to continue to rely on its existing enforcement mechanisms, as expanded by EPAct, to detect potential cross-subsidies—primarily companies’ self-reporting of noncompliance and a limited number of compliance audits. However, FERC does not formally consider the risks posed by various companies in determining which companies to audit—a consideration that financial auditors and other experts told us is important when auditing with limited resources. We also found that where affiliate transactions were audited, the resulting audit reports sometimes lacked clear and useful information. FERC’s merger review process requires companies to submit evidence that a merger or acquisition will not result in unapproved cross- subsidization, and its ability to prevent cross-subsidization depends largely on commitments by the merging parties rather than independent analysis. FERC-regulated companies that are proposing to merge with or acquire a regulated company must submit a public application for FERC to review and approve. As part of its review of these applications, FERC is now responsible for ensuring that mergers do not result in harmful cross- subsidies. To do this, FERC attempts to ensure that mergers will not result in: any transfer of facilities between or issuance of securities by a traditionally regulated public utility to an affiliate; any new financial obligation by a traditionally regulated public utility for the benefit of an affiliate; or any new affiliate contract between a nonutility affiliate company and a traditionally regulated public utility company, other than agreements subject to review by FERC under the Federal Power Act. To fulfill this new responsibility, FERC established an additional requirement that the merging companies submit new information as part of their application for merger or acquisition approval, referred to as “Exhibit M.” Exhibit M requires companies to describe organizational and financial information, such as affiliate relationships and any existing or planned cross-subsidies. If cross-subsidies already exist or are planned, companies are required to describe how these are in the public interest by, for example identifying how the planned cross-subsidy benefits utility ratepayers and does not harm others. Further, in FERC’s recent supplemental merger policy statement, issued July 20, 2007, FERC provided additional guidance on certain types of transactions that are not likely to raise concerns about cross-subsidization—termed “safe harbors.” FERC also requires company officials to attest that they will not engage in unapproved cross-subsidies in the future and specifically requires the merger application, including Exhibit M, to be signed by a person or persons having appropriate knowledge and authority. FERC’s merger or acquisition decision is based on a public record that starts with an initial application. This record includes the filing of the initial application. FERC’s review process also allows stakeholders or other interested parties, such as state regulators, consumer advocates, or others to submit information and arguments to this public record for FERC to consider. FERC officials told us that they evaluate the information in the public record for the application and do not separately develop or collect evidence or conduct separate analyses of a proposed merger beyond what is submitted as part of the record. FERC officials told us that they can, and sometimes do, request that applicants provide additional information or conduct additional analysis. In addition, FERC may require a public hearing before making a decision. Whether or not a hearing is held, officials noted that they are required to make their decision based on the evidence that is in the public record. On the basis of this information, FERC officials told us that they will determine which, if any, existing or planned cross-subsidies may be allowed, which is then detailed in the final merger or acquisition order. According to experts, FERC is generally supportive of mergers. FERC officials largely acknowledged this perspective, telling us that under law and regulation, FERC must approve mergers that are consistent with the public interest. These officials also said that FERC believes it has broad flexibility in determining what is consistent with the public interest, particularly in light of changing conditions in the industry and, as such, it does not read the statute as creating a presumption against mergers. On the other hand, FERC officials said that FERC was not prepared to presume that all mergers were beneficial but that it was the merger applicant’s responsibility to demonstrate that the merger was consistent with the public interest by, for example, demonstrating how it improves efficiency or lowers costs while not harming competition. Between the time EPAct was enacted in 2005 and July 10, 2007, FERC has reviewed or was in the process of reviewing 15 mergers or potential mergers (see table 1). FERC has not rejected any merger applications. In nine cases, FERC approved the merger without condition. In three cases, FERC approved the merger with conditions, for example, requiring the merging parties to provide further evidence of ratepayer protection consistent with FERC-approved “hold harmless” provisions. One merger was withdrawn by the merging parties prior to FERC’s decision. The two other applications are still pending. FERC officials in the Office of Enforcement intend to use the same tools to enforce prohibitions on cross-subsidization that they currently use for other enforcement actions. In general, the Office of Enforcement relies on two primary tools—self-reporting and a limited number of compliance audits. However, we found that FERC does not use a formal risk-based approach to guide its audit planning—the active portion of its oversight efforts to detect cross-subsidization—or deploy its limited audit resources. As such, FERC’s actions do not provide a strong basis for ensuring the detection of potentially harmful cross-subsidization. The first detection tool that FERC emphasizes is that companies self- police their own affiliate transactions and intercompany relationships and voluntarily self-report instances of harmful cross-subsidization to FERC. FERC’s policy statement on enforcement emphasizes such voluntary internal compliance and reporting as well as cooperation with FERC in order to detect and correct violations. A company’s actions in following this policy, along with the seriousness of a potential violation, help inform FERC’s decision on the appropriate level of potential penalty to impose on violating companies. FERC indicates that it places great importance on company’s proactive self-reporting because it believes that companies are in the best position to detect and correct both inadvertent and intentional violations of FERC orders, rules, and regulation. According to FERC officials, companies can actively police their own behavior through a formal program for internal compliance, internal audits, and through annual external financial audits. Since the enactment of EPAct, when Congress formally highlighted its concern about cross-subsidization, no companies have self-reported any of these types of violations. FERC officials said that FERC had approved 12 settlements with natural gas and electric entities, none of which involved violations of the PUHCA 2005 provisions in EPAct. In these cases, FERC has assessed civil penalties totaling $39.8 million on the companies. FERC officials told us that because it can now levy much larger fines—up to $1 million per violation per day—they expect companies to become more vigilant in monitoring their behavior. Regarding FERC’s reliance on self-reporting, key stakeholders have raised several concerns about this approach. First, because FERC’s rules related to affiliate transactions are broad, company managers may not always be fully aware of how these rules apply to specific affiliate transactions. According to market experts, including a November 2007 report issued by a former FERC Commissioner on behalf of a broad consortium of energy companies, FERC’s rules are often written broadly and it is unclear what standards of conduct FERC uses to oversee transactions between companies. This can result in utility managers being unaware that specific transactions may violate current FERC policies. One controller we met with told us that these broad rules can be counterproductive in encouraging company compliance and self-reporting because it is difficult to determine if the rules are actually being violated. Second, internal company audits tend to focus on areas of highest perceived risk and, as a result, may not focus specifically on affiliate transactions. Internal auditors with whom we spoke told us that they have relatively small staffs and are responsible for auditing a wide range of matters within a corporation and, as such, they focus their efforts on areas they believe pose the highest risk to the company. They said this approach means that they rarely focus on affiliate transactions, unless those transactions represent a large financial exposure to the company’s potential profitability. Finally, financial audit firms we spoke with told us their work primarily focuses on auditing financial statement balances and related disclosures. These audits focus on providing an opinion about whether the financial statements present fairly, in all material respects, the financial position and operations of the company. As such, they said that their work with regard to affiliate transactions is limited to the related disclosures rather than determining if harmful cross-subsidization was occurring. Only in cases where transactions could have a material effect on the overall financial statements of a company would they conduct detailed testing and review pricing arrangements. Compounding these concerns, and FERC’s belief that the threat of large fines will encourage companies to self-report, companies expressed uneasiness over FERC’s use of its new penalty authority on self-reporting companies. One company official noted that some of the recent penalties for companies that self-reported violations were large and would “chill” companies’ willingness to self-report violations. In addition, state commissions expressed concerns about a reliance on self-reporting of cross-subsidies and reported that effective oversight would require regular and rigorous audits of affiliate transactions. As a second way to detect potential harmful cross-subsidization, FERC plans to conduct a limited number of compliance audits of holding companies each year. Since enactment of PUHCA 2005 provisions in EPAct, FERC has not completed any audits to detect whether cross- subsidization is occurring. In our review of FERC processes for planning these audits, however, officials with the Division of Audits in the Office of Enforcement told us that FERC conducts audit planning for 1 fiscal year at a time. On the basis of this approach, FERC’s current audit plan for these matters in 2008 will audit three companies—Exelon Corporation, Allegheny, Inc., and the Southern Company. The overall objective of these audits will be to determine whether these companies are inappropriately cross-subsidizing or granting special preference to affiliates or burdening utility assets for the benefit of nonutility affiliated companies. Such compliance audits, officials told us, will determine whether companies are complying with FERC rules for the pricing of affiliate transactions, among other things. FERC’s audit plan is not designed to address the number of audits FERC will conduct beyond 2008, or at what companies it will conduct them since the planning for 2009, for example, will not be done until sometime later in 2008. In addition, based on discussions with FERC officials, the development of its audit plan is informal and developed in an ad hoc manner to address the specific audits for a given year. Specifically, these officials said that the plan is developed through informal discussions between FERC’s Office of Enforcement, including its Division of Audits, and relevant FERC offices with related expertise, including the Office of General Counsel, the Office of Energy Markets Regulation, and the new Office of Electric Reliability. FERC officials also told us that the plan is reviewed by top agency officials and approved by the Chairman. While FERC’s audit plan for 2008 reflects insights of key FERC staff, it does not formally consider the risks posed by individual companies, or the overall universe of companies, in determining which companies to audit or how many audit resources to deploy. FERC officials told us that while they do not specifically consider the individual or collective risks posed by companies in a formal manner, they believe that their discussions with knowledgeable staff provide a reasonable picture of risk. However, on the basis of our discussions with FERC staff, this picture of risk may be somewhat limited in that it is informed only by the views of a few key staff and does not seek input from stakeholders, such as the financial community or state commissions, or reflect analysis of key data on risk. To obtain a more complete picture of risk, FERC could more actively monitor company-specific data to develop a picture of the risks posed by the companies it regulates—something it currently does not do. To partly address this, FERC recently required certain affiliates to begin gathering comprehensive financial information in 2008 and filing the first of what will be annual financial reports by May 2009. According to a FERC audit official, after a year or 2 of data collection, analysis, and conducting audits, it will be in a much better position to plan, conduct, and report the results of its audits of affiliate relationships and potential cross- subsidization. In addition, this official said that FERC does not typically review certain publicly available financial information, such as bond ratings and stock prices for companies that FERC regulates or their affiliates. According to bond rating companies, they actively monitor companies’ operating and financial condition to identify the key risks faced by companies and reflect these risks in the ratings they assign to the company’s debt. Further, state officials agreed that such information may help provide a view of the financial condition of specific companies, or the overall industry, and how they may be changing. In support of the use of this information, some state regulators told us that such information has been helpful to them in identifying when companies may engage in unlawful cross-subsidies. Finally, some state officials said that because they regulate companies on a day-to-day basis, they have considerable expertise and knowledge that may prove useful to FERC. Thus, unless FERC changes its view about the usefulness of such data, it will continue to lack available information that may be potentially useful in assessing risk. The importance of formally considering risk when carrying out compliance oversight is highlighted by prior GAO reports. In these reports GAO identified instances where other agencies, such as SEC, the Department of Homeland Security, and the Environmental Protection Agency could use and have used risk-based approaches to inspect for compliance with regulations. In some cases, agencies have developed and used statistical models to estimate an entity’s (e.g., a company’s) risk of a violation and as a means to target limited audit resources. In other cases, we have recommended that agencies continue to devote some resources to auditing entities on a random basis but use the data collected from these random audits to update statistical models so that the agency can continue to identify high-risk entities. Furthermore, according to financial auditors and other experts we spoke with, risk assessments are an important consideration in targeting audits and allocating resources to detect noncompliance. Without a sufficient assessment of risk, it may be difficult for FERC to convince companies, states, and other market stakeholders that it can adequately and consistently detect cross- subsidization. At present, without a risk-based approach to guide its audit planning and deploy its limited audit resources, FERC may not be effectively allocating its staff to audit the companies it regulates. FERC’s Division of Audits currently has a total of 34 full-time staff, including 21 accountants/ auditors, 6 energy industry analysts, 3 economists, 2 engineers, 1 attorney, and 1 support staff. FERC has determined that of the 149 companies that have been identified as holding companies, 36 of them are currently subject to its PUHCA 2005 authority and it plans to allocate 9 of its available staff to these audits in 2008. Officials in the Division of Audits told us that they believe a typical audit would involve three to four audit staff—an auditor-in-charge and one or two auditors. Other companies and state auditors involved in auditing affiliate transactions told us that these audits can be difficult and require significant use of auditors with specialized skills and experience. These auditors also told us that examining affiliate transactions can be resource intensive since determining whether a transaction is unfair may require detailed analysis of the transaction and the market for the good or service that was the subject of the transaction. At its planned 2008 audit rate of 3 companies, it would take FERC 12 years to audit each of these companies once. In commenting on the report, FERC noted that the number of audits in future years may change. Nevertheless, FERC may face additional companies, some of which may require more complex audits. According to financial and industry experts we spoke with, the elimination of PUHCA 1935 is likely to attract companies previously restricted from owning utilities to consider mergers or acquisitions. For example, some experts told us that foreign companies, corporate conglomerates, and private equity companies are considering mergers or acquisitions of U.S. utilities. In addition to companies subject to FERC’s oversight under the PUHCA 2005 provisions of EPAct, FERC also has audit responsibilities for the electric reliability organization, the North American Electricity Reliability Corporation, which oversees issuing and enforcing rules, such as compliance with reliability standards, focused on ensuring reliable electricity supplies. At present, there are about 4,700 companies that could potentially be audited for compliance with FERC’s rules, regulations, and orders regarding reliability, transmission, and electricity pricing rules. FERC officials said some overlap exist between categories, such as investor-owned utilities and electric suppliers with market-based rate authority. In addition, according to FERC, Federal Power Act section 215 companies would initially be audited and overseen by the new Regional Reliability Organization and the related regional entities. FERC officials also said that they intend to audit about 100 of these companies during 2008. The universe of companies that FERC is responsible for auditing is identified in 10 categories in table 2. Because of the magnitude of companies it oversees and the range of rules it enforces, FERC enforcement and audit officials described their offices as resource constrained and acknowledged that the Office of Enforcement has not yet adopted a formal, risk-based approach to target these resources. FERC’s publicly available audit reports pertaining to affiliate transactions are not clear and, thus, their usefulness in terms of public transparency and disclosure is limited. Although FERC has not yet completed any affiliate transaction audits or yet issued any reports under EPAct, officials with the Division of Audits told us that they intend to rely on their existing “exception-based” audit reporting policy. A FERC official told us their “exception-based” audit reporting policy means audit reports would only reflect the audit findings and recommendations associated with the audit issues on which FERC found the company to be out of compliance. In contrast, if an audit does not result in FERC taking an enforcement action due to noncompliance, the audit report does not provide information on the methodology the auditors used nor their findings. Thus, FERC’s public audit reports may not always fully reflect key elements such as objectives, scope, methodology, and the specific audit findings. Federal government auditing standards, developed by GAO and referred to as Generally Accepted Government Auditing Standards (GAGAS), stipulate that audit reports contain this basic information, and other information as well, in order to comply with GAGAS. According to FERC officials, they are not required to comply with GAGAS, but “follow the spirit” of these standards because they provide a good framework for performing high-quality audits. In our review of 18 recent FERC audit reports pertaining to affiliate transactions, we found that they did not always identify any findings on affiliate transactions or have any recommendations. Further, the audit reports sometimes lacked key information, such as the type, number, and value of affiliate transactions at the company involved and the percentage of all affiliate transactions tested, or the test results. A FERC official conceded that FERC past audit reports on affiliate transactions do not always meet GAGAS standards because they are not required to do so. However, without this information, it may be difficult for regulated companies to understand the nature of FERC’s oversight concerns and to conduct internal audits to identify potential violations that are consistent with those conducted by FERC—key elements in improving companies’ self-reporting. Further, financial audit firms, internal auditors, and auditors at state commissions told us that they typically review prior related audits, including those done by FERC, as part of their preparation for a new audit. To the extent that FERC audit reports lack information on the work they performed, they limit the usefulness of these audits for future auditors as well as miss an opportunity to improve FERC’s audit practices and transparency to state regulators and other companies and stakeholders. Furthermore, without such information in the audit report, we and other stakeholders, such as state commissions, cannot confidently and credibly determine that the auditor’s efforts to detect abusive affiliate transactions and cross- subsidization were sufficient. A recent report prepared by a former FERC Commissioner on behalf of a wide range of industry stakeholders expressed concern that FERC increase the transparency of its audits and investigations in order to, among other things, help individual market participants to improve their internal compliance programs and correct deficiencies before they cause harm to consumers. States utility commissions’ views of their oversight capacities vary, but many states foresee a need for additional resources to respond to changes from EPAct. Almost all states have specific authority to review and either approve or disapprove mergers and acquisitions. Despite this authority, many states’ commission staff expressed concern over their ability to regulate the resulting companies. Almost all states report they have some type of authority over affiliate transactions, although many states report reviewing or auditing few of these transactions. Further, although almost all states can access the books and records of the utility to substantiate costs and other relevant data, many states report they cannot obtain such access to these books and records at the holding company or other affiliated nonutility companies. Almost half of the states report they need additional staff and funding to respond to changes stemming from EPAct. On the basis of our survey of state commission staff, all but 3 states (out of 50 responses) have authority to review and either approve or disapprove mergers. The types of authority states have vary, however. For example, one state noted that, technically, it could only disapprove a merger and, as such, the state allows a merger by taking no action to disapprove it. Three states noted their state legislatures had not provided them direct merger review authority, but they were able to use other commission authority to conduct such reviews. State commissions responding to our survey noted that the most important factors they consider in evaluating mergers or acquisitions are the effects on regulated rates and the quality of retail service (e.g., no significant problems with service interruptions for consumers). The next most important factors were the commission’s ability to regulate the resulting company and the effect on the financial complexity of the company that would result from the merger. Staff from one state told us in additional narrative comments that they were concerned that with the passage of EPAct utilities will become larger, more complex, and located in geographically diverse areas. They specifically expressed concerns over the challenges of allocating costs between various entities due to the potential for centralization of services in these types of resulting companies. Table 3 below lists the 4 top factors rated as either of very great importance or great importance out of 15 factors we asked states to rate in their evaluation of proposed mergers and acquisitions. In recent years, the difficulty and increased complexity of regulating merged companies has been cited by two state commissions denying proposed mergers in their states. For example, a state commission official in Montana told us the commission denied a merger in July 2007, between Northwestern Company and Babcock and Brown Infrastructure, an Australian company, even though it had been approved by FERC. This merger involved a Montana regulated utility, whose headquarters was located in South Dakota and was being bought by a foreign-owned holding company. According to this official, the commission denied the merger partly due to concerns about regulating the utility under such a corporate combination. He noted concerns that no top corporate officials would be located in Montana and that the time zone differences with the Australian company made contact with those officials more difficult in dealing with regulatory issues. As a result of the denial by the state commission, the merger was not allowed to proceed. In a different proposed merger in Oregon, state utility commission officials told us they denied the proposed merger in March 2005 between Portland General Electric, one of their regulated utilities and the Texas Pacific Group, a private equity fund company. They noted under their implementation of Oregon’s statutes, mergers must meet two standards: (1) they must provide net benefits to consumers and (2) they cannot harm consumers. Officials in Oregon noted that the state commission was concerned that consumers could be harmed because regulating the resulting company would be more difficult due to the financial complexity of the new ownership arrangement. In addition, the commission was concerned that consumers faced potential harm due to risks posed by high levels of debt and the private equity firm’s short- term business plan. Although an application had been made for a review at FERC it was withdrawn in April 2005 prior to FERC review. State commission views regarding potential mergers and acquisitions are of increasing importance in the financial community, as well. Officials from the financial community noted they believe state commissions may be highly suspicious of some of the new corporate structures being proposed, especially the role of private equity firms. They also noted that some commissions have expressed significant concerns over the formation of vast utility companies operating in multiple states. As a result of these and other concerns, these officials reported that some companies potentially interested in merging with or acquiring utilities have been reluctant to propose transactions so far. Almost all states report having authorities over affiliate transactions or regular reporting of such transactions, or both. Nationally, 49 states noted they have some type of affiliate transaction authority. These authorities, however, vary from prohibitions against certain types of transactions, or prior approval by the commission for transactions over a certain dollar amount, to less restrictive requirements such as allowance of the transaction without prior review. In some cases state commission authorities permit them to disallow these transactions at a later time if they were inappropriate. In fact more than half the states (27) reported that under their authority, affiliate transactions did not require prior commission approval, but could be reviewed and disallowed later. Such a disallowance would result in the cost of the transaction not being passed on to consumers or being recovered from the company. Only 3 states reported that affiliate transactions always needed prior commission approval. Nearly all states (41) require utilities to report affiliate transactions at least annually, or more frequently. These reports varied, however, in frequency of reporting, types of transactions requiring reporting, and the detail of reporting. For example, some states required reporting all transactions at least annually, while others required reporting of only certain types of transactions or just reporting the total dollars spent by each affiliate. Several of the state commissions we interviewed noted the importance of strong state authority over affiliate transactions. Staff in one state noted their commission must preapprove any affiliate transactions over $25,000 and conditions for approval were stringent. In some instances the state’s attorney general stepped in to stop companies from going ahead with affiliate transactions that had not been preapproved. Some states are concerned that they may not have sufficient authorities to oversee affiliate transactions, after the repeal of PUHCA 1935. In our survey, some state commissions expressed a need to increase their authority over affiliate transactions. During the course of our work one state took action to increase its authority. In 2006, the California commission strengthened existing affiliate transactions authorities, partly due to concerns related to the repeal of PUHCA 1935. The new rules clarified the scope of allowable utility affiliate transactions and tightened the rules on when and how specific services, such as, legal services could be shared between affiliates and the regulated utility. Despite various authority governing the prior authorization and disclosure of affiliate transactions, many states responding to our survey reported they audit few if any affiliate transactions or dedicate much staff time to reviewing these transactions. The majority of states reported they have audited 1 percent or less of these transactions over the last 5 years and dedicated no staff time to reviews or audits over the last year. Table 4 shows that many states are not performing reviews or audits of affiliate transactions. Since the passage of EPAct several aspects of monitoring of affiliate transactions were raised as key challenges by several state commissions responding to our survey and during our interviews. For example, an attorney from one state utility commission expressed concerns about having enough resources and expertise to enforce existing authorities. He noted that holding company and affiliate transactions can be very complex and time-consuming to review. He noted these reviews are resource intensive, since determining whether a transaction is unfair may require detailed analysis of the transaction and the market for the good or service that was subject of the transaction. Another expert, with extensive experience with FERC and several state public utility commissions noted that on the basis of his experience, states do not generally have the resources to effectively review affiliate transactions, particularly when they are multistate in nature. Similarly, a consultant whose firm does numerous affiliate transaction audits in many states, noted in a March 2007 FERC technical conference on related issues that many states, even when they have significant authority, lack staff to review transactions. Further, he noted that state commissions often lack the staff expertise to adequately address the accounting and financial operations aspects of these affiliate relationships as well as the risks inherent to audits of affiliate transactions Some states, however, do put special emphasis on auditing affiliate transactions. All four states we visited routinely audit affiliate transactions. Commission officials in one of these states told us they commit the equivalent of 2.5 full time employees to auditing affiliate transactions for reasonableness (e.g., prices appear to be correct). If they find unreasonable transactions the commission can adjust future electricity rates to correct for the problem (e.g., they disallow some or all of the value of the transaction and remove that amount from prices that consumers pay). Their goal is to audit each utility every 2 years and they estimate that over the last 5 years they have audited 100 percent of all utility affiliate transactions. As part of their audits the staff requests SEC filings, monitors credit reports, and reviews other related financial data. However despite this effort, representatives from two consumer groups in this state expressed concerns that affiliate transactions are so complex that the state commission just does not have enough resources to fully audit these transactions. Two additional states commissions we interviewed contract with outside auditors to do specific audits of the affiliate transactions of the state’s regulated utilities biennially. State commission staff in one of these states noted their audits review company affiliate transactions for appropriateness and proper pricing. The purpose of the audits is to show the transactions were made fairly to the utility and that ratepayers are not paying more than they should. One auditor who had done affiliate transaction audit work for another state we visited described that state’s approach to auditing affiliate transactions as being very aggressive in that their audits involved significant data analysis and the reports contained considerable detail about the findings. All states regularly require financial reports from utilities and are able to obtain access to the financial books and records of these utilities that document costs, but access beyond the utility varies. All 49 states that responded to this survey question, noted that they require utilities to at least provide financial reports. Most states (41) only require such reporting by the utility but 8 states require reports that also include the holding company or both the holding company and the affiliated companies. Of the 48 states that responded to our questions about the frequency of required reporting, 35 require annual reports; 6, quarterly reports; and 7, monthly reports. Although all states but 1 report having access to the books and records of the utilities in their states, some report they do not have such access to other companies within the holding company. Nearly one-third of the states reporting said they do not have access to the books and records of the utility holding company. Similarly, over 40 percent of the states reporting said they do not have such access to affiliated nonutility companies. Table 5 shows state commission access to different parts of holding companies. Utility experts also expressed concerns over state commissions’ access to the books and records of holding companies or other affiliate companies either through state authority or through assistance by FERC. Lack of such access, these experts noted, may limit the effectiveness of state commission oversight and result in harmful cross-subsidization because the states cannot link financial risks associated with affiliated companies to their regulated utility customers. Experts expressed concern over state commission authority. For example, the president of an audit company, who currently works with two-thirds of the utility commissions across the country and completed many affiliate audits, noted that there is a lack of clear authority in some states to gain access to the key records in other states, even though the utility shares common services across the states that bear upon the utilities transactions. Similarly, one commission official told us that it is difficult to get access using state authority alone. He noted that holding companies can set up numerous roadblocks for staff to access the records. Consistent with this view, in comments to our survey concerning key challenges since the passage of EPAct one state noted a concern about the responsiveness of a parent holding company based out of state to specific in-state inquiries. While the PUHCA 2005 provisions of EPAct provide states with additional access to books and records, some states expressed reservations relating to the level of protection this offered their states. In response to our survey, 8 states noted that access to books and records, if they had to gain assistance through FERC, offered little or no protection to their states, while another 14 states noted this offered only some protection. In contrast, only 3 states noted that FERC assistance in gaining access offered great protection. Commission staff in one state told us that obtaining such information requires state commissions to be very specific in identifying the necessary information. However, this commission staff noted that it may be difficult to develop such detailed knowledge. According to this state commission staff, such a detailed requirement to access information may limit their ability to conduct adequate and timely affiliate transaction audits. A utility expert who has experience with both FERC and state commissions also noted that states often follow leads and do not always know the specific information to support a detailed request. As a result of the potential need to develop a series of detailed requests, it may take longer to complete an audit. He stated this creates significant risks for states and their ratepayers as the full scope of utility transactions cannot be understood without seeing the entire trail of these transactions through the holding company and affiliate books and records. States and other officials expressed concerns that the state commissions do not currently have sufficient resources and may need additional resources to respond to the changes from EPAct. Since states have gained over 2 years of experience since EPAct was passed, many believe they now need additional resources to carry out their responsibilities. Specifically, as seen in table 6, 44 percent of the states responded to our survey that they need additional staffing or funding, or both, to deal with the changes from EPAct. Further, 6 out of 30 states raised staffing as a key challenge in overseeing utilities since the passage of EPAct. One state, for example, noted monitoring of affiliate relationships as a key challenge, particularly in light of its current staff and resources. Since the passage of EPAct, 8 states have proposed or actually increased staffing. Staffing concerns were also mentioned as problems by officials at the commissions or by representatives of consumer groups in 3 of the 4 states we visited as well others. For example, an official from the one of these state’s commissions noted that the state, in response to tighter budgets, had reduced staffing levels across-the-board including the utility commission and that the median age of the commission staff was now 56 and could soon face a wave of retirements. In addition, representatives of two consumer groups in another state expressed concerns that the commission does not have enough resources to oversee or audit affiliate transactions. In addition an official from a national credit-rating agency expressed concern that some state commissions may not fully appreciate the degree of difficulty they could face with existing staffs in the years ahead. The repeal of PUHCA 1935 further opened the door for new and different corporate combinations, including the ownership of utilities by complex international companies or equity firms, potentially providing needed investment to the utility industry. However, this potential to increase investment comes at the potential cost of making regulation more difficult. Further, the introduction of new types of investors, with incentives that may be at odds with traditional utility company services, could change the utility industry into something quite different than the industry that FERC and the states have overseen for decades. Despite these evolving changes, FERC continues to rely to a considerable degree on companies to self- certify that they will not cross-subsidize and self-report when they do. On the basis of our discussions with industry, state regulators, and audit experts, this reliance on self-enforcement—backed up by a few audits— does little to convince consumers and other market stakeholders that FERC’s oversight is sufficiently vigilant. As FERC and states approve mergers, the responsibility for ensuring that cross-subsidization will not occur shifts to FERC’s Office of Enforcement and state commission staffs. However, in the case of FERC this presents a challenge because FERC lacks a formal way of allocating resources to the areas of highest potential risk—leaving audit resources deployed in an ad hoc manner. Without a risk-based audit approach, FERC may not allocate its scarce audit resources to the right areas, potentially allowing cross- subsidization to go undetected. In addition, since states generally review only a very small percent of affiliate transaction to identify potential cross- subsidization and many reported resource constraints, some states’ detection of cross-subsidization may be limited. By reassessing its audit approach, how it shares the results of its audits, and its resources, FERC could take important steps to demonstrate its commitment to ensure that companies are not engaged in cross- subsidization at the expense of consumers. Absent such a reassessment, the potential exists for FERC to approve the formation of companies that are difficult and costly for it and states to oversee and potentially risky for consumers and the broader market. We recommend that the Chairman of the Federal Energy Regulatory Commission (FERC) take the following actions: 1. Develop a comprehensive, risk-based approach to planning audits of affiliate transactions in holding companies and other corporations that it oversees to more efficiently target its resources to highest priority needs and to address the risk that affiliate transactions pose for utility customers, shareholders, bondholders, and other stakeholders. 2. As an aid to developing this risk-based approach, FERC should develop a better understanding of the risks posed by each company by doing the following: a. Monitoring the financial condition of utilities to detect significant changes in the financial health of the utility sector, as some state regulators have found it useful to do. To do this, FERC could leverage analyses done by the financial market and develop a standard set of performance indicators. b. Developing a better means of collaborating with state regulators to leverage resources already applied to enforcement efforts and to capitalize on state regulators’ unique knowledge. As part of this effort, FERC may want to consider identifying a liaison, or liaisons, for state regulators to contact and to serve as a focal point(s). 3. Develop an audit reporting approach to clearly identify the objectives, scope and methodology, and the specific findings of the audit, irrespective of whether FERC takes an enforcement action, in order to improve public confidence in FERC’s enforcement functions and the usefulness of audit reports on affiliate transactions for FERC, state regulators, affected utilities, and others. 4. After developing a more formal risk-based approach, reassess whether it has sufficient audit resources to perform these audits. If FERC believes that it does not have sufficient resources to conduct adequate auditing of the companies that it oversees within its existing staff and budget, FERC should provide this information to Congress and request additional resources. We provided a draft of our report to FERC for review and comment. We received written comments from FERC’s Chairman and that letter and our detailed response is presented in appendix II. In his comments, the Chairman strongly disagreed with the report finding that FERC does not have a strong basis for ensuring that utilities do not engage in harmful cross-subsidization and noted that he believed the report contained inaccuracies and misunderstandings. We disagree with the Chairman’s characterization of our report and note that the letter’s assertions about some aspects of FERC’s operations are, in fact, quite different than the views of numerous commission staff and experts with whom we met over the course of the past year as well as FERC’s own Policy Statement on Enforcement. In addition, we believe that the repeal of PUHCA 1935 represents an important change in the context of FERC’s regulation of the industry and, in light of this change, FERC should err on the side of a “vigilance first” approach to preventing potential cross-subsidization by enhancing its current approach to audit planning and reevaluating audit resources. Overall, we believe our report presents a fair and balanced presentation of the facts and issues associated with FERC’s oversight and, as a result, encourage the Chairman to fully consider our recommendations. FERC also provided technical comments, which we incorporated, as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 14 days from the report date. At that time, we will send copies to the Chairman of the Federal Energy Regulatory Commission (FERC) and other interested parties. We will also make copies available to others upon request. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-3841, or gaffiganm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III. In this report, we agreed to determine: (1) the extent to which FERC changed its merger or acquisition review process and postmerger or acquisition oversight to ensure that potential harmful cross-subsidization by utilities does not occur, and (2) the views of state utility commissions regarding their current capacity, in terms of regulations and resources, to oversee utilities. Overall, to address the objectives we reviewed relevant reports, examined existing data, interviewed key officials and collected new data and information from 49 states and the District of Columbia. We interviewed and obtained documentation, when applicable, from a wide range of stakeholders including federal and state officials, industry officials, and various other special groups and organizations. We interviewed federal agency officials at FERC, the Department of Justice, the Federal Trade Commission, and the Securities and Exchange Commission (SEC). We obtained views from organizations including the National Association of Regulatory Utility Commissioners (NARUC), American Antitrust Institute, National Regulatory Research Institute, American Public Power Association, Electricity Consumers Resource Council, Edison Electric Institute, and Public Citizen. In addition, we obtained information and views on the effects of the Energy Policy Act of 2005 (EPAct) on investment in the utility industry from two national credit reporting agencies, Standard and Poor’s and Fitch Ratings, and the investment advisor Goldman Sachs Company. To specifically determine how FERC has changed its merger review processes and postmerger oversight to prevent cross-subsidization affecting utilities, we reviewed the Energy Policy Act of 2005 and the Public Utility Holding Company Act of 2005 (PUHCA 2005) provisions in EPAct related to FERC’s review of mergers and acquisitions, access to the books and records of companies in holding company systems, and assessment of civil penalties on companies that violate its rules. We reviewed information on the number, identity, and outcome of mergers that FERC has reviewed, audits of affiliate transactions that FERC has conducted, and civil penalties that FERC has assessed since passage of the 2005 legislation. We interviewed officials in FERC’s Office of Enforcement, Office of Energy Markets and Reliability, and Office of General Counsel concerning their plans to implement the statutory provisions of EPAct, including the PUHCA 2005 provisions and their development or update of new and existing rules, policies, and procedures regarding merger review, law enforcement, and audits. We performed a limited review of selected FERC merger orders and audit reports, including 18 completed audit reports the commission identified as pertaining to affiliate transactions, to assess FERC’s practices for reviewing mergers and conducting audits to prevent cross-subsidization. To address the second objective and gain insight into states’ views on their current capacities to oversee utilities, we visited four states, California, New Jersey, Oregon, and Wisconsin and conducted an Internet-based survey with staff from the public utility commissions in the 50 states and District of Columbia. In our site visits we met with officials from the public utility commissions, representatives of two utilities in each state, in some cases the utilities’ internal and external audit firms, and we also obtained views from representatives of consumer protection groups. We obtained information on the state’s authorities, actions, and resources relating to mergers, affiliate transactions, financial reporting, and access to company records. We gathered opinions relating to the federal regulatory changes and current or planned enforcement by FERC. We selected these states through a literature search, discussions with representatives of NARUC, a national organization representing state utility commissions, and from some initial discussions with selected states. We chose several states to visit that had strong protections related to holding companies/affiliates and utilities prior to the repeal of PUHCA 1935. We also selected two states of the four that were considering additional consumer protections directly due to the repeal of PUHCA 1935. We also discussed key issues with commission officials from Kansas and Montana. Since little detailed information existed that summarized the authorities, actions, and resources of all the states’ regulatory oversight related to utilities and holding companies, we supplemented our audit work with a survey of the staff of the 50 states’ and District of Columbia’s public utility commissions. The survey was developed between September and December 2006. Because we administered the survey to all of the state public utility commissions, our results are not subject to sampling error. However, the practical difficulties of conducting any survey may introduce other types of errors, commonly referred to as nonsampling errors. For example, differences in how a particular question is interpreted, the sources of information available to respondents in answering a question, or the types of people who do not respond can introduce unwanted variability into the survey results We included steps in the development of the survey to minimize such nonsampling error. To reduce nonsampling error, we had cognizant officials at NARUC review the survey to make sure they could clearly comprehend the questions. We also pretested the survey with two states to ensure that (1) the questions were clear and unambiguous, (2) terminology was used correctly, (3) the survey did not place an undue burden on commission officials, and (4) the survey was comprehensive and unbiased. In selecting the pretest sites, we sought the advice of NARUC and selected states that had different types of regulatory requirements. We made changes to the content and format of the final survey based on the pretests. We conducted the survey using a self-administered electronic questionnaire posted to GAO’s Web site on the Internet. To ensure that we would obtain information from commission staff most knowledgeable, we first obtained a list of key contacts from NARUC. We sent e-mail notifications to the Chairmen of the public utility commissions informing them of the purpose of our survey and requesting that they make any changes on the contact list provided to us by NARUC that would be most appropriate. After we made changes to our contact list, we sent e-mail notifications to alert the appropriate officials of the forthcoming survey. These were followed by another e-mail containing unique passwords and usernames that enabled officials to access and complete the survey and notifying officials that the survey was activated. Although the survey was available on the Web until June 30, 2007, we followed up with officials first through e-mail reminders and then by telephone to encourage them to respond. We received survey responses from 49 states plus the District of Columbia (each state could only provide one response). One state did not respond due to other high priorities at the time of our survey. We edited all completed surveys for consistency, but it was agreed we would not follow up with states relating to specific responses, but only to encourage them to send us their survey. Detailed survey results are available at: http://www.gao.gov/special.pubs/gao-08-290sp. The following are GAO’s responses to the Federal Energy Regulatory Commission’s comments on our draft report as outlined in its January 22, 2008, letter. 1. Our statement in the summary Highlights of the draft report referring to Energy Policy Act (EPAct) shifting sole responsibility from the Securities and Exchange Commission (SEC) to Federal Energy Regulatory Commission (FERC) was not intended to imply that, prior to the passage of EPAct, FERC had no role in regulating public utilities. We simply wanted to point out that, after EPAct, sole responsibility for oversight of potential cross-subsidies rested with FERC. We revised the Highlights text to clarify the historical roles of FERC and SEC. Other information in the draft report accurately reflected each agency’s role. 2. As a point of clarification, we make no explicit or implicit recommendation regarding “resurrecting” the Public Utility Holding Company Act of 1935 (PUHCA 1935). We share FERC’s apparent view that this was not the intent of Congress and the President in repealing PUHCA 1935. Our report focused on FERC’s new role as the sole federal agency responsible for enforcing prohibitions against cross- subsidization. 3. We acknowledge that FERC has executed the administrative steps to begin implementing EPAct, made changes such as adding a “code of conduct” for utilities and their affiliates as well as other changes discussed in the letter within the short time frames provided under law—and recognized this in our draft report. However, as we noted in our draft report, our view and the view expressed by FERC staff we met with during our investigation is that FERC’s overall merger review process remains largely unchanged except that FERC now requires companies to attest in writing that they will not engage in unauthorized cross-subsidization. We commend FERC for its ongoing outreach efforts, such as conferences to solicit stakeholders’ views, but we maintain that those efforts have, so far, resulted in few changes to FERC’s merger review process. Accordingly, we made no change to our draft report in response to this comment. 4. The Chairman of FERC said that we incorrectly conclude that the commission intends to rely on self-reporting as the primary enforcement mechanism to prevent cross-subsidization but did not explain what mechanism(s) FERC will use to detect potential cross- subsidization. To be clear, our draft report stated that once a merger has taken place, FERC intends to rely on its existing enforcement mechanisms—primarily (1) companies’ self-reporting and (2) compliance audits—to detect potential cross-subsidization. In addition, the draft report stated that FERC officials also said they used their “hotline” reporting system to identify potential violation of FERC rules. Throughout the course of our audit work, key FERC staff, including those involved in enforcement, noted that self-reporting was a central element in enforcing FERC’s overall enforcement approach, including all of the statutes, orders, rules, and regulations the commission enforces. FERC officials also provided a copy of FERC’s October 25, 2005, Policy Statement on Enforcement—which prominently features self-reporting—in the context of our discussion of how FERC planned to enforce the prohibitions on cross- subsidization. We share the views of the Chairman that self-reporting is not an effective method to reliably detect cross-subsidization. The Chairman also said that we may be confusing self-reports regarding standards of conduct violations with self-reports regarding cross- subsidization. We have not confused these two distinct reporting mechanisms as our report focuses on concerns related to potential cross-subsidization. As the draft report also discusses, the second key mechanism that FERC intends to use to detect potential cross- subsidization, and its only proactive enforcement component, is a limited number of compliance audits. We believe that audits provide tremendous potential value in enforcing the prohibitions against unauthorized cross-subsidization (delineated in detail by FERC on pages 3 through 7 of the Chairman’s letter and addressed in our comment 3), especially in light of FERC’s new role as the federal agency primarily responsible for the oversight of public utilities. We believe that audits of companies and transactions should play a key role in the FERC’s overall enforcement strategy, particularly in the area of cross-subsidization. With regard to preventing potential cross- subsidization through rate reviews, we are aware of this process and recognized in our draft report that FERC retains a limited ratemaking role and, as such, may have opportunities to establish cost recovery rules prospectively in these proceedings. We added additional language to our draft report to indicate that FERC may examine costs incurred by utilities for rates it still sets and, in so doing, decide which costs may be lawfully included in rates charged to customers. We also recognize that FERC allows third parties to report potential violations using its hotline or by filing a complaint that the terms of the approved rates are being violated. We revised our draft report to better reflect that such reports and complaints may lead to a FERC investigation. However, because we have no way of knowing (1) whether third parties will be a reliable enforcement tool, (2) how likely FERC is to conduct rate setting procedures, and (3) FERC’s plans currently reflect only 3 audits, we remain concerned that FERC is overly reliant on self- reporting. 5. We relied on FERC officials to identify the universe of companies it could audit and how many it planned to audit for the information contained in our draft report. In addition, we included suggestions from FERC staff regarding caveats to its audit responsibilities and overlaps raised in the Chairman’s letter. For example, the draft report noted that there was overlap between the various categories and that the Regional Reliability Organization, according to FERC, would be responsible for the initial audits of these 1,510 companies. Nonetheless, we moved our table note to the body of the report to emphasize these overlaps and the fact that the number of potential audit candidates could be lower than the universe of 4,700 companies identified by FERC. It is important to note, however, that some of the audits may be quite different and require different resources than audits of affiliate transactions. For example, audits of compliance with reliability rules may focus on whether companies have conducted sufficient training of staff, not addressing the unique accounting issues associated with affiliate transactions. While this change in the text of the report may help the reader better understand overlaps in the universe of companies, it is still not clear from the Chairman’s comments how many audits will ultimately be required of these companies, the nature of the audits or the resources needed, and how they would affect the resources available for audits of affiliate transactions. Regarding the frequency of audits, our draft report states, “At its planned 2008 audit rate of 3 companies, it would take FERC 12 years to audit each of these companies once.” We recognize that the current audit rate may change since such determinations are made annually, but we use these data—as provided by FERC—as the best available at the time of our review. We added an explicit notation that the number of audits may change to further clarify the statement already in the report. 6. The Chairman stated that the draft report incorrectly portrays FERC’s method of selecting audit candidates as informal and that FERC actually uses a variety of methods to assess the individual and collective risks posed by companies it oversees. However, during the course of our year-long engagement, including discussions with key FERC officials, the process was described as informal and did not mention the other mechanisms described in the Chairman’s letter. In addition, FERC staff, when we asked for a record of a risk-based analysis or the criteria FERC would have used to conduct such an analysis, were unable to provide them and told us audit selections were based on informal discussions with knowledgeable senior FERC staff. Although FERC officials may individually consider risk as they discussed audit planning in these informal discussions—and we noted in the draft report these officials believe their judgments provide a reasonable picture of risk—such considerations are not sufficiently formal or systematic and could change as staff in key positions change. In our view, a risk-based audit planning approach should be sufficiently rigorous and systematic to ensure that it reliably and consistently guides FERC in assessing individual company risks and the overall risks posed by the companies collectively and making audit selections accordingly. Furthermore such an approach should be flexible enough to meet FERC’s current and expected future auditing demands now that it is solely responsible for detecting potential cross- subsidization. We noted in our draft report that some federal agencies develop their own statistical measures of risk, derived in some cases from models although there are other methods. It may or may not be appropriate for FERC to use this type of tool but we want FERC to be aware that there are other ways of more formally considering risk in agency decision making. In any case, designing a formal risk-based approach will take time and effort and FERC may want to consider consulting with outside experts. It was our intent, by excluding these statistical methods from our recommendation, to provide the Chairman with flexibility on how best to implement a more formal, risk-based approach. With regard to FERC’s comment about its outreach to states during audits, we commend FERC for these efforts when conducting compliance audits, but also believe FERC could benefit from the states’ expertise and knowledge earlier in the process when determining which companies to audit. We continue to believe that our recommendation, if implemented, would improve the likelihood that the audits will be most effective. As such, we made no change to our draft report in response to these comments. 7. We are aware that FERC has established many expectations and rules—through both the company attestation process and its generic prohibitions on cross-subsidization—but we have concerns as to whether FERC has devoted enough attention to the formidable task of enforcing those rules by detecting violations. We recognize the importance of company attestations that they will not engage in cross- subsidization for use in developing a formal record from which FERC can potentially take enforcement actions. We share FERC’s view that companies should honor their commitments to the federal government, but know that staff turnover at these companies can be high, and that financial and other circumstances of companies can, and do, change. Because of this, and other factors, we believe that it is important to recognize the value of these company attestations in creating a record, but also believe that it is important to be vigilant and proactive in looking for potential violations. As a result, we made no change to the draft report in response to this comment. With regard to the Chairman’s related comment about FERC’s generic rules, we agree that these rules delineate FERC’s expectations for compliance; however, while these rules define potential violations, they do not detect them. Therefore, they must be coupled with vigilant enforcement mechanisms, such as audits to detect potential cross- subsidization. It is these mechanisms that the draft report concludes are inadequate in FERC’s approach. We made no change to our draft report for this comment. With regard to the Chairman’s comment about rate review, we discuss this point in our response to comment 4. 8. As noted above in comment 6, we are pleased that FERC includes discussions with state regulators when it conducts audits, however we believe FERC could further benefit from their expertise when selecting which companies to audit. With regard to financial indicators, as noted in the draft report, we believe that the deterioration of a company’s financial condition may raise the potential for financial abuses. In that regard, how the financial community values a company’s stocks or bonds is used as a high-level example of financial indicators that could be helpful to FERC. We do not suggest in our report that FERC should examine only stock and bond values; rather, we suggest that FERC should be gauging risk by, among other things “monitoring the financial condition of utilities.” Companies’ financial data is a window into their risks and an opportunity to leverage the financial community’s research. Such research is not strictly limited to stock and bond prices; it could include other appropriate metrics, such as financial ratios. In implementing our recommendation, FERC may wish to consult with financial experts to develop a set of useful metrics to monitor. We believe, as do others we spoke with in states and the financial community, that such indicators could provide additional insights into the risk posed by individual companies and the financial health of the overall industry. We made no change to our draft report in response to these comments. 9. As the Chairman indicates, FERC is in the process of implementing our recommendation to improve the usefulness of its audit reports. We discussed the need to improve the transparency of its audit requirements and actions during our discussions with FERC audit officials and encourage FERC to fully implement this recommendation. 10. As noted in the draft report, we believe that FERC should develop a formal risk-based audit planning approach to help inform its decisions about which companies to audit but also to assist it in better leveraging its resources. The development of such an approach could also help FERC determine whether it needs additional audit staff resources to fulfill its oversight responsibilities, particularly given that SEC no longer conducts such audits. We continue to encourage FERC to assess its resources for auditing and enforcement efforts and did not change our recommendation. 11. We agree that the Public Utility Holding Company Act of 2005 (PUHCA 2005) provisions in EPAct grant states the authority to obtain this information directly. Our statements related to state commissions’ access to books and records of utilities, holding companies, and affiliate companies was not intended to imply that states must go through FERC for access to this information. However, the draft report points out that this is the perception or experience in some states. For example, in response to our state survey, 14 states reported their state commission did not have access to these records at the holding company and 20 states reported this problem for affiliated nonutility companies. Further, as we reported, officials from companies that conduct audits for the states noted difficulties in obtaining access to out-of-state companies’ books and records. We did not evaluate states’ reasons for these views. Since there seem to be misunderstandings or misinformation about the access granted under the PUHCA 2005 provisions in EPAct, FERC could play an important role in clarifying these authorities or providing assistance in response to states’ concerns, or both. In response to this comment, we clarified the language related to states’ access to companies’ books and records. 12. The intent of our discussion of mergers in the draft report is not to criticize FERC’s merger review decisions or the conditions FERC placed on mergers. Rather, our intent is to provide some perspective on the number and status of FERC’s merger reviews and their disposition. Nonetheless, we note that FERC has been supportive of mergers—a point repeated by numerous FERC staff—and that FERC believes that it has certain obligations to approve mergers. Regarding FERC’s concern that the draft report does not recognize that “new types of investors” have acquired U.S. utilities before the repeal of PUHCA 1935, the draft report described such transactions in its discussion of changes to the strict limitations in this act. As such, we recognize that while PUHCA 1935 placed limitations on what types of companies could control utilities, some investors were allowed to invest into the utility industry if they met certain financial requirements (see GAO-05-617). Because these financial requirements placed limits on the companies outside the utility sector, the number of these types of investments was limited. In our discussions with financial experts, we found that, with the repeal of PUHCA 1935, more companies from outside the utility sector are considering utility mergers or acquisitions, or both, which could broaden the pool of potential investors. We revised the text of the report to better reflect these considerations. 13. As a point of clarification, our report conveys the views of state commission staff; we did not analyze state commissions’ auditing efforts or other state regulations or responsibilities. As such, we make no criticism of state commissions with regard to auditing, or any other areas of state regulation or responsibility. With this in mind, FERC should be aware that it is the view of state regulators––not based on evaluation by GAO––that state commissions are generally not conducting extensive compliance audits because of limited staff and other factors. On numerous occasions, FERC officials noted that state regulators, outside audit firms, and others are conducting audits of affiliate transactions; however, based on our discussions with each of these groups, we did not find this to be the case. We believe FERC should consider this information as it develops a formal risk-based audit planning approach, therefore we did not change the draft report in response to this comment. 14. With regard to accurately representing the percentage of companies that FERC plans to audit in 2008, FERC determined that 36 of 149 holding companies are subject to its authority under the PUHCA 2005 provisions in EPAct and told us it planned to audit 3. Although we agree that certain exemptions are required by statute, we did not conduct a legal analysis of these exceptions and waivers required by law nor did we review FERC’s evaluation of these applications to determine if the 36 holding companies (of the 149) accurately reflect the potential universe of companies to be audited. Because we did not make these evaluations, we revised the Highlights page of the draft report to reflect that FERC said it would audit 3 of the 36 companies it regulates, as we more fully described in the body of the report. 15. We revised footnote number 2 in the draft report to further clarify what authority FERC has with respect to Texas. 16. We disagree that the draft report suggests that, before the passage of EPAct 2005, the commission was not concerned with cross- subsidization. The draft explicitly stated that preventing cross- subsidization has been a long-standing responsibility of FERC and that preventing it at the point of merger review is new. As such, we made no change to the report in response to this comment. 17. We note that our draft report did not have an objective to determine the adequacy of FERC’s merger review and, as such, makes no finding regarding the quality of the FERC’s review. The draft report describes the record-based analysis noted in the Chairman’s comment, and participants’ possible roles, and states that FERC does not independently develop such information—a point that was repeatedly noted by FERC officials; rather, its review is limited to reviewing the record. We agree that FERC must make its decisions based on this record, and that it can take additional steps to make sure the evidence provided is sufficient. We clarified the language in the report to note that FERC can request that applicants provide additional information and perform its own independent analysis of record evidence. 18. During our review, we sought input from many stakeholders and involved parties. The report referenced by the Chairman’s comments provides one insight as to how industry perceives FERC’s actions but does not provide the sole insight, and we disclosed the report’s author and interest group affiliation so that the readers are aware of their interests. Similarly, the company official cited in the Chairman’s next comment reflects one example of concerns expressed by companies. In either case, we recognize—as should any reader of this report—that stakeholders have specific interests in FERC’s decisions and operations. However, it is important to note that some of the industries FERC regulates are expressing opinions similar to views we have developed independently during the course of our work in this area— namely that FERC needs to provide greater transparency of its enforcement functions. Furthermore, it is also worth noting that the need for greater transparency has been a theme over the last several years for GAO’s work regarding FERC, which has previously recognized this and made strides toward improving transparency. It is encouraging to point out that the Chairman recently acknowledged a similar view and committed FERC to improving the transparency of its enforcement functions. We made no change to our draft report in response to these comments. 19. The draft report contained language stating that EPAct provided FERC specific postmerger access to books, accounts, memos, and financial records of utility owners and their affiliates and subsidiaries, therefore we made no change to our draft report in response to this comment. Regarding the comment about “compliance with PUHCA 2005”, we deleted the language in the draft report related to company compliance. 20. We are not advocating that FERC allow nonfederal parties, such as FERC-regulated companies, to determine auditing priorities and agree that this would pose significant risks. We believe our recommendation that FERC seek input from stakeholders, such as the financial community and state commissions––many of whom have more frequent or more recent dealings with the utilities, or may have more recent audit experience with these companies, or both––may be an opportunity for FERC to better leverage these resources. Such input, along with the other information sources already at FERC’s disposal, could help inform FERC’s decisions but should not substitute for the risk-based decision-making criteria that we recommend FERC develop as part of a risk-based audit planning approach. We made no change to our draft report in response to these comments. 21. We recognize that the current FERC staffing choices, as they relate to auditing, leave few resources available to cover a broad range of potentially auditable entities. It is clear that the context within which the FERC audit staff are operating has changed in important ways and may require a reassessment of FERC resources, therefore we recommended that FERC seek additional resources, if needed. It is in this vein that we have outlined a path for FERC to make such a reassessment and to report its results to Congress so that it could potentially consider such a request. In addition, as noted in earlier comments, the development of a risk-based audit planning approach could also help FERC allocate its existing resources most efficiently and effectively. We made no change to our draft report in response to these comments. 22. Our draft report states that FERC has not yet completed any affiliate transaction audits under the PUHCA 2005 provisions of EPAct, but notes that FERC intends to rely on its existing, “exception-based,” reporting that it used for other types of audits. As noted in the draft report, our examination of FERC reports issued under this exception- based reporting policy raised concerns. As a point of clarification, our concern about this policy is meant to provide constructive criticism so that future reports on affiliate transactions could be more transparent and useful to FERC staff, states, and market participants. We made no change to our draft report in response to these comments. In addition to the contact named above, key contributors to this report included Dan Haas, Jon Ludwigson, Randy Jones, and Tony Padilla. Important assistance was also provided by Lee Carroll, Brad Dobbins, Kevin Dooley, Dan Egan, Gloria Hernandez-Saunders, Allison O’Neill, Glenn Slocum, Jay Smale, and Barbara Timmerman.

Summary: Under the Public Utility Holding Company Act of 1935 (PUHCA 1935) and other laws, federal agencies and state commissions have traditionally regulated utilities to protect consumers from supply disruptions and unfair pricing. The Energy Policy Act of 2005 (EPAct) repealed PUHCA 1935, removing some limitations on the companies that could merge with or invest in utilities, leaving the Federal Energy Regulatory Commission (FERC), which already regulated utilities, with primary federal responsibility for regulating them. Because of the potential for new mergers or acquisitions between utilities and companies previously restricted from investing in utilities, there has been considerable interest in whether cross-subsidization--unfairly passing on to consumers the cost of transactions between utility companies and their "affiliates"--could occur. GAO was asked to (1) examine the extent to which FERC changed its merger and acquisition and post merger review and oversight processes since EPAct to protect against cross-subsidization and (2) survey state utility commissions about their oversight. FERC has made few substantive changes to its merger review processes and does not have a strong basis for ensuring that utilities do not engage in harmful cross-subsidization. FERC officials told us that they plan to require merging companies to disclose existing or planned cross-subsidization and to certify in writing that they will not engage in cross-subsidization, but do not plan to independently verify such information. Once mergers have taken place, FERC intends to rely on its existing enforcement mechanisms--primarily companies' self-reporting noncompliance and a limited number of compliance audits--to detect potential cross-subsidization. FERC officials told us that they believe the threat of large fines, as allowed by EPAct, will encourage companies to investigate and self-report any non-compliance. In addition, FERC officials told us that, for 2008, FERC developed its plans to conduct compliance audits of 3 of the 36 holding companies it regulates based on informal discussions between senior agency officials and staffs in key offices. However, FERC does not formally use a risk based approach that considers factors, such as companies' financial condition or history of compliance. A risk-based audit approach is an important consideration in efficiently allocating its limited resources to detect non-compliance. In addition, we found that FERC's public audit reports often lacked a clear description of the audit objectives, scope, methodology, and findings--inhibiting their use in improving transparency with stakeholders or helping FERC staff improve their audit practices. State utility commissions' views of their oversight capacity varied, but many reported a need for additional resources, such as staff and funding, to respond to changes in their oversight after the repeal of PUHCA 1935. State regulators in all but a few states reported that utilities must seek state approval for proposed mergers. State regulators reported being mostly concerned about the impact of mergers on customer rates, but 25 of 45 reporting states also noted concerns that the resulting, potentially more complex company could be more difficult to regulate. Most states reported having some type of audit authority over the transactions between utilities and their affiliated companies, but many states currently review or audit only a small percentage of these transactions, with 28 of the 49 reporting states auditing 1 percent or less over the last five years. On the other hand, some states reported that they require periodic, specialized audits of affiliate transactions. In addition, although almost all states require financial reports from utilities and report they have access to utility companies' financial books and records, many states reported they do not have such direct access to the books and records of affiliated companies. While EPAct provides state regulators the ability to obtain such information, some states expressed concern that this access is narrow and could require them to be extremely specific in identifying needed information, thus potentially limiting their audit access. From a resources perspective, 22 of the 50 states reporting said that they needed additional staffing and funding to a carry out their oversight responsibilities.