In February 2008, we reported that FERC had made few substantive changes to either its merger and acquisition review process or its postmerger oversight as a consequence of its new responsibilities and, as a result, does not have a strong basis for ensuring that harmful cross- subsidization does not occur. Specifically: Reviewing mergers and acquisitions. FERC’s merger and acquisition review relies primarily on company disclosures and commitments not to cross-subsidize. FERC-regulated companies that are proposing to merge with or acquire a regulated company must submit a public application for FERC to review and approve. If cross-subsidies already exist or are planned, companies are required to describe how these are in the public interest by, for example identifying how the planned cross-subsidy benefits utility ratepayers and does not harm others. FERC also requires company officials to attest that they will not engage in unapproved cross- subsidies in the future. This information becomes part of a public record that stakeholders or other interested parties, such as state regulators, consumer advocates, or others may review and comment on, and FERC may hold a public hearing on the merger. FERC officials told us that they evaluate the information in the public record for the application and do not collect evidence or conduct separate analyses of a proposed merger. On the basis of this information, FERC officials told us that they determine which, if any, existing or planned cross-subsidies to allow, then include this information in detail in the final merger or acquisition order. Between the time EPAct was enacted in 2005 and July 10, 2007––when FERC provided detailed information to us––FERC had reviewed or was in the process of reviewing 15 mergers, acquisitions, or sales of assets. FERC had approved 12 mergers, although it approved three of these with conditions– –for example, requiring the merging parties to provide further evidence of provisions to protect customers. Of the remaining three applications, one application was withdrawn by the merging parties prior to FERC’s decision and the other two were still pending. Postmerger oversight. FERC’s postmerger oversight relies on its existing enforcement mechanisms—primarily self-reporting and a limited number of compliance audits. FERC indicates that it places great importance on self-reporting because it believes companies can actively police their own behavior through internal and external audits, and that the companies are in the best position to detect and correct both inadvertent and intentional noncompliance. FERC officials told us that they expect companies to become more vigilant in monitoring their behavior because FERC can now levy much larger fines––up to $1 million per day per violation––and that a violating company’s actions in following this self-reporting policy, along with the seriousness of a potential violation, help inform FERC’s decision on the appropriate penalty. Key stakeholders have raised concerns that internal company audits tend to focus on areas of highest risk to the company profits and, as a result, may not focus specifically on affiliate transactions. One company official noted that the threat of large fines may “chill” companies’ willingness to self-report violations. Between the enactment of EPAct––when Congress formally highlighted its concern about cross-subsidization––and our February 2008 report, no companies had self-reported any of these types of violations. To augment self- reporting, FERC plans to conduct a limited number of compliance audits of holding companies each year, although at the time of our February 2008 report, it had not completed any audits to detect whether cross- subsidization is occurring. In 2008, FERC’s plans to audit 3 of the 36 companies it regulates—Exelon Corporation, Allegheny, Inc., and the Southern Company. If this rate continues, it would take FERC 12 years to audit each of these companies once, although FERC officials noted that they plan audits one year at a time and that the number of audits may change in future years. We found that FERC does not use a formal risk-based approach to plan its compliance audits––a factor that financial auditors and other experts told us is an important consideration in allocating audit resources. Instead, FERC officials plan audits based on informal discussions between FERC’s Office of Enforcement, including its Division of Audits, and relevant FERC offices with related expertise. To obtain a more complete picture of risk, FERC could more actively monitor company-specific data––something it currently does not do. In addition, we found that FERC’s postmerger audit reports on affiliate transactions often lack clear information––that they may not always fully reflect key elements such as objectives, scope, methodology, and the specific audit findings, and sometimes lacked key information, such as the type, number, and value of affiliate transactions at the company involved, the percentage of all affiliate transactions tested, and the test results. Without this information, these audit reports are of limited use in assessing the risk that affiliate transactions pose for utility customers, shareholders, bondholders, and other stakeholders. In our February 2008 report, we recommended that the Chairman of the Federal Energy Regulatory Commission (FERC) develop a comprehensive, risk-based approach to planning audits of affiliate transactions to better target FERC’s audit resources to highest priority needs. Specifically, we recommended that FERC monitor the financial condition of utilities, as some state regulators have found useful, by leveraging analyses done by the financial market and developing a standard set of performance indicators. In addition, we recommended that FERC develop a better means of collaborating with state regulators to leverage audit resources states have already applied to enforcement efforts and to capitalize on state regulators’ unique knowledge. We also recommended that FERC develop an audit reporting approach to clearly identify the objectives, scope and methodology, and the specific findings of the audit to improve public confidence in FERC’s enforcement functions and the usefulness of its audit reports. The Chairman strongly disagreed with our overall findings and the need for our recommendations; nonetheless, we maintain that implementing our recommendations would enhance the effectiveness of FERC’s oversight. States utility commissions’ views of their oversight capacities vary, but many states foresee a need for additional resources to respond to changes from EPAct. The survey we conducted for our February 2008 report highlighted the following concerns: Almost all states have merger approval authority, but many states expressed concern about their ability to regulate the resulting companies. All but 3 states (out of 50 responses) have authority to review and either approve or disapprove mergers, but their authorities varied. For example, one state could only disapprove a merger and, as such, allows a merger by taking no action to disapprove it. State regulators reported being mostly concerned about the impact of mergers on customer rates, but 25 of 45 reporting states also noted concerns that the resulting, potentially more complex company could be more difficult to regulate. In recent years, the difficulty of regulating merged companies has been cited by two state commissions––one in Montana and one in Oregon––that denied proposed mergers in their states. For example, a state commission official in Montana told us the commission denied a FERC-approved merger in July 2007 that involved a Montana regulated utility, whose headquarters was in South Dakota, which would have been bought by an Australian holding company. Most states have authorities over affiliate transactions, but many states report auditing few transactions. Nationally, 49 states noted they have some type of affiliate transaction authority, and while some states reported that they require periodic, specialized audits of affiliate transactions, 28 of the 49 reporting states reported auditing 1 percent or fewer over the last five years. Audit authorities vary from prohibitions against certain types of transactions to less restrictive requirements such as allowance of a transaction without prior review, but authority to disallow the transaction at a later time if it was deemed inappropriate. Only 3 states reported that affiliate transactions always needed prior commission approval. One attorney in a state utility commission noted that holding company and affiliate transactions can be very complex and time-consuming to review, and had concerns about having enough resources to do this. Some states report not having access to holding company books and records. Although almost all states report they have access to financial books and records from utilities to review affiliate transactions, many states reported they do not have such direct access to the books and records of holding companies or their affiliated companies. While EPAct provides state regulators the ability to obtain such information, some states expressed concern that this access could require them to be extremely specific in identifying needed information, which may be difficult. Lack of direct access, experts noted, may limit the effectiveness of state commission oversight and result in harmful cross-subsidization because the states cannot link financial risks associated with affiliated companies to their regulated utility customers. All of the 49 states that responded to this survey question noted that they require utilities to provide financial reports, and 8 of these states require reports that also include the holding company or both the holding company and the affiliated companies. States foresee needing additional resources to respond to the changes from EPAct. Specifically, 22 of the 50 states that responded to our survey said that they need additional staffing or funding, or both, to respond to the changes that resulted from EPAct. Further, 6 out of 30 states raised staffing as a key challenge in overseeing utilities since the passage of EPAct, and 8 states have proposed or actually increased staffing. In conclusion, the repeal of PUHCA 1935 opened the door for needed investment in the utility industry; however, it comes at the potential cost of complicating regulation of the industry. Further, the introduction of new types of investors and different corporate combinations––including the ownership of utilities by complex international companies, equity firms, or other investors with different incentives than providing traditional utility company services––could change the utility industry into something quite different than the industry that FERC and the states have overseen for decades. In light of these changes, we believe FERC should err on the side of a “vigilance first” approach to preventing potential cross- subsidization. As FERC and states approve mergers, the responsibility for ensuring that cross-subsidization will not occur shifts to FERC’s Office of Enforcement and state commission staffs. Without a risk-based approach to guide its audit planning––the active portion of its postmerger oversight– –FERC may be missing opportunities to demonstrate its commitment to ensuring that companies are not engaged in cross-subsidization at the expense of consumers and may not be using its audit resources in the most efficient and effective manner. Without reassessing its merger review and postmerger oversight, FERC may approve the formation of companies that are difficult and costly for it and states to oversee and potentially risky for consumers and the broader market. In addition, the lack of clear information in audit reports not only limits their value to stakeholders, but may undermine regulated companies’ efforts to understand the nature of FERC’s oversight concerns and to conduct internal audits to identify potential violations that are consistent with those conducted by FERC— key elements in improving their self-reporting. We continue to encourage the FERC Chairman to consider our recommendations. Mr. Chairman, this completes my prepared statement. I would be happy to respond to any questions you or other Members of the Committee may have at this time. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this testimony. For further information about this testimony, please contact Mark Gaffigan at (202) 512-3841 or at gaffiganm@gao.gov. Individuals who contributed to this statement include Dan Haas, Randy Jones, Jon Ludwigson, Alison O’Neill, Anthony Padilla, and Barbara Timmerman. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Under the Public Utility Holding Company Act of 1935 (PUHCA 1935) and other laws, federal agencies and state commissions have traditionally regulated utilities to protect consumers from supply disruptions and unfair pricing. The Energy Policy Act of 2005 (EPAct) repealed PUHCA 1935, removing some limitations on the companies that could merge with or invest in utilities, and leaving the Federal Energy Regulatory Commission (FERC), which already regulated utilities, with primary federal responsibility for regulating them. Because of the potential for new mergers or acquisitions between utilities and companies previously restricted from investing in utilities, there has been considerable interest in whether cross-subsidization--unfairly passing on to consumers the cost of transactions between utility companies and their "affiliates"--could occur. GAO was asked to testify on its February 2008 report, Utility Oversight: Recent Changes in Law Call for Improved Vigilance by FERC (GAO-08-289), which (1) examined the extent to which FERC changed its merger review and post merger oversight since EPAct to protect against cross-subsidization and (2) surveyed state utility commissions about their oversight. In this report, GAO recommended that FERC adopt a risk-based approach to auditing and improve its audit reports, among other things. The FERC Chairman disagreed with the need for our recommendations, but GAO maintains that implementing them would improve oversight. In its February 2008 report, GAO reported that FERC had made few substantive changes to either its merger review process or its post merger oversight since EPAct and, as a result, does not have a strong basis for ensuring that harmful cross-subsidization does not occur. FERC officials told GAO that they plan to require merging companies to disclose any cross-subsidization and to certify in writing that they will not engage in unapproved cross-subsidization. After mergers have taken place, FERC intends to rely on its existing enforcement mechanisms--primarily companies' self-reporting noncompliance and a limited number of compliance audits--to detect potential cross-subsidization. FERC officials told us that they believe the threat of the large fines allowed under EPAct will encourage companies to investigate and self-report noncompliance. To augment self-reporting, FERC officials told us that, in 2008, they are using an informal plan to reallocate their limited audit staff to audit the affiliate transactions of 3 of the 36 holding companies it regulates. In planning these compliance audits, FERC officials told us that they do not formally consider companies' risk for noncompliance --a factor that financial auditors and other experts told us is an important consideration in allocating audit resources. Rather, they rely on informal discussions between senior FERC managers and staff. Moreover, we found that FERC's audit reporting approach results in audit reports that often lack a clear description of the audit objectives, scope, methodology, and findings--inhibiting their use to stakeholders. GAO's survey of state utility commissions found that states' views varied on their current regulatory capacities to review utility mergers and acquisitions and oversee affiliate transactions; however many states reported a need for additional resources, such as staff and funding, to respond to changes in oversight after the repeal of PUHCA 1935. All but a few states have the authority to approve mergers, but many states expressed concern about their ability to regulate the resulting companies. In recent years, two state commissions denied mergers, in part because of these concerns. Most states also have some type of authority to approve, review, and audit affiliate transactions, but many states review or audit only a small percentage of the transactions; 28 of the 49 states that responded to our survey question about auditing said they audited 1 percent or fewer transactions over the last five years. In addition, although almost all states reported that they had access to financial books and records from utilities to review affiliate transactions, many states reported they do not have such direct access to the books and records of holding companies or their affiliated companies. While EPAct provides state regulators the ability to obtain such information, some states expressed concern that this access could require them to be extremely specific in identifying needed information, thus potentially limiting their audit access. Finally, 22 of the 50 states that responded to our survey question about resources said that they need additional staffing or funding, or both, to respond to changes that resulted from EPAct, and 8 states have proposed or actually increased staffing since EPAct was enacted.