FERC has made few substantive changes to either its merger review process or its postmerger oversight as a consequence of its new responsibilities and, as a result, does not have a strong basis for ensuring that harmful cross-subsidization does not occur. To review mergers and acquisitions, FERC officials told us that they do not intend to make changes to their process other than to require companies to disclose any existing or planned cross-subsidization and explain why it is in the public interest, and to certify in writing that they will not engage in harmful cross- subsidization. For postmerger oversight, FERC intends to continue to rely on its existing enforcement mechanisms, as expanded by EPAct, to detect potential cross-subsidies—primarily companies’ self-reporting of noncompliance and a limited number of compliance audits. However, FERC does not formally consider the risks posed by various companies in determining which companies to audit—a consideration that financial auditors and other experts told us is important when auditing with limited resources. We also found that where affiliate transactions were audited, the resulting audit reports sometimes lacked clear and useful information. FERC’s merger review process requires companies to submit evidence that a merger or acquisition will not result in unapproved cross- subsidization, and its ability to prevent cross-subsidization depends largely on commitments by the merging parties rather than independent analysis. FERC-regulated companies that are proposing to merge with or acquire a regulated company must submit a public application for FERC to review and approve. As part of its review of these applications, FERC is now responsible for ensuring that mergers do not result in harmful cross- subsidies. To do this, FERC attempts to ensure that mergers will not result in: any transfer of facilities between or issuance of securities by a traditionally regulated public utility to an affiliate; any new financial obligation by a traditionally regulated public utility for the benefit of an affiliate; or any new affiliate contract between a nonutility affiliate company and a traditionally regulated public utility company, other than agreements subject to review by FERC under the Federal Power Act. To fulfill this new responsibility, FERC established an additional requirement that the merging companies submit new information as part of their application for merger or acquisition approval, referred to as “Exhibit M.” Exhibit M requires companies to describe organizational and financial information, such as affiliate relationships and any existing or planned cross-subsidies. If cross-subsidies already exist or are planned, companies are required to describe how these are in the public interest by, for example identifying how the planned cross-subsidy benefits utility ratepayers and does not harm others. Further, in FERC’s recent supplemental merger policy statement, issued July 20, 2007, FERC provided additional guidance on certain types of transactions that are not likely to raise concerns about cross-subsidization—termed “safe harbors.” FERC also requires company officials to attest that they will not engage in unapproved cross-subsidies in the future and specifically requires the merger application, including Exhibit M, to be signed by a person or persons having appropriate knowledge and authority. FERC’s merger or acquisition decision is based on a public record that starts with an initial application. This record includes the filing of the initial application. FERC’s review process also allows stakeholders or other interested parties, such as state regulators, consumer advocates, or others to submit information and arguments to this public record for FERC to consider. FERC officials told us that they evaluate the information in the public record for the application and do not separately develop or collect evidence or conduct separate analyses of a proposed merger beyond what is submitted as part of the record. FERC officials told us that they can, and sometimes do, request that applicants provide additional information or conduct additional analysis. In addition, FERC may require a public hearing before making a decision. Whether or not a hearing is held, officials noted that they are required to make their decision based on the evidence that is in the public record. On the basis of this information, FERC officials told us that they will determine which, if any, existing or planned cross-subsidies may be allowed, which is then detailed in the final merger or acquisition order. According to experts, FERC is generally supportive of mergers. FERC officials largely acknowledged this perspective, telling us that under law and regulation, FERC must approve mergers that are consistent with the public interest. These officials also said that FERC believes it has broad flexibility in determining what is consistent with the public interest, particularly in light of changing conditions in the industry and, as such, it does not read the statute as creating a presumption against mergers. On the other hand, FERC officials said that FERC was not prepared to presume that all mergers were beneficial but that it was the merger applicant’s responsibility to demonstrate that the merger was consistent with the public interest by, for example, demonstrating how it improves efficiency or lowers costs while not harming competition. Between the time EPAct was enacted in 2005 and July 10, 2007, FERC has reviewed or was in the process of reviewing 15 mergers or potential mergers (see table 1). FERC has not rejected any merger applications. In nine cases, FERC approved the merger without condition. In three cases, FERC approved the merger with conditions, for example, requiring the merging parties to provide further evidence of ratepayer protection consistent with FERC-approved “hold harmless” provisions. One merger was withdrawn by the merging parties prior to FERC’s decision. The two other applications are still pending. FERC officials in the Office of Enforcement intend to use the same tools to enforce prohibitions on cross-subsidization that they currently use for other enforcement actions. In general, the Office of Enforcement relies on two primary tools—self-reporting and a limited number of compliance audits. However, we found that FERC does not use a formal risk-based approach to guide its audit planning—the active portion of its oversight efforts to detect cross-subsidization—or deploy its limited audit resources. As such, FERC’s actions do not provide a strong basis for ensuring the detection of potentially harmful cross-subsidization. The first detection tool that FERC emphasizes is that companies self- police their own affiliate transactions and intercompany relationships and voluntarily self-report instances of harmful cross-subsidization to FERC. FERC’s policy statement on enforcement emphasizes such voluntary internal compliance and reporting as well as cooperation with FERC in order to detect and correct violations. A company’s actions in following this policy, along with the seriousness of a potential violation, help inform FERC’s decision on the appropriate level of potential penalty to impose on violating companies. FERC indicates that it places great importance on company’s proactive self-reporting because it believes that companies are in the best position to detect and correct both inadvertent and intentional violations of FERC orders, rules, and regulation. According to FERC officials, companies can actively police their own behavior through a formal program for internal compliance, internal audits, and through annual external financial audits. Since the enactment of EPAct, when Congress formally highlighted its concern about cross-subsidization, no companies have self-reported any of these types of violations. FERC officials said that FERC had approved 12 settlements with natural gas and electric entities, none of which involved violations of the PUHCA 2005 provisions in EPAct. In these cases, FERC has assessed civil penalties totaling $39.8 million on the companies. FERC officials told us that because it can now levy much larger fines—up to $1 million per violation per day—they expect companies to become more vigilant in monitoring their behavior. Regarding FERC’s reliance on self-reporting, key stakeholders have raised several concerns about this approach. First, because FERC’s rules related to affiliate transactions are broad, company managers may not always be fully aware of how these rules apply to specific affiliate transactions. According to market experts, including a November 2007 report issued by a former FERC Commissioner on behalf of a broad consortium of energy companies, FERC’s rules are often written broadly and it is unclear what standards of conduct FERC uses to oversee transactions between companies. This can result in utility managers being unaware that specific transactions may violate current FERC policies. One controller we met with told us that these broad rules can be counterproductive in encouraging company compliance and self-reporting because it is difficult to determine if the rules are actually being violated. Second, internal company audits tend to focus on areas of highest perceived risk and, as a result, may not focus specifically on affiliate transactions. Internal auditors with whom we spoke told us that they have relatively small staffs and are responsible for auditing a wide range of matters within a corporation and, as such, they focus their efforts on areas they believe pose the highest risk to the company. They said this approach means that they rarely focus on affiliate transactions, unless those transactions represent a large financial exposure to the company’s potential profitability. Finally, financial audit firms we spoke with told us their work primarily focuses on auditing financial statement balances and related disclosures. These audits focus on providing an opinion about whether the financial statements present fairly, in all material respects, the financial position and operations of the company. As such, they said that their work with regard to affiliate transactions is limited to the related disclosures rather than determining if harmful cross-subsidization was occurring. Only in cases where transactions could have a material effect on the overall financial statements of a company would they conduct detailed testing and review pricing arrangements. Compounding these concerns, and FERC’s belief that the threat of large fines will encourage companies to self-report, companies expressed uneasiness over FERC’s use of its new penalty authority on self-reporting companies.