In February 2008, we reported that FERC had made few substantive changes to either its merger and acquisition review process or its postmerger oversight as a consequence of its new responsibilities and, as a result, does not have a strong basis for ensuring that harmful cross- subsidization does not occur. Specifically: Reviewing mergers and acquisitions. FERC’s merger and acquisition review relies primarily on company disclosures and commitments not to cross-subsidize. FERC-regulated companies that are proposing to merge with or acquire a regulated company must submit a public application for FERC to review and approve. If cross-subsidies already exist or are planned, companies are required to describe how these are in the public interest by, for example identifying how the planned cross-subsidy benefits utility ratepayers and does not harm others. FERC also requires company officials to attest that they will not engage in unapproved cross- subsidies in the future. This information becomes part of a public record that stakeholders or other interested parties, such as state regulators, consumer advocates, or others may review and comment on, and FERC may hold a public hearing on the merger. FERC officials told us that they evaluate the information in the public record for the application and do not collect evidence or conduct separate analyses of a proposed merger. On the basis of this information, FERC officials told us that they determine which, if any, existing or planned cross-subsidies to allow, then include this information in detail in the final merger or acquisition order. Between the time EPAct was enacted in 2005 and July 10, 2007––when FERC provided detailed information to us––FERC had reviewed or was in the process of reviewing 15 mergers, acquisitions, or sales of assets. FERC had approved 12 mergers, although it approved three of these with conditions– –for example, requiring the merging parties to provide further evidence of provisions to protect customers. Of the remaining three applications, one application was withdrawn by the merging parties prior to FERC’s decision and the other two were still pending. Postmerger oversight. FERC’s postmerger oversight relies on its existing enforcement mechanisms—primarily self-reporting and a limited number of compliance audits. FERC indicates that it places great importance on self-reporting because it believes companies can actively police their own behavior through internal and external audits, and that the companies are in the best position to detect and correct both inadvertent and intentional noncompliance. FERC officials told us that they expect companies to become more vigilant in monitoring their behavior because FERC can now levy much larger fines––up to $1 million per day per violation––and that a violating company’s actions in following this self-reporting policy, along with the seriousness of a potential violation, help inform FERC’s decision on the appropriate penalty. Key stakeholders have raised concerns that internal company audits tend to focus on areas of highest risk to the company profits and, as a result, may not focus specifically on affiliate transactions. One company official noted that the threat of large fines may “chill” companies’ willingness to self-report violations. Between the enactment of EPAct––when Congress formally highlighted its concern about cross-subsidization––and our February 2008 report, no companies had self-reported any of these types of violations. To augment self- reporting, FERC plans to conduct a limited number of compliance audits of holding companies each year, although at the time of our February 2008 report, it had not completed any audits to detect whether cross- subsidization is occurring. In 2008, FERC’s plans to audit 3 of the 36 companies it regulates—Exelon Corporation, Allegheny, Inc., and the Southern Company. If this rate continues, it would take FERC 12 years to audit each of these companies once, although FERC officials noted that they plan audits one year at a time and that the number of audits may change in future years. We found that FERC does not use a formal risk-based approach to plan its compliance audits––a factor that financial auditors and other experts told us is an important consideration in allocating audit resources. Instead, FERC officials plan audits based on informal discussions between FERC’s Office of Enforcement, including its Division of Audits, and relevant FERC offices with related expertise. To obtain a more complete picture of risk, FERC could more actively monitor company-specific data––something it currently does not do. In addition, we found that FERC’s postmerger audit reports on affiliate transactions often lack clear information––that they may not always fully reflect key elements such as objectives, scope, methodology, and the specific audit findings, and sometimes lacked key information, such as the type, number, and value of affiliate transactions at the company involved, the percentage of all affiliate transactions tested, and the test results. Without this information, these audit reports are of limited use in assessing the risk that affiliate transactions pose for utility customers, shareholders, bondholders, and other stakeholders. In our February 2008 report, we recommended that the Chairman of the Federal Energy Regulatory Commission (FERC) develop a comprehensive, risk-based approach to planning audits of affiliate transactions to better target FERC’s audit resources to highest priority needs. Specifically, we recommended that FERC monitor the financial condition of utilities, as some state regulators have found useful, by leveraging analyses done by the financial market and developing a standard set of performance indicators. In addition, we recommended that FERC develop a better means of collaborating with state regulators to leverage audit resources states have already applied to enforcement efforts and to capitalize on state regulators’ unique knowledge. We also recommended that FERC develop an audit reporting approach to clearly identify the objectives, scope and methodology, and the specific findings of the audit to improve public confidence in FERC’s enforcement functions and the usefulness of its audit reports. The Chairman strongly disagreed with our overall findings and the need for our recommendations; nonetheless, we maintain that implementing our recommendations would enhance the effectiveness of FERC’s oversight. States utility commissions’ views of their oversight capacities vary, but many states foresee a need for additional resources to respond to changes from EPAct. The survey we conducted for our February 2008 report highlighted the following concerns: Almost all states have merger approval authority, but many states expressed concern about their ability to regulate the resulting companies. All but 3 states (out of 50 responses) have authority to review and either approve or disapprove mergers, but their authorities varied. For example, one state could only disapprove a merger and, as such, allows a merger by taking no action to disapprove it. State regulators reported being mostly concerned about the impact of mergers on customer rates, but 25 of 45 reporting states also noted concerns that the resulting, potentially more complex company could be more difficult to regulate. In recent years, the difficulty of regulating merged companies has been cited by two state commissions––one in Montana and one in Oregon––that denied proposed mergers in their states. For example, a state commission official in Montana told us the commission denied a FERC-approved merger in July 2007 that involved a Montana regulated utility, whose headquarters was in South Dakota, which would have been bought by an Australian holding company. Most states have authorities over affiliate transactions, but many states report auditing few transactions. Nationally, 49 states noted they have some type of affiliate transaction authority, and while some states reported that they require periodic, specialized audits of affiliate transactions, 28 of the 49 reporting states reported auditing 1 percent or fewer over the last five years. Audit authorities vary from prohibitions against certain types of transactions to less restrictive requirements such as allowance of a transaction without prior review, but authority to disallow the transaction at a later time if it was deemed inappropriate. Only 3 states reported that affiliate transactions always needed prior commission approval. One attorney in a state utility commission noted that holding company and affiliate transactions can be very complex and time-consuming to review, and had concerns about having enough resources to do this. Some states report not having access to holding company books and records. Although almost all states report they have access to financial books and records from utilities to review affiliate transactions, many states reported they do not have such direct access to the books and records of holding companies or their affiliated companies. While EPAct provides state regulators the ability to obtain such information, some states expressed concern that this access could require them to be extremely specific in identifying needed information, which may be difficult. Lack of direct access, experts noted, may limit the effectiveness of state commission oversight and result in harmful cross-subsidization because the states cannot link financial risks associated with affiliated companies to their regulated utility customers. All of the 49 states that responded to this survey question noted that they require utilities to provide financial reports, and 8 of these states require reports that also include the holding company or both the holding company and the affiliated companies. States foresee needing additional resources to respond to the changes from EPAct. Specifically, 22 of the 50 states that responded to our survey said that they need additional staffing or funding, or both, to respond to the changes that resulted from EPAct. Further, 6 out of 30 states raised staffing as a key challenge in overseeing utilities since the passage of EPAct, and 8 states have proposed or actually increased staffing. In conclusion, the repeal of PUHCA 1935 opened the door for needed investment in the utility industry; however, it comes at the potential cost of complicating regulation of the industry. Further, the introduction of new types of investors and different corporate combinations––including the ownership of utilities by complex international companies, equity firms, or other investors with different incentives than providing traditional utility company services––could change the utility industry into something quite different than the industry that FERC and the states have overseen for decades.