-: PUC Committee meeting on this date,
Wednesday, December 8th, 2021.
All parties are on listen only,
during the public comment section,
you can press star one.
Today's call is being recorded.
If you have any objections, please disconnect.
I will turn today's call over to President Batjer.
Thank you, you may begin.
-: Thank you so much operator.
Well, I'd like to say good morning to everyone
and thank you for joining us today.
I am calling the CPUC Commissioner Committee meeting
of December 8th, 2021 to order.
There are three committees here at the CPUC,
the Finance and Administration Committee,
the Policy and Governance Committee
and the Emerging Trends Committee.
Today, the Emerging Trends
and the Finance Administration Committee will meet.
Due to the Corona virus pandemic
and the shelter in place order,
we are conducting today's committee meeting online
and by remote participation,
the meeting is live-streamed on CPUC's website.
You can view the meeting
at www.adminmonitor.com/com/ca/cpuc.
And adminmonitor is all one word.
Closed captioning is available in English and Spanish
through the webcast.
You can click on the green button to select your language
of choice.
We will have an opportunity for the public to comment
following the Q&A and discussion
among the Commissioners.
If you wish to make a public comment or ask a question,
please dial 800-857-1917
and enter code 5180519 pound
and press star one.
You will be placed into a queue and it will be called upon
to speak when we get to the public comment period,
we will be at the end,
and which of course that will be the public comment period
will be at the end of the committee.
I will now turn the Commission to Commissioner Shiroma
to introduce the items on the emerging trends agenda,
Commissioner Shiroma.
-: Yes, thank you, President Batjer.
Good morning, everyone.
For our emerging trends committee presentation,
we will hear from Jim Chil, Program Manager in the Security
and Resilience Branch of our Safety Policy Division
and Dan Bouts, Director of the Safety Policy Division.
Jim has a decade of experience at FEMA and a master's degree
from University of Michigan.
Dan, prior to joining the Commission
served as Assistant Director
at the California Governor's Office of Emergency Services,
has an extensive background with the Armed Forces
and obtained a PhD in industrial
and organizational psychology
from Walden University.
Earlier this year,
Commissioner (indistinct) and I were working
on our Emerging Trends Committee work plan.
Some folks will recall we did a survey with most staff
and one of the topic areas
we included is a cybersecurity into the work plan.
As a result of all of these efforts,
it's an important topic given the ever-changing state
of affairs.
And when we saw the colonial pipeline ransomware attack
that occurred last may,
we saw an opportunity to focus the cyber security
presentation on this issue.
So today Tim and Dan will present us information
about ransomware,
including the colonial pipeline incidents
and overview of trends in ransomware and discussion
of its relevance to our regulated utilities.
All right, Jim and Dan, take it away.
-: Thank you, Commissioner.
So my name are Jim Chill.
I'm the Program Manager for security and resilience.
Dan, did you sorry to interrupt you.
I didn't mean to cut you off.
-: No, no, no.
Please, go ahead.
-: Okay.
So we put together a presentation.
This is one slice of cybersecurity and an issue.
So it's, I just,
before we get into the actual presentation itself,
it's a very large area, very vast area.
This is just one very specific look in.
I think it helps to provide some insights to it by looking
at a specific case such as colonial pipeline,
the link to the next slide,
just a quick overview of how this presentation
is gonna go.
One, we'll just give a very quick one-on-one on ransomware.
We could spend days doing it,
but just very quickly go into the mechanics of the colonial
pipeline, ransomware attack,
discuss some challenges
and then field any questions as needed.
So moving on to the next slide.
So this is the ransomware overview and we have,
these are common attack methods
and this is terminology you'll hear getting thrown around
a lot in the news by CNN, by Fox, depending on how,
whatever news program, everybody watches.
But we'll hear malware or phishing or zero day exploits.
And these are all just different attack methods
that are used.
Now, they're not all of them,
but they're probably the most commonly known
and displayed out to the public.
Going to the next slide.
Okay.
So ransomware,
the basics of ransomware is that it's actually one of many
different types of attacks.
And essentially what happens is that data is usually
encrypted and then held hostage until a ransom is paid.
And sometimes there's something called a double hot,
a double ransom, which is not only are
they gonna decrypt it,
but they also won't share it with everybody.
So there's a lot of avenues to this.
And it's evolved from this whole idea of just
a single group that has the skillset to do it to also being
done as a service too.
So it's actually now available to maybe non-technical
organizations for a price.
And what we've have seen is that ransomware payments in 2020
have climbed this year 82% and prior year
to that was 171%.
So we're seeing an increase in the average ransomware
payments going up.
Now, that's just to say that these numbers are pretty,
it's not as clear and tightly calculate as GDP or things
like that, because really there's a lot of,
not a lot of sharing of the information widely and publicly.
So this is just one of the publicly available numbers
that we feel has some that can provide a range
in terms of how much this actually costs.
Moving to the next slide.
So this is the ransomware methods.
And one thing that I really liked this slide,
because what this definitely shows is,
there's all these methods in terms of how people use code
and computers to create a situation
where they can actually demand a ransom.
But what this shows that a lot of this shows
is at the center of it, there's a human element.
There's a person element to ransomware where it can be
prevented by people.
And good computer hygiene, good cybersecurity hygiene.
And so it doesn't, I think
there's a lot of focus on the technical hardware aspect
of ransomware and cyber security,
but really a lot of it comes down to the people
and this shows that things like spam and phishing emails
to weak passwords and account management
and access management are all human-driven
types of situations.
So it puts a kind of a face
to the security as well as the attack to,
so moving on to the next slide.
So we get a little bit into the colonial pipeline
ransomware attack, and just to start off with,
colonial pipeline did not have any direct effects
on California.
Most of the in which all the infrastructure goes
from west to east.
And so that was something that we saw and we actually under
supported the calcium in the analysis of the infrastructure,
which is the state lead for cybersecurity.
Moving to the next slide.
So we're gonna go over kind of who was involved,
what were the impacts and then challenges exposed.
So gonna the next slide.
So colonial pipeline, just a quick overview of what it is,
basically it it basically supplies fuel,
including gasoline, diesel, heating oil, jet fuel
and military supplies basically from pretty much primarily
the Gulf of Mexico and into the Eastern seaboard
of the country.
And so it's one of the largest pipeline operators
and they deliver 2.5 million barrels a day
over 55 other miles of pipeline,
which makes it a very large piece of infrastructure.
And in terms of delivery of key fuels to an operations,
and that could impact anywhere from airports to home
heating, to transportation delivery logistics companies.
So that's kind of the larger kind of tangible impacts
that could happen even with short-term disruptions.
Moving to the next slide.
So the group that was allegedly responsible for this
is a group called DarkSide Hacking Group.
And here, I don't wanna focus too much on who they are,
but this is just an example of that
they're pretty well-organized as an organization.
They've been around probably about a year or so,
they have a website that has a press room,
a mailing list and hotline for victims to call.
They have a code of ethics from what we can tell from open
source information that's out on the web.
And so that they don't always,
they don't attack hospitals from what we understand
and schools or universities or non-profits.
So that's just, and this is not to say,
a question about their ethical values here,
but they're a much more or sophisticated group in terms
of they have an ethos, they have organizations
for communication, and obviously
they have the capability
of conducting the ransomware operations.
So, there's--
-: Sorry to cut you off here, but I'm not.
So, I mean, is this a legal thing I'm confused?
Like why are they allowed to have a website
and like have a code of ethics?
Like, is this something is like,
I'm missing something here.
-: Well, it's more of, there really,
what this slide is to say is that they're organized,
much more organized than just a group
of people with computers.
They have,
nothing is actually prevents them from having a website
per se,
and nothing actually prevents them from having an ethos
or a mission statement as an organization.
So it's just,
when we think about kind of an organization going
from playing Sandlot baseball to maybe,
minor league pro baseball,
they have mission statements, you have coaching,
you have a whole infrastructure around it,
not just the ball bat.
And so that's really, we're talking about, sorry.
-: Oh, you do.
But just to answer your question, also,
a lot of these companies,
existing countries without extradition treaties
to the United States.
So this is like an international environment,
and they're very peculiar about where they host
their services to provide them the greatest amount
of flexibility based on local laws.
-: Wow. Okay.
Thank you.
-: Okay.
So this dark side is organized group,
and there are other organized groups like DarkSide,
this is just to demonstrate that
it's an organization behind these groups.
There's a level of professionalism behind these groups,
regardless of whether their service or products that they're
actually providing.
So moving to the next slide.
Just that we wanted to show this slide,
because we wanted to give people a feel for how these things
kind of potentially happen.
This is not a screenshot from the DarkSide ransomware
during event with colonial pipeline,
but it is kind of what the thing that people will see.
And we just wanted to ground it a little bit with this image
where it kind of notifies that files have been encrypted.
There's a ransom amount,
and then time until the ransom is increased,
or files are encrypted permanently,
as well as potentially any other demands
that are part of what the group wants.
And this is something that somebody would see
on their screen.
So it's not a subtle email or a large press announcement.
It's pretty targeted in terms of the communication from what
we've seen.
Going to the next slide.
So just to walk through the timeline of events,
and so on May 6th, there was an initial intrusion and theft,
meaning that they got access to the network,
and they were able to encrypt data and then threatened
to leak it to the internet.
On May 7th, they continue, there was an assessment done
there was network, I'm sorry, the brand,
some were effective billing and accounting systems.
And so what colonial pipeline did is basically they took
certain systems offline to contain the threat.
And so, the colonial pipeline ransomware attack
primarily effected information technology.
It did not affect the actual operational technology,
meaning that the programs and the machines
that impacts the direct physical operation of the pipeline.
And so this was really more billing and accounting
information pieces,
but what was happening is that because they couldn't bill
and then they can really deliver either.
And so on the seventh colonial pipeline paid the ransom,
and it was valued approximately at $4.4 million.
And that allowed the company to get the decryption key
and then became the recovery process.
Now one would think, oh you know what,
it's really great to just,
we got decrypted the data,
and now we can be back up and running,
but there's a tail to this in terms of the recovery
where just because the data was decrypted,
that does the group, also the company go back and assess,
actually do a full assessment of their network
and their systems to make sure that things
are not still embedded there,
or they're not gonna be vulnerable to another attack again.
So there's a bit of a lag in terms of the ransom is paid
and then there's time that's gonna happen.
Usually, like for an example, if,
to make it analogous to a kidnapping situation,
you pay the ransom and usually the person
you get the person back.
And then the situation is pretty much over for the most part
in terms of the hostage situation,
but here there's a lot more recovery that's involved.
So what happened on May 9th is that the department of
transportation issued a regional emergency declaration,
which allowed for just the relaxation of labor laws,
governing drivers,
and allowed them to keep fuel supplies open
for that period of time.
And then on the 12th colonial pipeline restarts
the operations.
What was interesting also about this is about fast-forward
about maybe a month and US Department of Justice recovers,
probably about 2.3 million of that ransom,
which was very interesting.
There's very little actually about that.
But the fact that they were able to do that
was kind of a situation where a lot of people didn't think
that Department of Justice or ransoms could be recovered,
but means and methods are not,
or have not been widely shared on how that was done,
but they did report that that was done.
Moving on to the next slide.
So just to take this outside of just colonial pipeline
and their systems,
what we did see as a short-term price increase and shortages
that were driven by panic rather than supply,
given that it was about a five day event where the pipelines
were down, we saw demand spike about 20% for gasoline.
And then also the national average push the up
7 cents for gasoline to $3 and 3 cents,
which is I'd love to pay $3 and 3 cents for gasoline
in California.
But that's just to put that in context,
that's the national average,
and it increased that in person to 7 cents.
Okay. So moving on to the next slide.
So what this colonial pipeline case study,
as well as other ransom cybersecurity events have
brought up is some challenges.
And so we just kind of picked two of the bigger ones that
we've seen in our interactions and just looking at various
other cyber security incidents out there,
and to go into the next slide here,
the first one is really the ransom payments, right.
To pay, not to pay and who has to pay.
Those are really the three questions associated with that.
The Columbia pipeline paid, they paid the ransom,
and then however,
the federal government and government stance has been don't
pay the ransom.
So then the quandary there is, okay, well, do I pay,
or do I let this piece of infrastructure just sit there
and not operate right.
And have national impacts?
The other side of this is that actually insurance companies
have a major role in this
and a lot of it has to do with how the ransom gets paid
and what the company does and the things
that they need to do actually govern whether or not
they're covered under their cyber security insurance.
So it's a big thing in terms of creating a preparedness,
but also they do have a very large thing in this who gets
paid and how they get paid,
but also how the companies go about their business too.
So any questions about this challenge number one?
Okay. Moving to challenge number two.
So this is really the big piece, not just,
it's not just computers going back to the people's
situations and the organizational situation where there's
a multitude of players and processes
associated with cybersecurity.
And that is one of the big challenges in terms of
how we work forward, how we respond, recover, prepare,
and mitigate, and then evolve in that cycle to actually,
be prepared for cyber security,
because that mitigation is a sort of a never ending cycle.
There's always someone who's gonna be smarter and better.
And then you got to match that, or be better than that.
And so, it's an ongoing cycle with that,
but it does show a large set of kind of what we call
the alphabet soup of, DOD FEMA,
DOE, Department of Energy, DHS, cyber security.
You can see.
There's the NIST who's provides frameworks
and guidance, and then there's UL.
And there's, there's,
there's a lot of people involved with this and there's,
it's not just one person that has the silver bullet
in terms of cyber security and ensuring that,
we're mitigating and ready for cyber attacks.
And so that is kind of a big challenge because we have
technology evolving very quickly.
And then we also have this wide range of stakeholders
that may not have a full ownership stake in the issue
or that specific issue.
Let's say it's a piece of critical infrastructure,
but they do have a stake in sometimes the consequences
of that infrastructure, not being operational.
So a lot of people involved, which is great,
but also getting our arms around and hurting those cats
is also very critical in terms of making sure
that we're installed and ready for things
and able to mitigate or respond
and recover from cyber attacks.
So what that means for us as sort of our IOUs
and as a regulator and IOUs
and a lot of it is bringing these folks together
and ensuring that they're coordinated, they're connected.
If there's a response that they've met each other before
that they have process and procedures
that they're integrated,
obviously working with DOD is very different than working
with someone like Department of Energy, different cultures,
different ways of doing business, different resources too.
And so bringing everybody together early on,
and we've been working with Calla,
we asked the council to do that,
is to bring all these players together,
all the best thinking the process
and the players and the processes together to make sure
that one, everybody's working together
because there's stakes, everybody has a stake in it.
FEMA has consequence management.
DHS has very specific technical cyber security
responsibilities, Calloway acts as consequence management.
And the council has also very specific cyber security
responsibilities to as lead agency within our state
of California.
So really what it is,
is bringing the stakeholders together
and bringing our IOUs and giving them access,
but also helping build that team that we need
to be able to respond, recover, and mitigate.
So that is all I have for this.
Any questions?
-: Thank you, Jay.
Dan, anything else?
And then we'll open up.
-: Nothing additional.
-: Okay. All right.
-: Commissioner Shiroma I have a question it's Maribel.
-: Yes, what about it?
-: I don't mean to jump ahead if I'm interrupting you,
I apologize.
-: No, you're fine.
-: Okay, Jim, I was just wondering,
you mentioned coordinating with Cal sec at the end.
And Dan and I kind of lived through a little bit
of this together when it all happened with colonial.
And I'm just wondering if you could explain the coordination
without obviously revealing things that we can't publicly,
but if you could reveal a little bit how the coordination
works at the state level with Calloway yes.
And the SEC and what the SEC does
and who is the lead agency.
I think the Commissioners would benefit from hearing that.
-: Absolutely. Okay.
So the tell seasick,
based out of California is the state agency lead
for cybersecurity at large,
but they are also a combination of multiple agencies.
So they have the California Military Department,
the California Highway Patrol,
the California Department of Technology
among many other agencies included, excuse me,
included in that group are several of Jim's P analyst,
as well as Jim have the security clearances to allow them
to have those discussions.
And there's an important additional aspect
of the Cal Cizik,
which is embedded federal cybersecurity entities.
And so as these incidents start to unfold,
we can provide our expertise to the Cal Cizik to help them
understand what the potential impacts are to ensure
that they get to the right point of contact
if they don't have them with the IOUs.
And then also just to ensure,
that those coordinations have happened beforehand.
So when everyone pulls out their phone books,
they know exactly who to dial to.
And there's not this like,
who should I call, I'm uncertain because that hesitation
obviously can be a big impediment to respond.
-: So then Dan let's go into real time as we can
for a second.
So when there is say a ransom attack,
and we're notified of it by FBI,
and hopefully not the media first, but whatever,
our first reach out, my understanding is to Cal Cizik.
And then we do the real fast reach out to those entities
we regulate who may be impacted, is that correct?
Or is that the wrong sequence?
-: That's correct.
-: I just wanted to make sure that my fellow Commissioners
knew that because that sequence,
I know currently there may be changes in the future,
but currently that that sequence is very important
to the Cal Czic and then that we're immediately,
as soon as we possibly know it are in the loop
with CalCzec.
So thank you, Dan.
And thank you, Jim.
And thank you, Commissioner Shiroma
for letting me ask that question.
-: Thank you, President Batjer,
that's very important and helpful information in any of us,
maybe loosely aware of some of these things in the media
and so forth.
It's important for our team to be able to respond quickly.
And it's good to know that there is a team there's a set of
protocols, that's phone numbers and working relationships,
rather than just calling somebody that you've never talked
to before never met before those working relationships
are really key.
This information today from Jim and Dan as to here in this
fashion is, is quite stunning,
but it's important for us to know.
Other Commissioners, questions or comments.
Okay.
Thank you.
Thank you, Dan.
Thank you, Jim.
Keep up the good work or catalog it.
-: Thank you both very much.
-: All right. Back to your President Batjer.
Okay. I think we're now moving on to the risk and compliance
branch for their briefing.
I believe I saw Angie coming on earlier.
I'm not quite sure who's going to do this presentation.
Rachel, are you sorry, I don't have those notes.
I'll introduce President Batjer.
And then we will hear from Rachel and Angie.
So, again, thanks to Jim and Dan
for the Emerging Trends Committee presentation.
Now we will turn to Finance and Administration Committee.
We have a presentation from director Angie Williams
on the Commission's risks identified as part of the State
Leadership and Accountability act or SLAA.
I'm gonna introduce Director Williams.
We will then hear from Executive Director, Rachel Pearson,
and then hear Angie's presentation.
So Director Williams we'll walk us through the identified
SLAA risks, our response action plans and milestones.
We will also hear about the status of implementing audit
recommendations from our control agencies and audits
that are in progress.
How can I, as co-chairs of the Finance
and Administration Committee
received a pre-brief from director Williams as part
of the work towards strategic directive 12 on this,
Andy Williams has served as Director
of the Commissioners Utility Audits,
risks and compliance division since April of 2019.
Prior to joining the Commission,
Angie worked at the California Department of Finance
for 19 years,
leading complex audits and revamping the state leadership
and accountability act.
And Angie holds a bachelor's of arts in accounting
from California State University at Chico.
Now, at this point,
I'm gonna turn the mic over to our Executive Director,
Rachel Pearson,
for some additional introductory remarks
and both executive director Pearson,
and Angie will be available during the Q7A.
Executive Director Pearson.
-: Good morning, Commissioner Shiroma,
President Batjer and Commissioners.
Thank you very much for the opportunity to be here
this morning.
I actually can't let the last presentation go
without just two connecting points.
Number one,
where James chose spoke about the human elements
of our vulnerability to cyber security threats,
our own IT department sends out and requires
all staff and take an annual cyber security awareness
training in order to cut down on the risk
that we will fall subject
to one of those phishing email scams.
So small plug all staff,
please complete your cyber security awareness training
for 2021.
And then just as we turn to Angie and her presentation,
cybersecurity is one of those emerging threats.
We've all become much more familiar with it
over the last several years,
but it is one of those threats to the CPCs ability
to execute on our mission.
It's both a threat to us as an agency and to the utilities
that we regulate.
And so that's just one example of the importance of work
by director Angie Williams, as she works with
myself and our senior management,
and with you Commissioners to use different tools,
different cycles, different reports to assess risks,
establish management practices that mitigate against
those risks and then drill down and see how well we're doing
on actual achievement of that mitigation.
So I really thank you for asking
for this presentation today.
I think Angie's work is very important and I'm very glad
that she'll be able to give you the snapshot
of this year's State Leadership Accountability Act,
risk assessment that we're about to submit.
Thank you very much. All right.
Over to you, Angie.
-: Hey, good morning, thank you.
Again, my name is Angie Williams and I'm the Director
of the Utility Audits, Risk and Compliance Division.
We go to the next slide.
Today, I'm gonna be discussing the background of the State
Leadership Accountability Act in case some of you are not
familiar with it.
And the walk you through the risk process that we went
through this year,
I'll also discuss the five sleigh risks that we identified,
the action plans and the milestone date.
I'll also provide a status update for the internal
and external audit recommendations that we have,
and also discuss the audits that are currently in progress.
So just a quick background, as you guys mentioned,
the State Leadership Accountability Act is known as SLAA.
It's a requirement and the government code.
So all state departments must comply.
The report is due December 31st, 2021 and every odd year.
And then we also will submit implementation plans
that are due every six months to Department of Finance
and other control agencies are CC'd on that as well.
And then our risk process was a collaborative effort with
the executive director and senior management team where we
sat down and we identified our goals for the year and what
risks could prevent us from meeting those goals.
And that's how we came up with the risks that I'll share
the next few slides.
So risk one is the staff recruitment retention
and staffing levels.
Just so when I talk about action plans,
I'm kind of using the word action plan and controls
interchangeably here in this situation,
and may not read every action plan just due to time.
So if you have any questions,
please feel free to stop me and ask.
So in order to address this risk of recruitment, retention,
and staffing levels,
we plan to update and implement a recruitment plan.
We want to update and implement our workforce
in succession plan.
We're also doing activities like changing our remaining
in-person job exams to make sure that they're online
so we can hopefully get more people participating.
And then we also want to support activities that have been
developed by the diversity equity and inclusion work group.
Next.
Two is workforce in succession planning.
Oh, yes.
Please go ahead.
-: Commissioner (indistinct) wanted to ask the question.
-: Yeah.
And none of the Commissioners wrong,
if you prefer, we wait until the end,
but I just had a very quick question on that last slide,
how many exams do you happen to know how many exams
are still not online?
-: I believe we have two last that we still wanna put online.
I know for sure that we have the financial examiner one that
is not online currently.
-: Okay. So we've gotten most of exams are now online.
Just a couple of them remaining.
-: Yeah.
So we have the engineer one that was a big push last year
that we worked on getting that one online.
And this year I know we're working hard to get the financial
examiner one online.
-: Okay. Thank you.
-: Thank you.
Beck to you, Angie.
-: Next slide, risk two.
Thank you.
Here, we have workforce and succession planning.
So this is where really where we want to reduce the risk
of having a key person dependency issue,
where maybe there's only one person or one small group
of people who know how to do something.
So we really wanna plan for this.
Here, we wanna finalize and distribute our technical
advice on knowledge management guide.
That's it's a very detailed knowledge transfer guide
that we're drafting.
We also, again,
wanna update and implement our workforce in succession
plan items.
And then we also hope to relaunch
our Strategic Mentoring Program.
Next.
Here, risk three technology.
This is a very common one,
identify and usually through all the state departments
have this as one of their highest risks usually.
So for technology, we have support tools,
design, and maintenance.
We wanna finalize our scoring criteria and create
an initial IT project prioritization portfolios utilized
by the Information Technology Governance Committee
that we have in place now.
We will also wanna make sure that we've updated
our policies and procedures, and we have them.
We also want to establish a uniform data retention policy
for the Commission.
We do have a data retention policy and overarching one
already in place,
but we want to ensure that each division has a more detailed
plan that can really focus on what we have stored
on our systems in order to create more storage.
Next.
risk four, is internal controls and oversight,
here we wanna complete an enterprise wide safety program,
assessment of CPUC's, organizational,
and business safety systems.
And then once we've completed that assessment,
we wanna initiate a health and safety policies
and programs to respond to the findings that we identified
in that assessment.
And then we also want to ensure through that assessment
and the findings that we implement that were
in accordance with OSHA and Cal/OSHA.
So those are two big pushes for this internal controls
and oversight.
Risk five, this one is addressing CPUC's oversight
of regulated utilities.
Here, we're looking to develop new water citation procedures
to establish a patient programs for water companies
that are in violation of either our public utility code,
Commission orders or general orders.
We also really have been working hard to implement audit
recommendations to improve our fiscal safety oversight.
We also wanna refine our reporting requirements
for the utility risk spending accountability reports.
That's something that the Energy Division is working on.
Also, we have the utility audits branch.
There's a new section and that branch
with communication section.
And so they're gonna be completing some audits
on different carriers this year.
And then we're also gonna implement
enforcement committee activities.
We already have a enforcement committee in place.
So now we're working on the detailed of the activities
and the action plans that we wanna implement.
Next.
Next I'll provide an update on our audit recommendations.
These are audits that has been performed on the CPUC
by either our internal audit group,
known as IAS internal audit services
or by control agencies.
We've been tracking,
as you can see on the pie chart on the left,
the internal audit ones since 2018,
let's see, for internal audits,
we've had a total of 49 audit recommendations since 2018,
and we've been able to implement 32 of those already.
We still have 15 of them in progress.
That's what the orange shows.
And then two that will not be implemented
just to give an example of the will not implement it.
In case you're curious is for example,
our internal audit services has suggested that we purchased
some software to help us track our inventory.
And we've decided that purchasing the software
really isn't necessary.
At this point, we can really implement the control
and have a good solid system in place
by just utilizing Excel and expanding
some more columns on there that we track.
So we've decided to use a more cost effective approach
there, and that's why it's not implemented.
And then for external auditing,
we've had 237 audit recommendations,
but this does go back to since 2012.
And we've been very aggressive lately and we've been
cleaning up a lot of the audit recommendations
and implementing them and strengthening our controls.
So we're up to implementing 161 now, we have 68 remaining,
and then we have eight that will not implement.
And then next,
this is kind of the same information presented
a little different.
This shows a little bit more detail about the difference
control agencies that perform the audits
and when they perform them, as you can see,
there's quite a job in 2020 and 2021 for implementation.
And that's really due to the executive director
Rachel's leadership.
She has implemented and new process of accountability
and reporting,
and just her support with risk and compliance branch has
really made this successful effort and we continue
to implement the control.
So I greatly appreciate her support
Next slide.
Is, these are the audits that are in progress.
So our internal audit shop here at the CPUC has finishing up
two of them, those are the top two that started in 2019.
Those are currently being reviewed
by the chief acting chief.
And then the other four below,
there are ones that I've just begun.
We've held entrance conferences.
So they're just starting those audits
in progress right now.
And then we currently have two extern audits being performed
right now.
We have the State Controller's Office is here doing
a routine audit on the payroll process
and their audit period is covering July, 2018
to June 30th, 2021,
and they'll test their standard nine areas.
So that one's in progress right now.
And then the other audit going on right now
is the California State Auditors is here performing an audit
on electrical system safety oversight,
and their audit period is covering the last five years.
And again, they are both in progress.
Do you have any questions?
-: Thank you, Angie.
I'm going turn to President Batjer first.
-: Thank you very much Commissioner Shiroma and Angie,
thank you so much.
The progress you and your team has made is impressive.
I know you and I used to meet more regularly than,
and I haven't been able to see some of these stats slightly,
but I'm very, very impressed.
And I also want to thank Rachel Peterson for her insight
and her leadership in making sure that you had the resources
you needed and the support you needed
to get your goals and objectives to the place
that you wanted.
And I know you have always set very high,
high standards for yourself.
So I really, really appreciate it.
And thank you too,
for the update on the internal audits, that was helpful too.
So very good job, hats off to you and your team.
I know you came into a steep climb and it seems like you
have a mounted the summit.
So thank you very much.
-: Thank you. I appreciate that.
-: Thank you, President Batjer.
Commissioner Guzman, did I see you raise your hands?
-: Yeah, Commissioner Shiroma.
Thank you.
And it's really nice to see virtually Angie.
It's been some time.
I also wanted to just thank you.
So just reflecting on how on-point these risks
identification of risks are,
and to see some of these action plans,
and it gives me so much, peace of mind, I guess,
to see that we're working on these everything
from I didn't know there was a new communication section
on the telecommunication carriers.
That's like this, an example of things that have been
maybe a little chronic that are getting the attention
they really deserve.
So really congratulations on the process that you use
to determine these, obviously from my perspective,
seems to have yielded the right priorities.
Also, I just was wondering
who makes up the information
technology governance committee.
-: It's executive or Rachel, did you want to answer?
-: Okay. I can have the sure.
Yes.
It's a model that's used,
I think private and public sector Commissioner.
And it does require executive level sponsorship.
So I'm involved on the sponsor probably,
our IT department.
And then all of the substantive divisions are involved
as well at the senior level
because they are the ones that are developing.
They have IT needs and project ideas.
So the model is one in which at that senior level,
you have a process by which to propose projects that come
through a consensus driven decision-making matrix
and then select which ones will benefit the organization
and our mission,
and therefore rise to the top of the priority list for IT.
-: How often do you guys meet, Rachel?
How frequently does the Governance Committee meet?
-: President Batjer, we're aiming towards more regular
systematic meetings.
I would like for it to be either bi-monthly or quarterly,
we're still getting our feet on the ground.
As Ryan Dulin, our Deputy Executive Director
for internal operations started mid-year this year.
And so getting him incorporated and integrated
into it has taken a little bit of time
alongside all of the other work we're doing.
My aim would be probably by monthly to get ourselves up
and running and then move to quarterly.
There's a lot of work that happens in between
those meetings too.
-: And maybe Rachel,
you can reflect a little bit for the benefit of the other
Commissioners that we did.
And Angie too,
that we did have an outside consultant that came in
and helped design the best practices if you will.
And we did early on, when I first came on the Commission,
we consulted with CDT.
It identified this as a vulnerability when they came in.
And you might remember that I had them do that quick review
at the very beginning of the fall of '19.
And they said, you need a greater governance structure
and that wards off hopefully any kind of sale management
or excuse me, IT programs.
So that it's been a work from the last frankly two years.
So just FYI.
-: Yes, you provided the capital history very well,
President Batjer.
In itself, you could call it an audit recommendation
and then a management practice that we're instituting
to meet that audit recommendation.
So it is definitely a work in progress and something
I'm very committed to,
even though we're definitely in the crawl phase
of crawl walk run.
-: Commissioner Guzman Aceves, can you say anything else?
Okay. All right.
Yes, Commissioner Houck.
-: I just wanted to thank Angie and her team and Rachel
for all their work and the briefings would be audit
and Finance Committee and for Commissioner Shiroma
for her leadership and helping me get up to speed
as a newer member to the committee.
And just again,
lots of progress and appreciate all of the hard work.
So thank you.
Thank you.
-: Commissioner Rechtschaffen.
-: Angie, could you talk a little bit more about
the data retention policies?
I know that we were 2 to 3 years ago,
we were simply out of compliance with state rules about
that, it sounds like we're there, but not completely there.
-: Yes.
So actually we are in compliance now
with the state requirements.
We have the overarching data retention policy.
We actually have created a whole, not me,
but ASB division has created a whole SharePoint side about
record management and on there shows the policies
and any other relevant documents that people might need
for contracts and other items.
So we've made a lot of progress in that area.
So this risk is actually starting to touch on our storage
for the data in our systems.
And then also just ensuring that we're compliant.
Often you create a plan and a goal,
but sometimes we forget to go back and delete those old
emails, delete those old documents that we have saved.
So we also need to go back and ensure that we're
implementing the retention policy and following it to allow
for more storage and for PR requests and other legal
concerns that may come up with keeping documents for years
and years and years.
-: Well, that was a follow up question I was gonna have,
have we done training
and are we monitoring whether or not the divisions
are complying with the new rules?
-: That's something that the risk and compliance branches
and to talk about with Rachel
'cause I kind of went out and did some research to see...
We have a retention policy, but is everyone aware of it?
And so maybe doing a one more training,
letting people know that the retention policy is available,
it's out there.
And then also updating some divisions has a more detailed
retention policy, but they may need to be updated.
So making sure that those are current.
So I think the risk of clients branch can certainly circle
back and make sure that we're implementing those
recommendations that they have for the retention policy.
-: Thank you.
So Angie and Rachel, first of all,
thank you for the presentation, excellent.
Really is important that you're keeping a keen eye on
resolving all of the pending audit recommendations
and pending in so far as resolving them.
And he's heard recommendations placed in final reports,
assessing the CPUC and the metrics are very,
very, it's very important to see the progress being made.
Rachel, thank you.
Now on risk five as a Commissioner Guzman Aceves
pointed out,
it's really great to see that there'll be a new
communication section for the utility audit branch
to conduct and complete audits
of telecommunication carriers.
And I recall it's probably been a year or more Angie,
where you had indicated at a resource need
to have the resources to conduct these audits.
Do you have an update on that in terms of
what has been done since then to assure that you can,
that your branch can carry out,
its very important requirements?
-: Yeah, so kind of my other hats that I wear is I'm also,
I'm in charge of external auditing and I believe that's what
you're speaking on.
So for external auditing, yes.
I mean, resources are always a concern, but we did receive.
And the last round we received three audit positions
for communications specifically
and we have filled those positions and they have,
when we've performed a risk assessment,
we've determined our audit objective and they are already
currently out performing spilled work on two companies
right now.
I'm very excited about the progress that's been made with
that 'cause we've never had a communication section before
for auditing.
-: Congratulations on that progress.
That's very nice to hear.
Any other questions or comments from the Commissioners?
All right.
I'm going to return back to Rachel for any concluding
remarks and then back to President Batjer.
Should there be folks signed up for public comments?
Rachel.
-: Thank you, Commissioner.
Thank you all again for the opportunity to have Angie
and myself present today, as you seen,
I find this work to be very important.
It's very satisfying to see the numbers of open
recommendations tick downwards.
So that's partly why I pursue it,
but not really just because of that,
but because it really is important.
We have such a broad mission and we incur risk
in so many different ways that,
audits are actually beneficial in helping point out where
risk occurs and how we can requires us to become innovative
and figure out how to address it.
So I'm actually quite,
I find it a very useful management tool.
So I'm very happy to present to you today.
Thank you very much.
-: Alright, thank you.
President Batjer, the microphone back to you.
See if any books for helicopters.
-: Again, want to thank Angie so much for the progress.
She's made always a concern that internal controls
and proper controls within the organization.
And I think again, we're making a lot of progress.
So with that,
I will turn to the operator and asked her to open up
the phone lines for any public comment.
-: Thank you.
If you would like to have a public comment,
please press star one,
un-mute youth and record your name clearly.
Your name is required to introduce your comment.
One moment please. Thank you.
Once again it is star one.
If you would like to have a public comment
I currently have no public comments at this time.
-: Okay.
Thank you very much.
Again, thank you to everyone who's participated
and listened in to the meeting today.
Very important to topics and I wanna thank Rachel
and Commissioner Shiroma,
Commissioner Houck, Commissioner Guzman Aceves
for bringing these very important topics to us today.
And I would recommend as I'm walking out the door
that we probably have this type of a briefing
on these very topics a little bit more frequently,
and I really do appreciate them very much
and nothing is more important to the operations
of an organization at making sure that our risk assessment
or our risk is well identified and being addressed,
whether that's in the cyber security area or internal
controls or just the auditing.
And as Rachel said,
we can only monitor our progress as an organization
when we have audits to measure ourselves by.
So with that, thank you all very much again.
And the meeting is now adjourned.