NERC 2026 regional compliance audits: A case for third-party mock audits

In highly regulated industries, particularly in the energy sector, the stakes for compliance are high. Regulatory audits, such as those conducted for the North American Electric Reliability Corporation (NERC) Operations & Planning (O&P) and Critical Infrastructure Protection (CIP) Standards, are rigorous, complex, and can have significant consequences for organizations that fall short. In this environment, mock audits have become an essential tool for organizations seeking to meet compliance, minimize risk, and foster a culture of readiness and accountability.

Mock audits are especially valuable for large entities-such as Reliability Coordinators, Balancing Authorities, and Transmission Operators that are subject to audits every three years. While not mandatory, mock audits are conducted by many NERC registered organizations to bring an independent perspective and improve readiness.

Understanding mock audits

A mock audit is a simulated review that closely replicates the form and substance of a formal regulatory audit. Its primary purpose is to assess whether an organization meets required Standards and to identify and remediate deficiencies before a real audit occurs. This proactive approach enables organizations to address issues in advance, reducing the likelihood of potential violations and the associated penalties, as well as reputational damage, or operational disruptions.

A typical mock audit involves both off-site and on-site activities, although, the entire mock audit can be conducted off site, if requested. Off-site reviews focus on the completeness and organization of compliance documentation, as well as narratives and responses provided in the Reliability Standard Audit Worksheets (RSAWs). Data requests are issued, if necessary, for both clarification and sampling.  The on-site portion of the mock audit includes meetings with compliance personnel and subject matter expert (SME) interviews to clarify evidence and address identified gaps. It may also include facility tours and operator interviews to validate operational practices and simulate actual audit conditions and provide real-time feedback and coaching.

The value of third-party expertise

Some organizations choose to hire a third-party audit team to conduct a gap analysis of its compliance policies, procedures, and simply identify areas of concern. Others choose to do a mock audit that simulates the experience of a regional audit.

A third-party mock audit provides an unbiased, enforcement-focused perspective on compliance posture. This outside perspective can be invaluable, as internal teams may develop blind spots or unintentionally overlook gaps in their compliance programs due to familiarity with their own systems and processes.

“When auditors are aware that you have taken the initiative to conduct a thorough mock audit, it often creates a positive impression,” said Dave Viar, vice president, enterprise risk management at Southern Maryland Electric Cooperative, Inc. (SMECO) “By identifying gaps early and implementing corrective actions, we are better prepared and have confidence that we will do well in the actual audits.” SMECO has an excellent compliance record and has been conducting gap analysis and mock audits as standard procedure for the last 14 years.

Five ways mock audits strengthen compliance

1. Navigating regulatory uncertainty

Standards and audit approaches are constantly evolving to improve grid security and reliability. Changes to NERC Standards or regional regulatory requirements can introduce uncertainty and anxiety among compliance teams. Mock audits provide a structured way to understand these changes in advance, saving time and resources while greatly reducing the risk of potential violations. By simulating the audit experience, organizations can identify areas of concern, validate compliance, and address gaps before they become potential violations in a real audit.

2. Building confidence and readiness

These audits instill confidence across the organization and enable SMEs to become better equipped to perform under the pressure of a real audit. Simulated interviews and evidence requests help SMEs practice articulating their understanding of compliance requirements and responding effectively to auditor questions. This preparation often leads to improved performance and fewer data requests during the actual audit, streamlining the process and reducing stress for everyone involved.

3. Early identification and remediation of gaps

Mock audits are designed to uncover compliance gaps, misinterpretations of Standards, incomplete documentation, and operational weaknesses. By identifying these issues early, organizations can remediate them before the official audit. This may involve updating policies and procedures, retraining staff, improving documentation, or even self-reporting with a mitigation plan if necessary. The result is a stronger compliance program and a reduced risk of potential violations.

4. Enhancing documentation and evidence quality

A recurring challenge in regulatory audits is the quality and completeness of documentation and evidence. Mock audits involve a thorough review of compliance documentation, policies, procedures, and supporting evidence for each relevant standard. Auditors assess whether documentation aligns with the regulatory requirements.  This process conveys confidence that, when the real audit arrives, the organization can present clear, organized, and sufficient evidence to demonstrate compliance.

5. Supporting continuous improvement

Mock audits are not a one-time exercise; they are part of a continuous improvement cycle. Detailed reports generated at the conclusion of a mock audit highlight key findings, areas for improvement, and actionable recommendations. These reports can serve as a roadmap for closing gaps and optimizing compliance programs to maintain high standards of reliability and security.

Best practices in conducting mock audits

A successful mock audit follows a structured process that mirrors the regional audit methodology:

• Planning and preparation: Define the scope, schedule, and documentation requirements. Early engagement ensures all stakeholders understand their roles and the audit’s objectives.
• Document review: Collect and review relevant documentation, such as policies, procedures, internal controls, and evidence of compliance. Assess alignment with regulatory Standards.
• Site inspection: Conduct physical or remote inspections of facilities and operations to verify compliance.
• Interviews and testing: Interview SMEs responsible for specific Standards or requirements. Simulate auditor questioning to test knowledge and readiness.
• Findings and reporting: Document findings, rate compliance efforts, and provide recommendations for corrective actions.
• Remediation and follow-up: Support organizations in addressing identified gaps, updating documentation, retraining staff, and improving processes as needed.

For NERC O&P and CIP Standards, mock audits may use tools such as the RSAWs and the NERC Evidence Request Tool (ERT) to structure evidence collection and review.

A final option is to have third party SME support during the audit to assist in responding to requests from the auditors. These are usually former auditors who are up to date on the latest rules and can also participate in settlement negotiations if required.

What success looks like

The City of Tallahassee has performed third-party annual mock audits of its NERC cyber security compliance for almost nine years. Each time, they identify areas for improvement in documentation, receive valuable coaching for SMEs on interview techniques, and are advised on current best practices to implement greater security. “The technical support we receive through mock audits has led to the exemplary compliance record we maintain with federal regulators,” said Karen Weaver, the assistant general manager of electric system compliance at the City of Tallahassee.

The best-case scenario following a mock audit is one where the organization is fully prepared for the real audit. All data requests are answered promptly and accurately, SMEs demonstrate a clear understanding of their systems and compliance responsibilities, and the audit concludes with no potential violations or findings-perhaps even earning recognition for best practices.

For this reason, mock audits are a worthy investment – the question is not whether you can afford to conduct mock audits, but whether you can afford not to.

Dale Zahn, senior solutions specialist, Radian Generation

Dale Zahn has been in the energy compliance industry for over 45 years. He is a former NERC auditor, NERC certified System Operator and shift superintendent of two 640 MW generators and has been an active member on numerous NERC and Regional committees.

Popular content

Treasury issues guidance for solar, wind ‘start of construction’ tax credit rules

18 August 2025 The rules for safe harboring clean energy tax credits are “not as bad as rumored” but uncertainty remains on qualification requirements.