focused management and operations audit of ...significant. specific items of management...

FOCUSED MANAGEMENT

AND

OPERATIONS AUDIT

OF

SUEZ WATER PENNSYLVANIA

INC.

Prepared By ThePennsylvania Public Utility Commission

Bureau of AuditsIssued August 2020

Docket No. D-2019-3013234

SUEZ WATER PENNSYLVANIA, INC.

- i -

MANAGEMENT EFFICIENCY INVESTIGATION

TABLE OF CONTENTS

Chapter Page I. INTRODUCTION 1 A. Background 1 B. Objective and Scope 1 C. Approach 2 D. Current Events 2

II. SUMMARY OF MANAGEMENT EFFECTIVENESS 3 AND OPERATING EFFICIENCY

III. FINANCIAL MANAGEMENT 10

IV. AFFILIATED TRANSACTIONS AND COST ALLOCATIONS 15

V. WATER OPERATIONS 19

VI. EMERGENCY PREPAREDNESS 29

VII. MATERIALS MANAGEMENT 45

VIII. CUSTOMER SERVICE 53

IX. ACKNOWLEDGEMENTS 57


- ii -

MANAGEMENT EFFICIENCY INVESTIGATION

LIST OF EXHIBITS

Exhibit Page

II-1 Summary of March 2017 Management Audit Recommendations and Staff’s Follow-up Findings, Conclusions, and Recommendations

4

V-1 Hits on Mains and Services, Highlighting Discrepancies in 2015 20

V-2 NRW and UFW for 2015 – 2018 23

V-3 Miles of Main Replaced by District for 2015 – 2019 25

V-4 Additional Restoration Costs for Main Replacement Projects Bid in

2019 28

VI-1 Public Utility Security Planning and Readiness Self Certification Form 29

VII-1 Inventory Turnover for 2016 – 2019 49

VIII-1 Call Center Performance for 2016 – 2019 54

VIII-2 Annual Average Monthly Call Volume for 2016 – 2019 54

- 1 -

I. INTRODUCTION A. Background In 2016, the Pennsylvania Public Utility Commission (PUC or Commission) Bureau of Audits conducted a Management and Operations Audit (management audit) of SUEZ Water Pennsylvania, Inc. In March 2017, the Bureau of Audits issued its final report with 28 recommendations for improvement. SUEZ Water Pennsylvania, Inc. (SWPA or company) submitted its implementation plan on February 23, 2017, indicating that 26 were accepted and two were partially accepted. On March 16, 2017, at D-2016-2528481, the Commission made the audit report and Implementation Plan public and directed the company to: • Proceed with its February 2017 Implementation Plan; and, • Submit progress reports on the implementation annually, by March 1, for each of the

next three years.

Since March 2017, SWPA has submitted two implementation plan updates as requested by the Commission to ascertain SWPA’s progress in implementing the recommendations from the audit report. Based on a review of these updates, the Management Audit staff of the Commission’s Bureau of Audits (audit staff or auditors) conducted a Management Efficiency Investigation (MEI) of SWPA’s progress in implementing 26 of the 28 original recommendations that were deemed the most significant. Specific items of management effectiveness and operational efficiency may be investigated pursuant to Title 66 Pa. C.S. § 516(b). B. Objective and Scope The objective of this MEI was to review and evaluate the effectiveness of SWPA’s efforts to implement the recommendations contained within the management audit report released in March 2017. The scope of this evaluation was limited to SWPA’s efforts in implementing 26 prior management audit report recommendations in the functional areas of:

• Financial Management • Affiliated Transactions and Cost Allocations • Water Operations • Emergency Preparedness • Materials Management • Customer Service

In addition, the PUC’s auditors deemed it prudent to review SWPA’s compliance

with PUC regulations at 52 Pa. Code Chapter 101 regarding physical security, cybersecurity, emergency response, and business continuity plans.

- 2 -

C. Approach The PUC’s audit staff began fieldwork on November 13, 2019 and continued through June 2020. The fact gathering process included:

• Interviews with SWPA and affiliated companies’ personnel

• Analysis of selected SWPA records, documents, reports, and other information focused on the period 2016 through April 2020

• Visits to selected company facilities

D. Current Events

On March 6, 2020, the Governor of Pennsylvania, Tom Wolf, declared a disaster emergency due to the COVID-19 pandemic. This and other state government actions ordered all but essential businesses and their operations closed for the safety of the general public. Although fixed utility operations such as water treatment were considered essential, most of the back-office functions such as corporate management, accounting and government relations were deemed nonessential. Most Pennsylvania utilities closed their business offices and allowed their employees to work remotely. The Pennsylvania Public Utility Commission also closed the main office and allowed employees, including those of the Audit Bureau, to perform their functions remotely. All nonessential travel and in-person meetings were prohibited.

As such, the COVID-19 crisis affected the approach and timeline of the audit,

particularly towards the end of fieldwork. Some interviews and data request responses were delayed or modified due to the effects of COVID-19. In all cases, the audit staff worked with Suez to acquire information needed to issue the findings and recommendations contained within this report. Although some aspects of the audit program were modified and alternative procedures employed, the impact to the conclusions presented within the report are considered minimal. We believe that our procedures sufficiently mitigate the audit risk associated with altering our standard practices. However, conclusions presented within this report may change if additional information is made available. Furthermore, it is important to note that although COVID-19 affected the company’s operations; this report does not, nor was it intended to reflect any modified operations.

- 3 -

II. SUMMARY OF MANAGEMENT EFFECTIVENESS AND OPERATING EFFICIENCY

The PUC auditors found that SWPA effectively or substantially implemented 13 of the 26 prior management audit recommendations reviewed and has taken some action on 8 additional recommendations. Among the more notable improvements are: • SWPA established and achieved an inventory turnover rate goal of 2.0 in 2019. • The company increased its main replacement activity. • SWPA’s call center performance improved. • SWPA’s dividend policy and procedures were updated to include a requirement to

notify the Commission prior to issuing dividends in excess of 85% of net income. • SWPA successfully worked with its service company to access a more detailed

monthly billing invoice for intercompany charges. • The company tracks additional restoration costs incurred by project. • SWPA updated its emergency response plan with current contact information from the

PUC and disseminated the ERP to each facility. • The company has reduced NRW through the use of technology.

Although these accomplishments are commendable, the PUC auditors have identified further opportunities for improvement. Specifically, SWPA should: • Discontinue using UARL as an exclusion when reporting UFW levels to the PUC. • Continue to reduce NRW and UFW levels. • Update its financial policies and procedures to reflect new company practices. • Conduct an external market study on SWPA’s intercompany services. • Eliminate the manual capital expenditure reporting process through implementation of

a project portfolio management tool. • Reduce or eliminate the manual aspects of the inventory management process. • Implement and document a formal process to conduct periodic inventory cycle counts. • Conduct periodic customer satisfaction surveys targeted to Pennsylvania customers. • Develop and implement uniform physical security standards based upon facility

criticality. • Update physical and cybersecurity plans to address threats or vulnerabilities identified

by risk assessments once completed. • Participate in interagency tabletop drills and exercises at least once per year. • Increase or optimize resources to to address physical security at SWPA such as

delineating roles and responsibilities for physical security, improving the physical security budget, and creating a five-year security improvement plan.

Exhibit II-1 summarizes the 26 prior recommendations and the auditors’ follow-up

findings, conclusions, and recommendations. Exhibit II-1 also includes six additional findings, conclusions, and recommendations that were identified by the PUC audit staff during fieldwork.

Exhibit II-1 Page 1 of 6

SUEZ WATER PENNSYLVANIA, INC. MANAGEMENT EFFICIENCY INVESTIGATION

SUMMARY OF MARCH 2017 MANAGEMENT AUDIT RECOMMENDATIONS AND STAFF’S FOLLOW-UP FINDINGS, CONCLUSIONS, AND

RECOMMENDATIONS

- 4 -

Prior MA Recommendations

MEI Follow-up Findings and Conclusions

MEI Follow-up Recommendations

III. FINANCIAL MANAGEMENT (PAGE 10) Conduct periodic internal audits of affiliate transactions including cost allocations for shared services.

III-1 – SUEZ SA did not perform an internal audit of its affiliated transactions for shared services for SWPA.

Regularly schedule and conduct internal audits of affiliate transactions including cost allocations of shared services.

Update and correct information contained in Accounting and Capital Expenditure Control policies.

III-2 – SWPA’s financial and accounting policies and procedures are out of date.

Update financial and accounting policies and procedures to reflect actual processes.

Update the dividend policy to submit a detailed, written explanation for each dividend payment in excess of 85% of net income and provide advanced notice to the Commission prior to making any future dividend payments in excess of 85% of net income.

III-3 – The dividend policy and procedures were updated to include the required Commission notification.

None

Expand features in the new financial asset management system to include monthly forecast variance cost reporting on capital expenditures.

III-4 – The project portfolio management tool was approved.

Complete implementation of the project portfolio management tool.

IV. AFFILIATED TRANSACTIONS AND COST ALLOCATIONS (PAGE 15) File or amend existing affiliated interest agreements with the Commission for the cash pool agreement, consolidated debt arrangement, and for every affiliate receiving/providing goods and/or services to SUEZ Water Pennsylvania.

IV-1 – SWPA has updated many of its affiliated interest agreements, but its agreement with Water Management and Services remains out of date.

Amend or file a new affiliated interest agreement for SWPA services provided to Water Management and Services.




RECOMMENDATIONS

- 5 -




IV. AFFILIATED TRANSACTIONS AND COST ALLOCATIONS (continued) Periodically conduct internal or external studies to compare SWPA’s intercompany charges for services it provides to or receives from its affiliates.

IV-2 – A contract for an external market study on the cost of intercompany charges for services provided to SWPA is under negotiation.

Complete the external market study on SWPA intercompany charges.

Work with Suez M&S to improve the level of detail provided in intercompany invoices and reports.

IV-3 – SM&S introduced a more detailed intercompany invoice for SWPA.

None

V. WATER OPERATIONS (PAGE 19) Develop a comprehensive damage prevention program.

V-1 – Improvements to its damage prevention efforts were made but the company did not develop a comprehensive damage prevention program manual.

Improve and refine the damage prevention program, develop a damage prevention manual, and reduce line hits.

Strive to meet NRW goals and reduce UFW levels below the Commission’s guidelines of 20%.

V-2 – SWPA is improving both its NRW and UFW levels, but it is not meeting its NRW goals. SWPA continues to misapply an exclusion while reporting UFW to the Commission.

Continue reducing NRW and UFW levels, and discontinue deducting UARL from UFW when reporting to the Commission.

Accelerate main replacement efforts to achieve main replacement rates of approximately 100 to 120 years.

V-3 – SWPA has increased its main replacement activity.

None

Implement measures to routinely capture various main replacement cost components.

V-4 – SWPA manually tracks additional restoration costs incurred by project.

None




RECOMMENDATIONS

- 6 -




VI. EMERGENCY PREPAREDNESS (page 29) Correct minor physical security deficiencies and perform on-going physical security reviews of all facilities.

VI-1 –Physical security deficiencies exist at its facilities, including many that were previously identified, and security inspections are not optimal.

Standardize and optimize monthly security inspections of all facilities and promptly address identified deficiencies.

Establish uniform physical security standards for each type of facility at SWPA.

VI-2 – There are now uniform physical security standards at SWPA, but the standards do not define requirements for different types of facilities.

Develop and implement uniform physical security standards based upon facility criticality.

Design and implement a policy of layered physical security for SCADA equipment, controllers, and servers.

VI-3 – There is no detailed physical security policy for SCADA or cyber equipment, controllers, and servers, and no policy on layered security for critical facilities.

Design and implement a specific, detailed physical security policy for SCADA systems, control centers, and critical equipment.

Strive to perform a vulnerability assessment every 10 years, and revise physical and cybersecurity plans to address any new threats or vulnerabilities identified.

VI-4 – SWPA finished the risk assessments required by the America’s Water Infrastructure Act of 2018 but has not yet updated its physical and cybersecurity plans to address new threats or vulnerabilities identified.

Upon the VA’s completion, update the physical and cybersecurity plans as necessary to address threats or vulnerabilities identified by the risk assessments.

Participate in more frequent interagency tabletop drills and exercises.

VI-5 – SWPA participates in drills with local first responders but has not participated in multi-agency tabletop exercise or drill in several years.

Participate in interagency tabletop drills and exercises at least once per year.


SUEZ WATER PENNSYLVANIA, INC MANAGEMENT EFFICIENCY INVESTIGATION


RECOMMENDATIONS

- 7 -




VI. EMERGENCY PREPAREDNESS (continued) Update the emergency response plan’s PUC contact information and disseminate it to every SWPA facility.

VI-6 – SWPA has updated its ERP with current contact information from the PUC, and has disseminated it to every SWPA facility.

None

Establish controls to ensure SUEZ Water Management and Services’ Legal Department provides regular cybersecurity legal and regulatory updates to SUEZ North America’s subsidiary companies, including SWPA.

VI-7 – Suez Water Management and Services’ Legal Department is providing regular updates to Suez North America, but not to its subsidiary companies, and no controls were established.

Establish controls to ensure SUEZ Water Management and Services’ Legal Department provides regular cybersecurity legal and regulatory updates to SUEZ North America’s subsidiary companies, including SWPA.

Update the SDS sheets annually at every SWPA facility

VI-8 – SWPA has switched to an online solution for SDS.

None

VI-9 – The company’s respective Emergency Preparedness Plans have minor deficiencies and outdated references.

Conduct thorough reviews of all emergency and security plans and policies, and revise as appropriate.

VI-10 – Suez Water Pennsylvania’s approach to physical security is not yet optimized to support effective oversight.

Increase and/or optimize resources to address physical security at SWPA such as delineating roles and responsibilities for physical security, improving the physical security budget, and creating a five-year security improvement plan.


SUEZ WATER PENNSYLVANIA, INC MANAGEMENT EFFICIENCY INVESTIGATION


RECOMMENDATIONS

- 8 -




VI. EMERGENCY PREPAREDNESS (continued) VI-11 – SWPA lacks

sprinkler systems at some regularly occupied buildings.

Install fire suppression sprinkler systems at all regularly occupied facilities, where feasible.

VI-12 – SWPA-provided cell phones allow users to install their own applications.

Restrict the ability to install applications on company-provided cell phones and mobile devices to IT personnel.

VI-13 – Network access controls have not been automated.

Automate inventory control systems to identify devices and software connected to or utilized on company networks.

VI-14 – Certain server and OS lifecycle management practices could be improved.

Improve patch management of air-gapped systems and require certification of destruction of equipment as part of the disposal process.

VII. MATERIALS MANAGEMENT (PAGE 45) Reduce or eliminate the manual aspects of the current inventory management process.

VII-1 – Manual aspects of the inventory management system are still prevalent.

Reduce or eliminate the manual aspects of the inventory management process.

Initiate measures to improve inventory accuracy.

VII-2 – SWPA initiated measures to improve inventory accuracy; however, a periodic cycle count process has not been formalized company-wide to ensure proper controls.

Implement and document a formal process to conduct periodic cycle counts of inventory.

Develop inventory turnover goals and strive to achieve an inventory turnover of at least 2.0.

VII-3 – SWPA established and achieved an inventory turnover goal of 2.0 in 2019.

None




RECOMMENDATIONS

- 9 -




VII. MATERIALS MANAGEMENT (continued) Establish a consistent and uniform definition for emergency stock and identify appropriate emergency stock levels for all warehouse locations.

VII-4 – SWPA developed a definition for emergency stock and designated emergency stock within its Harrisburg region.

Document the definition and location of emergency stock within SWPA.

Establish minimum and maximum levels for inventory items.

VII-5 – SWPA has begun developing minimum and maximum levels for inventory items at each of its warehouses.

None

VIII. CUSTOMER SERVICE (PAGE 53) Identify methods to improve call center performance and strive to meet established goals.

VIII-1 – SWPA’s call center performance has improved.

None

Utilize existing platforms to proactively engage customers, especially online.

VIII-2 – SWPA has not gauged its customer’s attitudes towards its online offerings recently.

Conduct targeted periodic customer satisfaction surveys of Pennsylvania customers that encompass customers’ preferences for communications.


- 10 -

III. FINANCIAL MANAGEMENT

Background – SWPA’s financial management function is provided by SWPA’s finance department and its service company, SUEZ Management & Services (SM&S). The service company provides centralized financial services, such as multi-year budgeting, financial planning and reporting, treasury, internal auditing, etc. for all SUEZ North America Inc. (SNA) subsidiaries, including SWPA. Conversely, SWPA’s finance department has oversight of requisition approvals, budgeting, and variance reporting on all income statement accounts, including the annual assessment and completion of SWPA’s operating budget. SWPA’s Engineering Manager is responsible for all capital expenditure accounts. In this chapter, four prior situations and recommendations are reviewed, and four follow-up findings and three follow-up recommendations are presented. The findings relate to performing internal audits of affiliate transactions, updating accounting and capital expenditure policies, updating the dividend policy, and expanding the tools available for asset management.

Finding No. III-1 Prior Situation – The most recent audit of SWPA’s affiliate transactions was completed on April 29, 2011. Although periodic SWPA related internal audits had been conducted, no additional audits of its affiliate transactions and cost allocation processes had been planned through 2016. The Internal Audit (IA) function’s risk-based assessment had not targeted any IAs on the new cost allocation process. However, PUC audit staff contended that early testing would provide assurance that the new processes were functioning as intended. Prior Recommendation – Conduct periodic internal audits of affiliate transactions including cost allocations for shared services. Follow-up Finding and Conclusion – SUEZ SA did not perform an internal audit of its affiliated transactions for shared services for SWPA. Current Review – In 2018, the IA function was consolidated on an international level by SNA’s parent company, SUEZ SA. SUEZ SA1 provides holistic reviews through its international IAs, including testing of its internal controls, inclusive of all subsidiaries. These global risk assessments include input from subsidiaries, including SNA. However, this process has not resulted in an IA of affiliated transactions or allocations of shared costs for SWPA or any of SNA’s subsidiaries.

SNA’s subsidiaries include regulated water and wastewater utilities (utility division)

across multiple jurisdictions within North America. Intercompany transactions occurring

1 As a French-based global corporation, SUEZ SA is publicly-traded on European stock exchanges in both France and Brussels. SUEZ SA is not publicly traded on US stock exchanges (i.e., NYSE, NASDAQ) and, therefore, SUEZ SA is not subject to SOX. However, SUEZ SA complies with the regular review and testing of its internal controls as required for companies publicly traded under Euronext’s Harm.onized Rules.


- 11 -

between regulated subsidiaries (e.g., SWPA) and its affiliates are subject to review and approval by state utility commissions (e.g., PA PUC). Within these separate jurisdictions, there can be differences in appropriate rules or structure. Furthermore, as SWPA must do in Pennsylvania, SNA subsidiaries may require Commission-approved affiliated interest agreements governing the interactions between subsidiaries. Intercompany transaction costs, including costs for shared services, are subject to review during base rate case proceedings, with regulator focus on the potential risk of cross-subsidization between affiliates and the cost prudency of shared services. Utilities also prefer to ensure cost allocations are accurate and fair between affiliates because recovery, compliance, and efficient operations are often predicated by just and reasonable interactions.

One way to help mitigate risks associated with affiliated transactions is to conduct

periodic operational IAs. In this case, SWPA should focus on quality assurance and to verify that its internal processes are functioning as intended. The PA PUC audit staff recognizes that division-specific operational audits could be limited by the company’s IA resources as a globally centralized function. However, other entities2 have used the engagement of small local consultants to augment the IA function with these types of periodic quality assurance and operational audits. Follow-up Recommendation – Regularly schedule and conduct internal audits of affiliate transactions including cost allocations of shared services.

2 As documented in the Financial Management chapter of the 2017 Management Efficiency Investigation of Philadelphia Gas Works (Docket No. D-2017-2627521) and the Corporate Governance chapter of the 2019 Management Audit of the C&T Companies (Docket Nos. D-2019-3007883, D-2019-3007884, and D-2019-3007885).


- 12 -

Finding No. III-2 Prior Situation – SWPA and its affiliates underwent numerous changes in 2015 including: a corporate-wide rebranding, reorganization of its corporate organizational structure, upgrade of its financial accounting software, introduction of a new financial asset management system, implementation of new cost allocation methodologies, and changes to its chart of accounts. However, SWPA did not update its policies to reflect the changes. Prior Recommendation – Update and correct information contained in Accounting and Capital Expenditure Control policies. Follow-up Finding and Conclusion – SWPA’s financial and accounting policies and procedures are out of date. Current Review – Policies provide written support for the processes and activities that support basic business needs and should be updated to reflect significant changes to organizational structure, software, etc. Numerous changes have affected SWPA’s financial and accounting policies and procedures resulting in outdated legacy policies. In 2019, SWPA’s parent company, SUEZ Water Resources (SWR) experienced a change of ownership. As a result, all financial policies and procedures required substantial updates to reflect the new organization and processes, which are the responsibility of the SM&S Utility Segment Controller. To accomplish this, SM&S developed a framework to review and update the company’s financial policies and procedures. In addition, a team of experienced accounting and finance staff was assigned to update SWR’s Accounting Policy Manual, with review of the proposed updates by all department stakeholders (i.e., rates, treasury, etc.). Once the policies and procedures are finalized, the company plans to also provide training to ensure compliance with the changes. SM&S projects a two to three-year timeframe requirement to complete its extensive update process. Follow-up Recommendation – Update financial and accounting policies and procedures to reflect actual processes.


- 13 -

Finding No. III-3 Prior Situation – SWPA issued dividends to its parent company based upon its cash position. Although the 2011 dividend policy accurately reflected its dividend process, the policy did not list SWPA’s correct parent company (SWR). Further, the dividend policy failed to include a requirement to notify and explain to the Pennsylvania PUC prior to issuing dividends in excess of 85% of net income to its parent company. Prior Recommendation – Update the dividend policy to submit a detailed, written explanation for each dividend payment in excess of 85% of net income and provide advanced notice to the Commission prior to making any future dividend payments in excess of 85% of net income. Follow-up Finding and Conclusion – The dividend policy and procedures were updated to include the required Commission notification. Current Review – Although dividends greater than 85% of net income may be justified, they raise greater concern for the financial stability of a regulated utility. In response, SWPA updated its dividend policy and procedures in February 2017 to accurately reflected its parent company and included Commission notification requirements. In fact, the company’s internal procedures cap dividend issuance at 75% of net income3 for SWPA. Furthermore, due to SWPA’s ongoing and continued capital investments in infrastructure improvements, SWPA did not issue any dividends to its parent company between 2016 through 2019. Nonetheless, SWPA has strengthened the internal controls for its dividend process. Follow-up Recommendation – None

3 Percentage rate of net income for dividends is subject to increases due to declining revenues resulting from decreased usage for a stable customer base.


- 14 -

Finding No. III-4 Prior Situation – SWPA was unable to automatically track variances in funded projects (budget information to actual cost) through the SM&S’ new financial asset management system. Thus, SWPA’s variance report, the Monthly Forecast Report, required manual assembly via an Excel spreadsheet by the Engineering Department. As of August 2016, SM&S was considering expanding its new financial asset management system to include a budget tracking module which would eliminate the manual processes. Prior Recommendation – Expand features in the new financial asset management system to include monthly forecast variance cost reporting on capital expenditures. Follow-up Finding and Conclusion – The project portfolio management tool was approved. Current Review – After the management audit, SM&S implemented the use of queries, which significantly reduced the time required for manual assembly of the Monthly Forecast Report. However, this new process does not eliminate the need for manual processes. Therefore, the potential risk of inaccuracies migrating data is still elevated and could be eliminated through automation. Automation could also improve productivity of employees and the efficiency of processes. Thus, SM&S has proceeded with the design phase of a project portfolio management (PPM) tool and was negotiating a contract for integration of the PPM tool into its software environment with a third-party vendor at 2019 year end. The PPM tool will provide SWPA and its affiliates with increased forecasting and planning functionality for the company’s capital investment projects. In addition, the PPM tool will eliminate the use of the Excel spreadsheet to manage the budgeting and forecasting for capital projects and provide the company with up-to-date actual spending information, variance reporting, and reforecasting information. Follow-up Recommendation – Complete implementation of the project portfolio management tool.


- 15 -

IV. AFFILIATED TRANSACTIONS AND COST ALLOCATIONS Background – SWPA conducts intercompany transactions with its regulated and nonregulated affiliates. SWPA has ongoing, regularly occurring intercompany transactions with several unregulated affiliates including its parent company, SUEZ Water Resources (SWR), SUEZ Water Inc. (SWI), and SUEZ Water Management and Services, Inc. (SM&S or service company). For example, SWPA’s parent company processes some payments (e.g., insurance) on behalf of SWPA which are subsequently reclassified through intercompany transactions. Whereas, SWPA’s intercompany transactions with SM&S reflect the costs of shared services (i.e., accounting and tax, treasury, human resources, legal, corporate communications, etc.) provided to SWPA. In this chapter, three prior situations and recommendations are reviewed, and three follow-up findings are presented. The findings relate to SWPA’s filing of affiliated interest agreements with the Commission, performing market rate cost comparisons for intercompany services, and working with SM&S to improve the level of detail provided on service company invoices.

Finding No. IV-1 Prior Situation – SWPA’s existing affiliated interest agreements (AIAs) did not accurately address the intercompany transactions occurring between it and its affiliates. In some cases, the AIAs lacked information on intercompany transactions, while others did not accurately identify the affiliate(s) and/or methods used to determine charges. The AIAs became outdated due to changes at the company such as affiliate structure reorganization, corporate wide rebranding, and introduction of a new methodology for the distribution of shared costs. Prior Recommendation – File or amend existing affiliated interest agreements with the Commission for the cash pool agreement, consolidated debt arrangement, and for every affiliate receiving/providing goods and/or services to SUEZ Water Pennsylvania. Follow-up Finding and Conclusion – SWPA has updated many of its affiliated interest agreements, but its agreement with Water Management and Services remains out of date. Current Review – In response to the recommendation made in the 2017 management audit, SWPA filed and received approval for three new AIAs. SWPA’s AIAs address its transactional interactions with its parent company (SWR), service company (SM&S), and the unregulated and regulated subsidiaries of SWR. The AIA with SWR details SWPA’s money pool transactions and functions. Similarly, SWPA’s shared service company agreement outlines the regular interactions with SM&S and the services received by SWPA. Finally, a combined sector agreement addresses the intercompany transactions occurring between SWPA and its “sister” companies (all subsidiaries of SWR) for operations and managerial-related support. Thus, SWPA has significantly improved the transparency of its affiliated transactions with the Commission.


- 16 -

The PUC auditors commend SWPA for its transparency and expediency working to update the AIAs as required by the Commission. However, due to the corporate-wide rebranding of all SUEZ North America affiliates, one AIA between SWPA and Water Management and Services was overlooked and not updated. The outdated AIA no longer reflects accurate company names covering the intercompany transactions between the two affiliates. Company management acknowledged this and plans to file an update in the future. Pa. C.S. § 2102 requires Pennsylvania public utilities to obtain Commission approval for arrangements or contracts with affiliated companies for goods and services and such contracts should accurately identify affiliates. Follow-up Recommendation – Amend or file a new affiliated interest agreement for SWPA services provided to Water Management and Services.


- 17 -

Finding No. IV-2 Prior Situation – SWPA had not conducted a market study comparing intercompany costs since 2004. To ensure that intercompany transactions are appropriate, regulated utilities must periodically evaluate the market rates of services it provides to, or receives from, its affiliates. Prior Recommendation – Periodically conduct internal or external studies to compare SWPA’s intercompany charges for services it provides to or receives from its affiliates. Follow-up Finding and Conclusion – A contract for an external market study on the cost of intercompany charges for services provided to SWPA is under negotiation. Current Review – SWPA evaluates the cost of its nonroutine intercompany transactions through its competitive bid process. This process is triggered for any project4 exceeding $20,000 in cost. Generally, bids are awarded to the lowest cost vendor. In cases where the selected vendor is also an affiliate of SWPA, the company files an AIA with the Commission for approval prior to beginning any activities not already identified within an effective AIA. For example, on April 9, 2019, the PUC approved SWPA’s AIA5 for tank painting services and should be commended. However, as noted in the prior situation, SWPA’s most recent evaluation of ongoing intercompany service costs was in 2004.

To ensure that intercompany charges are prudent6, the market cost for routine intercompany services must be evaluated periodically. Such evaluations confirm that ratepayers are insulated from cross-subsidization when a regulated utility receives services from its affiliates. SWPA relies on its approved AIAs to govern intercompany transactions, which specify that all services will be provided between affiliates at cost. However, without the periodic assessment of market rates for services, SWPA could be overpaying or undercharging for services it receives or provides to its affiliates.

Thus, SM&S plans to engage a third-party vendor to conduct an external market study on the services it provides to SWPA. In December 2019, SM&S was negotiating a contract with a vendor to conduct the market study. The market study will evaluate the shared services specific to SWPA and will provide further analysis on the rational for the cost allocation methodology implemented in 2016. Completion of the study would allow the company to identify whether the allocated cost of SM&S-provided services for SWPA aligns with market rates. Follow-up Recommendation – Complete the external market study on SWPA intercompany charges.

4 Projects performed internally by SWPA are not competitively bid regardless of size. However, projects performed by affiliates would follow the competitive bid process when exceeding $20,000. 5 Docket No. G-2019-3008158 6 The higher of cost or market for services provided to affiliates or the lower of cost or market for services provided from affiliates.


- 18 -

Finding No. IV-3 Prior Situation – In October 2015, SWPA’s accounting software was upgraded. As a result of the upgrade, a billing detail report for intercompany charges from its affiliate service company, SM&S, was no longer accessible. The billing detail report had previously identified SM&S employees providing services, the allocation factor used, and the total monthly amount billed. The replacement report used by SM&S did not contain enough detail to determine the respective labor rates and hours associated with the performance of intercompany services for SWPA. Prior Recommendation – Work with Suez M&S to improve the level of detail provided in intercompany invoices and reports. Follow-up Finding and Conclusion – SM&S introduced a more detailed intercompany invoice for SWPA. Current Review – In response to the 2017 management audit, SM&S has introduced a new monthly invoice which reflects the total and overall shared service charges to SWPA. The more detailed invoice allows SWPA to verify the proportion of services received from SM&S with the level of costs assigned to SWPA. Testing and delivery of the newly designed invoice was completed in the last quarter of 2019. Additionally, the invoices are accessible to SWPA on-demand and allow for direct access of additional details (cost center, department, etc.) through the financial management software system. Intercompany billing and reporting on affiliated transactions should provide adequate detail to verify the accuracy of charges. Thus, the newly introduced SM&S invoice has increased the transparency of the distribution of shared costs to its affiliates, including SWPA. Follow-up Recommendation – None


- 19 -

V. WATER OPERATIONS Background – SWPA serves approximately 59,000 customers across eight counties and 40 municipalities. The company’s distribution system is comprised of four primary regions: Harrisburg, Mechanicsburg, Bloomsburg and Dallas. SWPA’s Director of Operations oversees all day to day water operations activities which include engineering, transmission and distribution (T&D) production, non-revenue water (NRW) SCADA, and asset management.

In this chapter, four prior situations and recommendations are reviewed, and four follow-up findings and two follow-up recommendations are presented. The findings primarily relate to developing a damage prevention program, reducing UFW below 20%, accelerating main replacement, and tracking additional restoration costs for capital projects.

Finding No. V-1 Prior Situation - Prior to 2016, SWPA did not have a formal process to track the number or cost of company-at-fault third-party line hits (mismarked or not marked) otherwise referred to as non-billable hits. Starting in 2016, the company started tracking non-billable hits in the Harrisburg region, but not in the Mechanicsburg, Bloomsburg, or Dallas systems. SWPA did not bill for third-party damages in 2015 because both T&D Superintendents were new hires who were unaware of company policy on billing for third-party damages. The company was also not filing incident reports to the Department of Labor and Industry in accordance with the Underground Utility Line Protection Act (Act 287 of 1974 as amended).7 Prior Recommendation – Develop a comprehensive damage prevention program. Follow-up Finding and Conclusion – Improvements to damage prevention efforts were made but the company did not develop a comprehensive damage prevention program manual. Current Review – SWPA’s damage prevention program consists of an annual meeting with its contractors, at which health and safety topics are discussed including damage prevention. However, SWPA does not have a damage prevention manual. Instead, the company uses a standard operating procedure, the Damage Prevention Program for Marks Outs and Excavation (Damage Prevention SOP), which provides guidelines for pre and post-locate activities. It also provides internal procedures to comply with PA One Call, guidelines for incident report documentation, and tolerance zone identification and marking.

However, the Damage Prevention SOP does not cover all aspects of a damage prevention program. For instance, the Damage Prevention SOP identifies the excavation and locating process but details on the actual methods used, such as thumping, hydro

7 PA Act 287, as amended by PA Act 50 of 2017, moved the responsibility for enforcement of the Underground Utility Line Protection Act from the PA Department of Labor & Industry to the Pennsylvania Public Utility Commission (PUC).


- 20 -

excavating, GIS mapping, use of GPS, and hand digging, are not detailed. These procedures are embedded in other documents but should be referenced within the Damage Prevention SOP. In addition, the Damage Prevention SOP mentions that the Environmental Health and Safety (EHS) Manager is responsible for investigating incidents but does not provide any of the steps the EHS Manager would take. As mentioned in the prior situation, the lack of documentation and formalized procedures meant that the company did not have a method to track third-party damages to their facilities. Although the company believes its current processes have improved, the auditors identified data discrepancies provided in the previous management audit and current review. This discrepancy is highlighted below in Exhibit V-1. In addition, the company’s damages are presented.

Exhibit V-1 SUEZ Water Pennsylvania Inc.

Hits on Mains and Services, Highlighting Discrepancies in 2015 For 2012 – 2019

Source: Exhibit VII-8 from the 2017 Focused Management and Operations Report and Data Request WO-10.

As seen above, there is a clear difference in the data gathered during the management audit (i.e., 2012-2015) from the data provided during fieldwork (i.e., 2015-2019). In addition, by reviewing the data from 2015, it appears that several originally billable hits are now recorded as non-billable hits. The audit staff was not able to verify the cause for these discrepancies nor could the company provide a reason. However, the SWPA Director of Operations opined that the newer data was likely to be more accurate, also claiming that the company has not had any billable hits since 2015 and all hits were due to company fault (i.e., mismarking). He was unable to explain why he thought the newer data was more accurate.

Mismarks can occur at any company. However, this is usually minimized with a robust damage prevention program because mismarks are avoidable. Therefore, it is

$0$5,000$10,000$15,000$20,000$25,000$30,000$35,000

0

10

20

30

40

50

2012 2013 2014 2015 2016 2017 2018 2019

Hits on Mains (2017 Data) Hits on Mains (2020 Data)

Hits on Services (2017 Data) Hits on Services (2020 Data)

Number Billable (2017 Data) Number Billable (2020 Data)

Number Non-Billable (2017 Data) Number Non-Billable (2020 Data)

Amount Billed (2017 Data) Amount Billed (2020 Data)


- 21 -

unsurprising that SWPA focused on locating its facilities and PA One Call compliance. Specifically, the company has trained its locators in GPS use, requires GPS locating for all field infrastructure, increased focus on working with PA One Call, and on using safer methods of excavation, etc. The company attributes these new focal points as a large reason why non-billable hits have fallen substantially since 2015. Although the company has made drastic improvement, there are still opportunities to continue to improve its damage prevention program. For instance, linking the damage prevention SOP with other procedures, improving the documentation on incident investigations, and ensuring consistent and accurate data collection are needed. Therefore, SWPA should take the necessary steps to ensure its damage prevention documentation and program are comprehensive and sufficient to safeguard its facilities. Follow-Up Recommendation – Improve and refine the damage prevention program, develop a damage prevention manual, and reduce line hits.


- 22 -

Finding No. V-2 Prior Situation – SWPA tracked both non-revenue water (NRW) and unaccounted-for water (UFW) for each of its systems and had set short- and long-term goals for NRW. Although the company improved its NRW and UFW levels from 2007 through 2015, it fell short on some of its goals. SWPA had a long-term goal to reduce NRW by 1% per year over five years; however, it had only achieved a slight reduction from 34% to 32.5% over the 2012 to 2015 period.

Since at least the year 2000, Suez PA has been inaccurately reporting its UFW statistics to the Commission. During the 2017 audit period, the company continued to inaccurately report UFW in Schedule 500 of the PUC Annual Reports. Specifically, the company included an inappropriate exclusion allowance of Unavoidable Annual Real Losses (UARL), which is a theoretical reference value representing the inherent leakage of a given system. This is a reference goal, not an excludable amount, and the company’s practice of excluding it was noted as misleading in the PUC’s 2006, 2010, 2013, and 2017 Audit Reports. Prior Recommendation – Strive to meet NRW goals and reduce UFW levels below the Commission’s guidelines of 20%. Follow-up Finding and Conclusion – SWPA is improving both its NRW and UFW levels, but it is not meeting its NRW goals. SWPA continues to misapply an exclusion while reporting UFW to the Commission. Current Review – SWPA’s UFW and NRW have been trending downward since 2015. As shown in Exhibit V-2, UFW decreased from 16.7% to 14.2%, while NRW went from 32.2% to 30.0% from 2015 to 2019. However, the company continues to deduct UARL (a supplementary calculation from the American Water Works Association’s NRW methodology) from its reported UFW to the Commission8, as a deduction labelled, “Unavoidable Leakage.” The Bureau has repeatedly identified this practice as inappropriate, most notably in the 2006 management efficiency investigation, the 2010 management audit, the 2013 management efficiency investigation, and the 2017 management audit of SWPA.

8 UFW is reported to the Commission on schedule 500 of the Annual Report.


- 23 -


NRW and UFW For 2015 – 2019

Source: Data request WO-4 and 2019 Annual Report

* 2019 NRW percentage is a rolling 12-month average as of 10/2019, as that was the latest data available on NRW.

As shown above, Exhibit V-2 illustrates the disparity on the reported UFW (the

dashed blue line), compared to the corrected UFW (the solid blue line), calculated by adding the reported UARL back in to the reported UFW values. By subtracting UARL from UFW, the company artificially lowered its UFW by an average of 8.9%. This results in reported UFW levels below the Commission’s recommended guideline of 20% each year, whereas corrected UFW values reflect levels above 20%. When questioned about this continued practice despite earlier audit findings and recommendations, the Director of Operations was unable to provide an adequate justification for the practice. Instead, he insisted that the exclusion is an allowed adjustment and that changing it would significantly increase the company’s reported Unaccounted-for-Water. Although the change would increase UFW; the Bureau rejects the argument due to its sole basis being favorable reporting for the company. It is in the interest of both ratepayers and the industry that companies report UFW using the same definitions and benchmark themselves using meaningful and comparable metrics.

Despite its use of UARL, SWPA has made notable progress in reducing both its NRW and UFW. It reduced its NRW from 32.5% to 29.9%, and its UFW from 26% to 21.9% from 2015 to 2018. SWPA accomplished this reduction by accelerating its pipeline replacement program, focusing on unreliable pipes, and developing better early detection capabilities. The company started exercising its valves and added loggers and sound detecting devices to its system to help identify water loss. The company also began using satellite surveillance to detect possible leaks, which has shown promising results.

0.0%

5.0%

10.0%

15.0%

20.0%

25.0%

30.0%

35.0%

2015 2016 2017 2018 2019

Reported UFW %

Corrected UFW Percentage

NRW %

Commission UFW Recommendation


- 24 -

The company also continues to set its NRW goals aggressively. Since 2015, SWPA’s goal has been to reduce NRW by 1% per year, reaching 27.3% by 2020. The company will likely fall somewhat short of this goal, as it has reduced its NRW by 0.87% per year since 2015. However, as mentioned earlier, the company’s progress is commendable. The company indicated that its goal for the next five years is to reduce NRW by 300 million gallons per year by 2024, or the equivalent of lowering NRW by 4.8%.

Despite the company’s progress in reducing NRW and UFW, aggressive goal setting, and deployment of new technology, it still has a UFW over 20%. Pursuant to 52 Pa. Code § 65.20 (4), the Commission considers UFW greater than 20% excessive. If SWPA were to reduce its NRW by 4.8% over the next 5 years, it would save production costs of roughly 900 million gallons over the five-year period, and 300 million gallons every year thereafter. At the current production of 6.3 billion gallons per year, a reduction in UFW to the Commission’s recommended 20% would mean the company would save the variable production costs of about 119 million gallons per year or roughly $38,7009 annually. Follow-Up Recommendation – Continue reducing NRW and UFW levels, and discontinue deducting UARL from UFW when reporting to the Commission.

9 Assumes a variable production cost of $325 per million gallons of water.


- 25 -

Finding No. V-3 Prior Situation - From 2012 to 2015, SWPA replaced an average of 4.5 miles of main annually, which translated to a replacement rate of 195 years. Moreover, the company planned to replace approximately five miles of main per year from 2016 through 2020, a replacement rate of 175 years. Additionally, the company had a short-term goal of replacing approximately 0.5% to 0.75% of its total distribution system per year (rates of 200 and 150 years, respectively), with a long-term goal of replacing 1% per year, depending on available budget and cost of installation. The company was funding its entire main replacement program through its Distribution System Improvement Charge (DSIC) due to other large capital investments. Prior Recommendation – Accelerate main replacement efforts to achieve main replacement rates of approximately 100 to 120 years. Follow-up Finding and Conclusion – SWPA increased its main replacement activity. Current Review – From 2012 through 2017, SWPA was replacing mains on a 180-year replacement schedule. In 2017, the company officially changed the long-term replacement cycle goal to 160 years and temporarily accelerated main replacement to 15 miles per year, a replacement cycle of 58.8 years. This temporary goal runs until 2022, after which the company intends to readjust the rate as needed to meet the company’s goals, infrastructure needs, and budget. Meanwhile, the industry recommended standard is a 100-year replacement rate over a long-term replacement schedule. The company’s replacement levels by division are shown in Exhibit V-3.

Exhibit V-3

SUEZ Water Pennsylvania Inc. Miles of Main Replaced by District

For 2015 – 2019

2015 2016 2017 2018 2019 Bloomsburg 0.5 0 0.5 0.8 9.4 Dallas 1.7 1.1 1.8 2.0 1.4 Harrisburg 3.1 2.5 9.2 6.5 6.7 Mechanicsburg 0.3 1.3 4.8 4.1 0.3 Total Miles Replaced

5.6 5.0 16.3 13.4 17.8

Replacement Rate in Years*

157 yrs. 176 yrs. 54 yrs. 66 yrs. 51 yrs.

* Used 2017 total miles of main to calculate replacement for all years, except for 2019. Total systems miles for 2019 were used to calculate the 2019 replacement rate due to the addition of a small water system.

Source: Data Request WO-8.


- 26 -

In the past, SWPA used a scoring system to determine which mains to replace. In

2018, the company began using a software package for main prioritization, which includes a hydraulic model of the system to predict criticality and to develop a more efficient flushing system. SWPA is still gathering the data to enable the model to function accurately. This long-term project will enable the company to compile information and make the hydraulic model more accurate. The company also plans to install an asset management system that will interface with the Geographic Information System (GIS) in the last quarter of 2020, which will aid in locating and replacement efficiency.

In the meantime, the company continues to identify its most risky pipe through field identification, engineering studies, etc. For instance, the company is currently replacing 10 miles of Schedule 40 PVC pipes within its Newberry system. The pipe was installed before SWPA purchased the system, but this type of pipe was never intended for outdoor usage and must be replaced. This project is about 70% complete, with the remaining work anticipated to be finished by 2021. The company also has over 200 miles of asbestos cement/transite main and is hiring a firm to analyze the condition of a portion of the asbestos cement pipe to determine the remaining life. This study will then be used to help prioritize its replacement. As part of its main replacement projects, the company is replacing an average of 920 services, 304 valves, 45 hydrants, and 2,668 meters per year since 2017. SWPA is presently unaware of any lead service lines in its territory but has not yet inspected 29,743 of its services to verify their material composition. Field employees indicate that they occasionally find lead goosenecks, but not lead service pipes. These services are also considered a high priority for replacement, as they are discovered.

As mentioned earlier, SWPA increased its main replacement efforts, especially for higher risk main and is currently exceeding industry standards of 1% per year. This is commendable and helps to drive the company’s main replacement efforts over the long-term towards industry standards. The audit staff recognizes that a variety of factors can influence replacement rates. This means that there will be periods of both increasing and decreasing replacement activity, however, the trend is positive. Overall, this increased activity has resulted in an improvement to the replacement cycle from 160 to 58.8 years. Increased main replacement also aids in reducing NRW and UFW as discussed in Follow-up Finding and Conclusion V-2. In addition, increased main replacement can improve reliability, water quality, and customer satisfaction. Follow-Up Recommendation – None


- 27 -

Finding No. V-4

Prior Situation – Various factors can influence main replacement costs such as location, soil type, other underground facilities, etc. SWPA’s service territory included 40 municipalities where main replacement project work must adhere to local municipal ordinances including repaving requirements. Although SWPA typically coordinated with townships for restoration work, sharing costs for paving and trench restoration, some municipalities required partial or complete road restoration (i.e., entire lane width including the shoulder, etc.). However, SWPA was not tracking additional restoration costs by municipality. Therefore, the estimates used by SWPA during the budget planning process did not account for additional municipality specific costs. Prior Recommendation – Implement measures to routinely capture various main replacement cost components. Follow-up Finding and Conclusion – SWPA manually tracks additional restoration costs incurred by project. Current Review – In 2017, SWPA’s engineering department implemented an internal tracking process for required restoration costs that were not essential to the main replacement work (i.e. milling and paving areas that are outside of the area disturbed by the main replacement, updating intersections to be compliant with the American Disability Act, etc.). These additional restoration efforts are required by some local municipalities through ordinances, permit requirements, etc. SWPA competitively bids the additional work as part of the total main replacement project. Then, SWPA negotiates with the municipalities to limit the amount of extra paving required. However, these negotiations have not reduced the extra paving costs substantially.

Exhibit V-4 shows SWPA’s competitively bid main replacement projects in 2019 with total project costs and additional restoration expenses. As shown in the exhibit, on average an additional 9% or $1.3 million is spent towards the additional restoration work requiring capital bids. This amount is consistent with the $1.2 million SWPA quantified in additional restoration costs for 2018.


- 28 -


Additional Restoration Costs for Main Replacement Projects Bid in 2019

Project ID Approved Amount ($)

Additional Restoration ($)

Additional Restoration as % of Project Total

C19D101_002 8,100,454 779,167 9.6% C19D601_002 1,342,810 51,620 3.8% C19D602_002 2,251,081 146,160 6.5% C19D603_002 1,332,696 210,927 15.8% C19D606_002 141,611 5,721 4.0% C19D608_002 163,578 11,864 7.3% C19D613_002 99,446 1,535 1.5% C19D615_002 119,287 45,855 38.4% C19D705_002 286,456 19,550 6.8% C19D709_002 368,939 22,779 6.2%

Total 14,206,358 1,295,176 9.1% Source: Data Request WO-9

Although SWPA must comply with all local, state and federal rules, the above Exhibit highlights the cost for compliance with some local ordinances. This situation has been reported by various utilities throughout the state or operating within some municipal jurisdictions. Whether or not municipalities should require this additional restoration work is beyond SWPA and this audit report. However, it is important to track the above information for multiple reasons. For one, it gives SWPA’s engineering department the ability to make informed decisions and more closely estimate future main replacement costs. In addition, it should aid the company recover costs during rate cases by demonstrating prudence. Therefore, SWPA should continue to track additional municipality/local government-imposed restoration costs. Follow-up Recommendation – None


- 29 -

VI. EMERGENCY PREPAREDNESS

Background – The 2017 Focused Management and Operations Audit of Suez Water Pennsylvania Inc., conducted by the Pennsylvania Public Utility Commission Bureau of Audits, released in February 2017 at D-2016-2528481, contained eight recommendations for the Emergency Preparedness functional area (referred to as the “Emergency Response” section within the Management Audit). The Commission rated this area as needing significant improvement. The PUC auditors incorporated the prior recommendations into this review and deemed it prudent to perform an updated review of the company’s compliance with PUC regulations at 52 Pa. Code § 101 regarding physical security, cyber security, emergency response and business continuity plans. Therefore, eight follow-up findings, six new findings, and thirteen recommendations are presented.

To protect infrastructure within the Commonwealth of Pennsylvania and ensure safe, continuous and reliable utility service, effective June 2005, PUC regulations at 52 Pa. Code § 101 (Chapter 101) require all jurisdictional utilities to develop and maintain written physical security, cyber security, emergency response and business continuity plans. Furthermore, in accordance with 52 PA Code § 101.1, all jurisdictional utilities are to annually submit a Self-Certification Form to the Commission documenting compliance with Chapter 101. This form, available on the PUC website, is comprised of 13 questions as shown in Exhibit VI-1.

Exhibit VI-1 Pennsylvania Public Utility Commission

Public Utility Security Planning and Readiness Self Certification Form Item No.

Classification Response (Yes – No – N/A*)

1 Does your company have a physical security plan? 2 Has your physical security plan been reviewed in the last year and updated as needed? 3 Is your physical security plan tested annually? 4 Does your company have a cyber security plan? 5 Has your cyber security plan been reviewed in the last year and updated as needed? 6 Is your cyber security plan tested annually? 7 Does your company have an emergency response plan? 8 Has your emergency response plan been reviewed in the last year and updated as

needed?

9 Is your emergency response plan tested annually? 10 Does your company have a business continuity plan? 11 Does your business continuity plan have a section or annex addressing pandemics? 12 Has your business continuity plan been reviewed in the last year and updated as

needed?

13 Is your business continuity plan tested annually? * Attach a sheet with a brief explanation if N/A is supplied as a response to a question. Source: Public Utility Security Planning and Readiness Self-Certification Form, as available on the PUC website at

http://www.puc.state.pa.us/general/onlineforms/pdf/Physical_Cyber_Security_Form.pdf


- 30 -

While conducting our Management Efficiency Investigation, the PUC auditors reviewed the most recent Self Certification form submitted by SWPA to evaluate its responses. Our examination of the company’s emergency preparedness included a review of the physical security plan, cyber security plan, emergency response plan, business continuity plan, and associated security measures. In addition, the PUC auditors performed inspections at a sampling of SWPA’s facilities. Due to the sensitive nature of the information reviewed, specific information has not been provided as part of the findings and recommendations.

Finding No. VI-1 Prior Situation – As inspections were concluded, the PUC auditors had noted several minor vulnerabilities or deficiencies in physical security. Most of these were due to facility age, oversight, weather, of general wear and tear. In addition, a few instances had been noted where additional security measures should have been considered. One potential area for improvement noted was to consider additional security measures for tours of SWPA facilities. Prior Recommendation – Correct minor physical security deficiencies and perform on-going physical security reviews of all facilities. Follow-up Finding and Conclusion – Physical security deficiencies exist at its facilities, including many that were previously identified, and security inspections are not optimal. Current Review – Since the 2017 management audit, SWPA has made some security improvements to its facilities. These new security measures were recorded in the physical security plan (PSP) for two facilities including access controls, communications upgrades, and intrusion detection technology. However, many deficiencies noted during facility tours at other sites during the previous audit have not been addressed.

The Director of Environmental Health and Safety (EHS), is responsible for physical

security at Suez PA and inspects all facilities at least once each year. In addition, local staff perform monthly inspections (e.g., fire extinguisher checks, first aid kit inspections, etc.). There is a centralized tool for tracking inspections, fire extinguisher maintenance, safety checks, etc., but not every operation is using this tool. However, these monthly inspections often do not include fences or other security focused efforts. Further complicating these efforts, the company has not standardized its approach to security as further discussed in Follow-up Finding and Conclusion No. VI-2.

The inspections include some but not all items needed for safety and security.

Although extinguisher and first aid kit checks are performed regularly, in many locations monthly fence line inspections are not, which has precluded needed repairs from occurring as fence conditions deteriorate.

There were several weaknesses in the fencing:

• At some facilities, there is damage from fallen trees and/or fence lines obscured by foliage that were identified three years ago.


- 31 -

o At one facility the fence was solidly embedded within the tree trunks indicating the presence of this security weakness for numerous years.

• At one facility, there are questions pertaining to fence ownership on a portion of the property resulting in disrepair.

• In another location, there is a facility where the fence provides a visual barrier from the road but does not enclose the facility or prevent access to it.

Ideally, a robust inspection program would identify and then help to mitigate such deficiencies.

All utilities are required to secure their facilities against emergencies, including physical intrusions and attacks, and security deficiencies should be addressed immediately. SWPA has not prioritized security to a level appropriate for a water utility, which has resulted in deterioration of protective measures. Consequently, SWPA’s security posture exposes the company to increased risks. Follow-Up Recommendation – Standardize and optimize monthly security inspections of all facilities and promptly address identified deficiencies.


- 32 -

Finding No. VI-2 Prior Situation – SWPA maintained a set of suggested physical security measures with input provided by Suez Inc. Facility managers were responsible for implementing physical security measures at their own discretion. However, physical security measures deployed varied for each facility. Prior Recommendation – Establish uniform physical security standards for each type of facility at SWPA. Follow-up Finding and Conclusion – There are now uniform physical security standards at SWPA, but the standards do not define requirements for different types of facilities. Current Review – SWPA’s physical security plan (PSP) contains descriptions of physical deterrents, including physical barriers, electronic surveillance, intrusion alarms, etc. There is also a requirement for monthly fence and lighting inspections with repairs addressed in a timely manner. Additionally, the PSP states that each facility should be evaluated to determine the level of security needed. However, levels of security and their specific requirements are not defined in the PSP or any other policy.

Utilities should define their security needs based on their infrastructure’s criticality, and standards should be well defined for each criticality and/or type of facility. SWPA has established general, uniform standards for security, but has not defined security classifications or tiers to identify security needs based on facility classification or type. For example, although the company improved perimeter security when building new critical infrastructure, no prioritization was given to older facilities with critical infrastructure. Furthermore, because the standards are generalized and vague, broad security measures would qualify without properly mitigating or eliminating specific deficiencies. As identified in Follow-up Finding and Conclusion No. VI-1, many previously identified security deficiencies have not been addressed or remain unchanged.

In February 2020, SUEZ North America Inc. (SNA) created and filled a new position for corporate security in North America for the utility division. As the company’s parent increases its security posture, so should SWPA. SWPA should utilize SNA resources where beneficial to further develop criticality-based security standards for itself and all affiliates. Follow-Up Recommendation – Develop and implement uniform physical security standards based upon facility criticality.


- 33 -

Finding No. VI-3 Prior Situation – SCADA control stations were protected by insufficient layers of security at SWPA’s facilities. Prior Recommendation – Design and implement a policy of layered physical security for SCADA equipment, controllers, and servers. Follow-up Finding and Conclusion – There is no detailed physical security policy for SCADA or cyber equipment, controllers, and servers, and no policy on layered security for critical facilities. Current Review – SWPA’s Physical Security Plan (PSP) states that each facility should be evaluated to determine its level of required security. However, levels of security and associated requirements are not defined in any document as detailed in Follow-up Finding and Conclusion No. VI-2. Moreover, SNA mentions in its “Golden Rules10,” that the SCADA equipment room should be separately secured, but this is a statement rather than a dedicated policy. Additionally, the document does not specify the individual responsible for the security measures. Furthermore, the statement on SCADA equipment room security is not followed at SWPA. In fact, the SWPA Director of EHS was unsure if there was a policy on layered physical security for SCADA equipment. SWPA is also lax in following SNA guidance for visitor access to control centers.

During fieldwork, the PUC auditors noted confusion between SWPA’s EHS director and the SNA Regional CISO (Chief Information Security Officer) regarding assigned responsibility for physical security of SCADA equipment. As a result, cybersecurity equipment at SWPA often lacks its own dedicated physical security measures or additional layered security.

It is an industry best practice to layer security for critical facilities or equipment like SCADA control stations, servers, etc. To be fair, SWPA has improved the overall security at some of its facilities, consequently increasing the security of SCADA equipment at these facilities. However, the company has not developed a policy of increased, layered security for SCADA equipment, controllers, and servers. Without such a policy, SWPA lacks not only the governing oversight but administrative controls to ensure proper security of these critical facilities. Follow-Up Recommendation – Design and implement a specific, detailed physical security policy for SCADA systems, control centers, and critical equipment.

10 SNA issued a set of guidelines known as “The 10 Golden Rules for ICS (Industrial Control Systems) Environment,"

which are intended for SCADA systems.


- 34 -

Finding No. VI-4 Prior Situation – SWPA had not completed a vulnerability assessment (VA) since 2004, and had not addressed most of the findings. Since 2004, the nature of many of the threats facing utilities had changed substantially, and the security standards and policies had not been adjusted to address these changes. Prior Recommendation – Strive to perform a Vulnerability Assessment every 10 years, and revise physical and cybersecurity plans to address new threats or vulnerabilities identified. Follow-up Finding and Conclusion – SWPA finished the risk assessments required by the America’s Water Infrastructure Act of 2018 but has not yet updated its physical and cybersecurity plans to address new threats or vulnerabilities identified. Current Review – In 2017, SWPA solicited quotes for a vulnerability assessment of its facilities with an intent to complete the assessment in 2018. However, restructuring at SNA during 2017 resulted in the creation of a new position for corporate security at SNA. Therefore, SWPA decided to delay the assessment until the corporate security position was filled, which did not occur until February 2020, three years later. In the meantime, the passage of the America’s Water Infrastructure Act of 2018 meant that SWPA was required to complete a risk assessment, by mid-2020. Because of this, in the summer of 2019, SWPA planned a risk assessment, which began in the winter of 2019/2020.

As of early March 2020, assessments of both the Harrisburg and Bloomsburg/ Dallas operations were completed. A draft report for the Harrisburg operation had been issued while a draft report for the Bloomsburg/Dallas operation is expected to be completed soon. SWPA plans to revise its ERP to incorporate the findings of the risk assessments, but this was not completed by the end of audit fieldwork. SWPA should incorporate findings from the risk assessments into its ERPs as they are completed. Follow-Up Recommendation – Upon the VA’s completion, update the physical and cybersecurity plans as necessary to address threats or vulnerabilities identified by the risk assessments.


- 35 -

Finding No. VI-5 Prior Situation – SWPA had conducted emergency drills such as fire and chemical spill exercises. Some local facility managers had reached out to local emergency response groups, such as firefighters and police, to familiarize the emergency responders with the unique risks and appropriate responses at SWPA’s facilities. SWPA had not, however, taken part in many interagency drills or exercises, and none of SWPA’s drills had simulated a widespread or regional problem at more than one facility. Prior Recommendation – Participate in more frequent interagency tabletop drills and exercises. Follow-up Finding and Conclusion – SWPA participates in drills with local first responders but has not participated in multi-agency tabletop exercise or drill in several years. Current Review – SWPA routinely performs drills internally, with a drill of the PSP occurring in March of 2019. The company also invites local first responders (i.e., fire companies) to tour its facilities and perform drills at certain facilities. However, SWPA’s Director of EHS could not recall the last multi-agency tabletop exercise or drill the company participated in. These multi-agency drills involve multiple entities across different industry types and are often hosted by county, state or federal governments and/or trade organizations. Although internal drills are extremely important for the readiness of the company, many outside parties would be involved in a real emergency. That is why it is an industry best practice for utilities to take part in interagency emergency response drills and tabletop exercises. Without practicing with these outside parties, SWPA is less prepared for issues and needs that may arise from external agencies and partners, or may be mistaken about outside agency responses and responsibilities during an emergency. Therefore, the audit staff encourages all utilities to participate in at least one interagency drill annually. Follow-Up Recommendation – Participate in interagency tabletop drills and exercises at least once per year.


- 36 -

Finding No. VI-6 Prior Situation – Several site-specific emergency response plans lacked up-to-date PUC contact information. These deficiencies were resolved before the end of fieldwork. Prior Recommendation – Update the emergency response plan’s PUC contact information and disseminate it to every SWPA facility. Follow-up Finding and Conclusion – SWPA has updated its ERP with current contact information from the PUC, and has disseminated it to every SWPA facility. Current Review – ERPs throughout the company were updated with the current PUC contact information. Each ERP has an emergency contact list for PUC contacts, separated by type of emergency. The contact page is an insert within the ERP but there is no tracking system to ensure the contact pages for all ERPs were updated. Currently, updating the ERPs is a complicated and time-consuming process, because they are widely distributed to many employees and facilities. This also presents an increased risk to the security of information within the ERP. Therefore, it may be beneficial to tie ERPs to operations centers and headquarters, rather than distribute them as widely as is done currently. Nonetheless, the company has taken the appropriate steps and has complied with 52 PA Code Section 101.3(a)(4). Follow-Up Recommendation – None


- 37 -

Finding No. VI-7 Prior Situation – Suez Water Management and Services (SM&S) was providing various shared services to its affiliates including SWPA. Per Suez North America’s cybersecurity plan, SM&S’s Legal Department was required to carry out regulatory surveillance on applicable laws and regulations which impact the cybersecurity needs of the Information Security System (ISS) network. The Legal Department was unfamiliar with this requirement, and consequently had not been tracking or notifying the ISS network about any such changes. Although the Business Technical Services Team had been monitoring changes in legal and regulatory requirements on an ad-hoc basis, it was not officially tasked with doing so. Prior Recommendation – Establish controls to ensure Suez Water Management and Services’ Legal Department provides regular cybersecurity legal and regulatory updates to Suez North America’s subsidiary companies, including SWPA. Follow-up Finding and Conclusion – Suez Water Management and Services’ Legal Department is providing regular updates to Suez North America, but not to its subsidiary companies, and no controls were established. Current Review – Currently, there are no controls in place to ensure that Suez Water Management and Services’ Legal Department provides regulatory updates to SUEZ North America’s subsidiary companies, including SWPA. Consequently, cybersecurity updates to SNA’s CISO, although provided frequently, are not formally disseminated to SWPA or the other subsidiary companies. This is a problem, as SNA’s cybersecurity plan11 specifies that these regulatory and legal updates are to be provided by SM&S’s Legal Department to its ISS Network, which includes representatives from the subsidiary companies.

In order for SWPA to comply with current regulations and laws as well as operate consistently with its cybersecurity plan, SM&S’s Legal Department should continuously monitor and provide regular, formal and recurring cybersecurity legal and regulatory updates to all SUEZ North America’s subsidiaries, including SWPA. Follow-Up Recommendation – Establish controls to ensure SUEZ Water Management and Services’ Legal Department provides regular cybersecurity legal and regulatory updates to SUEZ North America’s subsidiary companies, including SWPA.

11As SNA provides cybersecurity services to its subsidiaries, SWPA uses SNA’s cybersecurity plan.


- 38 -

Finding No. VI-8 Prior Situation – All of SWPA’s facilities with chemicals onsite had the required Safety Data Sheets (SDS). At most locations, however, the SDS sheets had not been updated within the last year or were undated. Prior Recommendation – Update the SDS sheets annually at every SWPA facility. Follow-up Finding and Conclusion – SWPA has switched to an online solution for SDS. Current Review – In 2017, SWPA began using a cloud storage solution for SDS, which is updated annually, and is available online for all Pennsylvania locations. In addition, the company maintains duplicative copies of all SDS sheets on a flash drive at its headquarters. In addition, locations with chemicals also have paper SDS, but these have not been updated since 2015 because they are now stored electronically. The new cloud-based SDS will help ensure the company has a simple and efficient method to update all SDS. Audit staff applauds SWPA implementation of the electronic SDS solution as an improvement for the company which complies with OSHA regulations. OSHA regulation 29 CFR 1910.1200(a)(1) states:

The purpose of this section is to ensure that the hazards of all chemicals produced or imported are classified, and that information concerning the classified hazards is transmitted to employers and employees…The transmittal of information is to be accomplished by means of comprehensive hazard communication programs, which are to include container labelling and other forms of warning, safety data sheets and employee training.

Follow-Up Recommendation – None


- 39 -

Finding No. VI-9

Additional Finding and Conclusion – The company’s respective Emergency Preparedness Plans have minor deficiencies and outdated references. Current Review – The following opportunities for improvement related to SWPA’s Physical Security Plan (PSP), Emergency Response Plan (ERP), and Cybersecurity Plan (CSP) were noted: ERP: • The ERP did not identify critical customers or address their needs. • Some data from ERP introductory sections appears outdated and inaccurate. PSP: • The PSP lacks a revision log and accountability section. • The PSP contains references to the National Security Alert Levels, but this alert level

system was discontinued in 2011. • The PSP requires levels of security, but does not define or list requirements, as

discussed in Follow-up Finding and Conclusion No. VI-2. There is a chart of information on facilities’ existing security, but no classification of security levels or security goals for each facility or type of facility.

• The Chemical Delivery Policy does not include any security measures regarding delivery or requirements of storage.

• The PSP lacks information on reporting procedures, including how to report an issue within the company, and what agencies to contact during and after a security incident.

CSP: • Agency and regulator liaisons are informal and not recorded in the CSP. The SNA

CISO has personal contacts at many agencies, but these are not recorded in the CSP. All plans: • As discussed in Follow-up Finding and Conclusion No. VI-4, emergency plans have

not been updated to reflect the findings of the latest vulnerability assessments, since the reports are currently in progress, and no vulnerability assessments had been performed for 16 years prior.

According to 52 Pa. Code (Section) 101.3(a), a jurisdictional utility shall develop and maintain written physical and cyber security, emergency response, and business continuity plans. A good emergency plan should be as complete, organized, and comprehensive as possible, designed so that any employee can use it to carry out the necessary steps to handle an emergency. SWPA and SNA have done minor updates and revisions to their emergency plans, but have room for some improvements.

Follow-Up Recommendation – Conduct thorough reviews of all emergency and security plans and policies, and revise as appropriate.


- 40 -

Finding No. VI-10 Additional Finding and Conclusion – Suez Water Pennsylvania’s approach to physical security is not yet optimized to support effective oversight. Current Review – SNA’s Regional EHS Director is responsible for Environmental Health and Safety, Emergency Preparedness, and Physical Security. There is no dedicated Director of Security, and no full-time physical security personnel at SWPA. The Regional EHS Director has one direct report in Delaware, but no other direct reports in PA.

During fieldwork, it was unclear what authority the EHS Director had to address emerging or unbudgeted security concerns. It was our impression that the budget for physical security, outside of large capital projects, is minimal and only allows the Director of EHS to independently approve smaller emerging projects (i.e., generally less than $10,000). In most cases, the approval of the Director of Operations, SWPA’s General Manager, and/or SNA’s Director of EHS & Security is needed for any larger projects. As detailed throughout this report, the company appears to lack a strong security culture and seems to de-emphasis physical security in some situations over other operational concerns. While the audit staff recognizes the need to balance priorities, some of the identified security deficiencies have been noted in previous audits. In addition, SNA has hired a corporate security professional, but it is unclear how much time this position will be devoted to SWPA. Therefore, SWPA should leverage this new position to expand its physical security oversight.

Overall, the audit staff contends that additional resources (i.e., time dedicated to

inspections, clear delegation of authorities, budget to address emerging issues, etc.) are needed at SWPA to address the deficiencies noted within the report. In particular, the company would benefit from a Director of Security or a dedicated position under the Director of EHS focused on security. However, SWPA’s size may prohibit that approach in which case, the company’s current structure should be optimized and corporate resources should be leveraged. Primarily, security should have a separate pre-approved budget supporting a five-year plan for security maintenance and improvement projects. In addition, the company should clearly identify the delegation of authority and priority for physical security. Although audit staff notes that some of these efforts may be addressed by corporate with its new position, dedicated resources are needed at SWPA to fully implement the security recommendations found in this report. Follow-Up Recommendation – Increase and/or optimize resources to address physical security at SWPA such as delineating roles and responsibilities for physical security, improving the physical security budget, and creating a five-year security improvement plan.


- 41 -

Finding No. VI-11 Additional Finding and Conclusion – SWPA lacks sprinkler systems at some regularly occupied buildings. Current Review – During inspections of SWPA’s facilities, no sprinkler systems were observed at any of the company-owned buildings; however, PUC auditors did not visit all SWPA facilities. Local plant managers at several locations said that these systems were never installed. According to the Society of Fire Protection Engineers, wet pipe sprinkler systems reduce fatality rates in a fire by 85%, and are effective in 98% of incidents where only one sprinkler is activated. The likelihood of a fatality in a fire is increased by 567% compared to facilities that have wet pipe sprinkler systems, and the damage to property is likely to be much more significant. It is best practice to have wet pipe sprinkler systems installed in all buildings that are regularly occupied.

Many of SWPA’s facilities were not required to have sprinkler systems when they were built, and SWPA will need to spend money to add these systems. However, the safety and cost savings in the event of the fire clearly outweigh the associated cost of installation. Therefore, for any building that is regularly occupied, SWPA should install sprinkler systems. The audit staff recognizes that it may not be prudent to convert all facilities, but the company should prioritize the most critical facilities and begin retrofitting when feasible. Follow-Up Recommendation – Install fire suppression sprinkler systems at all regularly occupied facilities, where feasible.


- 42 -

Finding No. VI-12

Additional Finding and Conclusion – SWPA-provided cell phones allow users to install their own applications. Current Review – Tablets provided to field technicians have security that prevents independent installation of applications (apps). However, most users can independently install apps on their SWPA-provided cell phones. Although employees are required to follow company policies regarding online behavior and use of company devices, these measures rely on prudent employee behavior instead of company imposed technical restrictions. It is best practice for a utility to restrict the ability to install random or non-approved applications on mobile devices. Instead, apps should be preapproved and vetted by security professionals before being implemented on company devises. While the company does identify approved applications, it does not blacklist questionable or unneeded applications. Follow-Up Recommendation – Restrict the ability to install applications on company-provided cell phones and mobile devices to IT personnel.


- 43 -

Finding No. VI-13

Additional Finding and Conclusion – Network access controls are not automated. Current Review – Inventory control systems are not yet automated to identify devices and software connected/utilized on the network to prohibit use of unauthorized devices, mobile media, software, etc. Having information on what devices are connected and what programs are communicating across a company’s network is vital to monitoring the security of the network and automating the prohibition of unapproved devices’ ability to communicate increases network security. The company has identified this need but has not yet begun a project to address it. Such a project is, however, on SNA’s 5-year roadmap.

It is best practice for a utility to automate inventory control to identify devices connected or software installed on the company network. SWPA has identified the need to automate inventory control systems but has not yet done so. Until inventory control systems are automated, the risk of unauthorized devices or programs operating on the network is increased. Follow-Up Recommendation – Automate inventory control systems to identify devices and software connected to or utilized on company networks.


- 44 -

Finding No. VI-14

Additional Finding and Conclusion – Certain server and OS lifecycle management practices could be improved. Current Review – SNA has identified cyber equipment obsolescence as a risk and has taken steps to mitigate it, including implementing a robust equipment lifecycle policy. For instance, laptops are on a scheduled replacement cycle. In addition, patch management programs are employed for all company systems, except for specific air-gapped systems, which are on dedicated networks. However, certain practices for server and operating system lifecycle management could be improved.

One example is that SNA employs a disposal management system to ensure

digital information is destroyed/wiped from systems, devices, and equipment using a third-party company, but SNA does not require certificates of destruction for disposed equipment. Also, patch management is irregular for air-gapped systems. These systems are only patched when a critical or high-risk vulnerability is identified. Although air-gapped systems present a low risk to company networks, the risk increases as companies continue to integrate systems that were formerly isolated. In addition, some dedicated networks are devoted to operational systems that are critical and always should be considered at-risk due to the steep consequences of compromise. Therefore, it is a best practice to use patch management for even isolated systems, with consideration given to minor security patches.

Consequently, SNA should implement a scheduled patch management program and improve its end of life cycle tracking and disposal of hardware. Follow-Up Recommendation – Improve patch management of air-gapped systems and require certification of destruction of equipment as part of the disposal process.


- 45 -

VII. MATERIALS MANAGEMENT Background – SWPA maintains inventory at five locations throughout its service territory: two locations in the Harrisburg region and one each in the Mechanicsburg, Bloomsburg, and Dallas Regions. SWPA uses PeopleSoft as its inventory management system. SWPA’s materials management function is overseen by the Financial Director of the Mid-Atlantic Division. However, oversight of inventory throughout SWPA’s territory is embedded within the responsibilities of various operations employees, ultimately reporting to the Director of Operations.

In this chapter, five prior situations and recommendations are reviewed, and five follow-up findings and three recommendations are presented. The findings primarily relate to establishing minimum and maximum inventory levels, defining emergency stock, increasing inventory turnover, improving inventory accuracy, and reducing inventory management’s manual processes.

Finding No. VII-1

Prior Situation – PeopleSoft’s auto-replenishment feature was not being utilized due to the company’s physical warehouse configuration in which inventory is stored at five separate warehouse locations. Reportedly, the PeopleSoft system had inherent limitations in tracking the desired information by warehouse location. The functionality of PeopleSoft was not optimized to generate reports pertaining to inventory management control such as obsolete material, inventory turnover, auto-replenishment, etc. Prior Recommendation – Reduce or eliminate the manual aspects of the current inventory management process. Follow-up Finding and Conclusion – Manual aspects of the inventory management system are still prevalent. Current Review – In 2018, a consultant conducted a process improvement review of SWPA’s T&D department after a similar review was conducted at SUEZ Water New Jersey. Because personnel within SWPA’s T&D department handle materials as part of their responsibilities, the review took materials management into consideration. Specifically, this project helped prepare SWPA to implement a new mobile workforce management system (Clevest), which eliminated paper service orders for field service personnel. In Clevest, service orders can be viewed and sorted electronically. This change allows field service personnel to view scheduled daily work and pull materials from inventory based on the assigned daily work. As a result, field service personnel no longer carry miscellaneous inventory on their trucks. This directly improves inventory accuracy and is discussed further in Follow-up Finding and Conclusion No. VII-2.

Although it appears the implementation of Clevest aided SWPA’s materials management function, there are still many manual aspects of the inventory management


- 46 -

process. For example, in some regions12 when personnel need inventory issued to a specific project, they must still complete a paper Materials Stock Receipt (MSR) and forward it to personnel trained to record the inventory issues in PeopleSoft. Manual processes can be inefficient and introduce the potential for human error and data entry mistakes when replication of work is necessary to perform a task.

Although recent changes have improved the overall accuracy and efficiency of the inventory management process, the manual nature of SWPA’s materials management function increases the risk for errors. Due to the relatively small size of SWPA’s warehouses, the cost of automation may be uneconomical. However, improving the documentation behind its existing policies and procedures to ensure that all employees are aware of the proper actions13 or dedicating an employee to the materials management function may reduce the frequency or significance of errors from the manual processes until automation is feasible. Follow-up Recommendation – Reduce or eliminate the manual aspects of the inventory management process.

12 The Bloomsburg and Dallas regions still use paper MSRs whereas personnel in the Harrisburg and Mechanicsburg

regions have begun using Excel to process the MSRs. 13 SWPA does not have document policies or procedures regarding physical inventory counts. Documenting all

materials management related policies and procedures is a best practice.


- 47 -

Finding No. VII-2

Prior Situation – Physical inventory counts of SWPA’s exempt and non-exempt materials were conducted annually. Gross variances ranged from 40% to 55% from 2013 to 2015. The company had a goal to adjust inventory less than 25% of the value of total inventory on a yearly basis whereas a net variance goal should be 1-2% for companies with well-managed inventories. Additionally, more frequent inventory counts were recommended to help identify the drivers for inaccurate inventory. Prior Recommendation – Initiate measures to improve inventory accuracy. Follow-up Finding and Conclusion – SWPA initiated measures to improve inventory accuracy; however, a periodic cycle count process has not been formalized company-wide to ensure proper controls. Current Review – As discussed in Follow-up Finding and Conclusion No. VII-1, the consultant’s review of SWPA’s T&D department led to improvements within the materials management function. SWPA no longer orders inventory coded directly to a project, as it did during the 2017 management audit. Instead, all inventory is recorded to an accrued inventory account when it is ordered. This allows all departments to have a better understanding of how much stock is on-hand without bifurcating inventory ordered for specific projects. As discussed further in Follow- up Finding and Conclusion No. VII-3, recording all materials into inventory before assigning them to a project has contributed to improved inventory turnover in 2019.

Subsequent to the consultant’s work, finance personnel from SUEZ Water New Jersey began a project to improve SWPA’s electronic and physical inventories. Results from this inventory clean-up included: • Development of flowcharts for each region’s inventory process • Addition of all materials into PeopleSoft by eliminating exempt inventory • Creation of a system to organize materials in the warehouse by shelf or grid location,

which is now reflected in PeopleSoft14 • Verification via physical inventory counts that items within PeopleSoft match inventory

present at each warehouse

Since that time, SWPA has continued to conduct annual physical inventory counts to ensure that materials in each warehouse can be matched with inventory in PeopleSoft. As to be expected, there were significant variances during the inventory clean up due to the elimination of exempt inventory and physical cleansing of each warehouse. Therefore, SWPA’s reported inventory count accuracy data from 2016 through 2019 does not reflect significant improvements from the 2017 management audit. Nonetheless, several changes since 2017 will, over time, have a positive effect on inventory accuracy which includes the following:

14 Except the Bloomsburg warehouse where it was decided that the shelf or grid system would be introduced later.


- 48 -

• Field operations personnel no longer must determine if an inventory issue needs to be recorded, since all items are recorded with the elimination of exempt inventory.

• Personnel can locate materials easier with locations recorded in PeopleSoft, which is especially beneficial during an emergency or when counting inventory.

• Exempt inventory was added to the Peoplesoft (i.e., there is no untracked inventory).

There are existing challenges despite recent improvements – specifically a manual process to ensure that inventory issues are recorded in the accounting system. In 2019, SWPA experienced a growing inventory balance with a declining number of inventory issues. Eventually, Finance personnel discovered that several months’ worth of MSRs (i.e., inventory issues) were not transferred to the proper personnel and recorded in PeopleSoft. This situation highlights the dangers of a manual system and should be corrected with additional automation, controls, or training. As presented in Follow-up Finding and Conclusion No. VII-1, increased automation may not be feasible. Therefore, additional controls, like monthly cycle counting of the fastest moving inventory items could identify these types of issues15. This practice would give the company a way to quickly identify problems with its inventory or processes and create the proper controls to manage its manual systems.

During audit fieldwork, the T&D Superintendent of the Harrisburg region indicated that T&D staff in Harrisburg would conduct monthly inventory counts. The PUC auditors recommend that this process be formalized and applied to all regions. It is a best practice to cycle count the fastest moving/highest dollar value inventory items regularly to ensure that the physical inventory reflects the inventory balances within an inventory management system. As with any policy or procedure, it should be documented to ensure consistency. Without reinforcing the desired behavior and establishing documented policies and procedures around the new processes, there is a greater likelihood of employees reverting to prior deficient behavior. Follow-up Recommendation – Implement and document a formal process to conduct periodic cycle counts of inventory.

15 Employees investigate discrepancies discovered during physical counts, which includes looking for missing MSRs.


- 49 -

Finding No. VII-3

Prior Situation – SWPA did not track exempt inventory (~18% of overall inventory, which consisted of slow-moving items or items smaller than two inches) within its inventory management system and therefore was excluded from the inventory turnover calculations (annual net inventory issues divided by the 12-month average inventory balance). The company did not have goals for inventory turnover, which ranged from 1.85 to 0.66 during the years 2011 through 2015. Prior Recommendation – Develop inventory turnover goals and strive to achieve an inventory turnover of at least 2.0. Follow-up Finding and Conclusion – SWPA established and achieved an inventory turnover goal of 2.0 in 2019. Current Review – In 2018, SWPA established inventory turnover goals of 1.5 for 2018 and 2.0 for 201916. The cumulative effect of the previously discussed materials management function changes is starting to be realized as shown in Exhibit VII-1; SWPA’s inventory turnover has significantly improved from 0.38 in 2016 to 5.45 in 2019.

Exhibit VII-1 SUEZ Water Pennsylvania, Inc.

Inventory Turnover For the years ended December 31st, 2016 through 2019

2016 2017 2018 2019 Average Inventory Levels 395,725 430,866 630,891 786,652

Annual Issues 149,881 360,121 1,221,438 4,289,160 Inventory Turnover 0.38 0.84 1.94 5.45

Source: Data Request MM-11 Factors contributing to the improved inventory turnover include: • Changing the accounting methodology in 2018 when ordering so that inventory is

booked to an accrued inventory account rather than directly coded to a project. • Organizing and cleaning up inventory at each warehouse from 2018-2019. • Eliminating exempt inventory in 2019 by ensuring that materials in each warehouse

were also recorded in the inventory management system. • Implementing the minimum and maximum inventory level file17 to encourage each

warehouse to better monitor inventory on hand.

16 At the time of audit fieldwork, an inventory turnover goal for 2020 had not been determined. 17 See finding no. VII-5 for additional information about SWPA’s use of the min/max file.


- 50 -

Utilities should strive to maintain inventory turnover ratios above 2.0 to minimize inventory on hand and associated carrying costs. With the positive changes that SWPA has initiated, inventory turnover has significantly improved. Follow-up Recommendation – None


- 51 -

Finding No. VII-4

Prior Situation – SWPA had not established a consistent definition of emergency stock across its service territory. Additionally, system limitations with PeopleSoft were noted as a reason it was difficult to identify emergency stock separately from inventory. Emergency stock levels should typically be between 5%-10% of the average inventory value and should be clearly defined. Prior Recommendation – Establish a consistent and uniform definition for emergency stock and identify appropriate emergency stock levels for all warehouse locations. Follow-up Finding and Conclusion – SWPA developed a definition for emergency stock and designated emergency stock within its Harrisburg region. Current Review – As mentioned in SWPA’s implementation plan for the 2017 management audit, SWPA was planning to work with a consultant to establish a definition for emergency stock and develop an improved method to identify and track emergency stock by inventory location. From this work, the company defined an emergency incident. SWPA used this definition to identify emergency stock as items greater than or equal to 24".

However, SWPA provided no documentation of the definition of emergency stock beyond its 2019 progress report to the 2017 management audit. Instead, the T&D Superintendent provided a verbal definition for emergency stock: any abnormal material for larger transmission mains that cannot be easily obtained. Appearing to confirm this definition, a list of emergency stock provided as a data request response included items 16" or 24" in size. The dollar value of the seven items identified amounted to ~4% of SWPA’s 2019 average inventory balance.

As part of a recent initiative, flow charts for each of the four regions and job aids related to the inventory process were created by SNA. This same initiative also led to reorganizing physical inventory within the warehouses, which improved identification (i.e., warehouse location) and classification of emergency stock. However, audit staff concluded that there is no emergency stock documentation. Nonetheless, by not documenting the definition of emergency stock, SWPA’s tracking of emergency materials could be hindered and may lead to delayed emergency response. Follow-up Recommendation – Document the definition and location of emergency stock within SWPA.


- 52 -

Finding No. VII-5

Prior Situation – SWPA used the inventory module within PeopleSoft to record inventory receipts and issues, document physical inventory counts, set up auto-replenishment parameters, etc. However, the minimum (min) and maximum (max) inventory item level functionality was not being used. The company did not use this functionality due to the use of multiple warehouse locations which made the application of min and max problematic. However, min and max inventory level set points should be designed to ensure operational continuity in the most economical manner (i.e., avoidance of stockouts, excessive inventory and associated carrying costs, obsolete inventory, etc.) while balancing operational needs. Prior Recommendation – Establish minimum and maximum levels for inventory items. Follow-up Finding and Conclusion – SWPA has begun developing minimum and maximum levels for inventory items at each of its warehouses. Current Review – SWPA is improving its inventory control. In 2018, SWPA began piloting the use of a min/max Excel file for its Harrisburg warehouse. The min/max Excel file is generated from a download of the “Inventory On Hand” report from PeopleSoft, which tracks inventory levels at each of SWPA’s inventory locations. By the end of 2019, min/max levels had begun to be developed for each of SWPA’s warehouses. The report uses conditional formatting to highlight the specific inventory items that need to be ordered based on established minimum and maximum inventory levels for some items.

As discussed in Follow-up Finding and Conclusion No. VII-1, SWPA’s materials management function relies heavily on manual processes like the transmittal of the MSR from T&D personnel to a clerk for entry into the inventory management system. By recording MSRs daily and adjusting the min/max file to reflect each warehouse’s needs periodically, T&D personnel will be better able to communicate and justify their inventory needs. This process is still constrained by existing manual processes but does improve the oversight and efficiency of ordering materials. Still, to work effectively, it is imperative for SWPA to establish additional controls for inventory accuracy as discussed in in Follow-up Finding and Conclusion No. VII-2. Follow-up Recommendation – None


- 53 -

VIII. CUSTOMER SERVICE Background – SWPA’s customer service function is overseen by the Mid-Atlantic Division Customer Service Manager and SWPA’s Customer Service Supervisor. Nine customer service representatives answer customer telephone calls, verify customer bills and, as necessary, perform other back office work such as responding to customer email inquiries, handling field service activity order, and cash processing. A third-party answering service handles customer telephone inquiries during non-business hours.

In this chapter, two prior situations and recommendations are reviewed, and two follow-up findings and one recommendation are presented. The findings primarily relate to improving call center performance and engaging customers.

Finding No. VIII-1

Prior Situation – SWPA tracked two quality of service metrics to assess call center performance: call abandonment rate and average speed to answer. For the period 2013 through June 30, 2016, SWPA was not meeting its established goals for their metrics: less than 3% abandoned call rate and 30 second average speed to answer. As of June 30, 2016, SWPA quality of service metrics were 5.3% abandoned call rate and 57 seconds average speed to answer. SWPA Customer Service Representatives (CSRs) performed additional duties such as responding to email inquiries, processing customer payment and service orders, reviewing meter readings, etc. However, the complement of CSRs has remained at nine since 2009. The company indicated that factors related to staffing levels, employee turnover, and lag time in filling vacancies have contributed to this negative trend though an increased average monthly call volume could also be a factor. Prior Recommendation – Identify methods to improve call center performance and strive to meet established goals. Follow-up Finding and Conclusion – SWPA’s call center performance has improved. Current Review – In 2017, after filling vacancies and hiring a new Customer Service Supervisor, SWPA began to see improvements in call center performance. Exhibit VIII-1 shows the 2019 performance goals and call center performance improvement from 2016 through 2019. As of December 31, 2019, SWPA met the abandoned phone rate goal of less than 3% but was no longer meeting the average speed of answer goal of 30 seconds.


- 54 -

Exhibit VIII-1 SUEZ Water Pennsylvania, Inc.

Call Center Performance For the years ended December 31, 2016 – 2019

Goal Target 2016 2017 2018 2019 Abandoned Phone Rate < 3% 6% 3% 2.78% 2.46% Average Speed of Answer 30 seconds 57 sec 26 sec 25 sec 33 sec

Source: Data Request CS-1 and CS-10

In 2018, SWPA implemented a new IVR, which allows customers to perform self-service (i.e., obtain account balances, pay bills, schedule appointments, etc.) any time or day. Since implementing the IVR, call volume has increased substantially, while call volume handled by CSRs has decreased as shown in Exhibit VIII-2. On average, CSRs are answering ~53% of incoming telephone calls. As discussed further in Finding No. VIII-2, CSRs are increasingly responsible for other duties as customers contact the utility in ways other than telephone calls.

Exhibit VIII-2 SUEZ Water Pennsylvania, Inc.

Annual Average Monthly Call Volume For the years ended December 31, 2016 – 2019

* In November 2018 the IVR was implemented and customers began to perform self-service. Source: Data Requests CS-4, CS-10 and CS-11. Follow-up Recommendation – None

6292 6142 6327

9238

5766 5508 53574815

0

1000

2000

3000

4000

5000

6000

7000

8000

9000

10000

2016 2017 2018 2019

Aver

age

Mon

thly

Cal

l Vol

ume

Average Monthly Calls Received Average Monthly Calls Answered by CSRs *


- 55 -

Finding No. VIII-2

Prior Situation – SWPA utilized a combination of communication methods to engage customers and issue emergency and maintenance alerts including telephone, door postings, local news media, SWPA website and social media. However, customer satisfaction surveys conducted in 2014 and 2015 indicated that customers’ satisfaction with online service was 46% in 2014 and 54% in 2015 compared to SWPA’s overall ratings of 76% and 88% respectively. Prior Recommendation – Utilize existing platforms to proactively engage customers, especially online. Follow-up Finding and Conclusion – SWPA has not gauged its customer’s attitudes towards its online offerings recently. Current Review –In early 2017, SWPA started a campaign to obtain email addresses and update telephone numbers during customer calls into the call center. SWPA uses the email addresses to inform customers of their options to utilize online services offered and encourage e-billing sign ups. In November 2017, the Web Self Customer Service Portal was implemented. Within the portal, customers can view and print bills for the last twelve months, make a one-time payment, and sign up for automatic direct debit payments. SWPA experienced a reduction of email inquiries once customers began using the portal. Additionally, SWPA’s website provides emergency and informational alerts based on location to keep customers informed regarding emergency repairs or available communications (e.g., consumer confidence report). Emergency alerts on the SWPA website are consistent with telephone messaging related to the emergency.

SWPA has been expanding the methods available for customers to interact with the company. As described in Finding No. VIII-1, SWPA implemented a new IVR in 2018, which also provides numerous self-service options for customers. In 2019, the SUEZ Alexa skill became available for customers to link their SWPA web account with their Alexa-enabled device. The SUEZ Alexa Skill allows customers to retrieve their balance due, ask the amount of their last payment, request information on how to contact customer service, or ask for a conservation tip (e.g., how can I reduce my water bill). Although SWPA was proactive in implementing new ways to communicate with its customers, no targeted customer satisfaction surveys were conducted in the last three years. For the last few years, SWPA has relied upon JD Powers surveys for customer feedback. These surveys include SWPA customers but are consolidated with all other Suez NA operations for a single composite look at customer service. The Customer Service Manager indicated one solution being considered is a voice of the customer18 platform to solicit customer feedback. Without periodically soliciting customer feedback, the utility may be focusing efforts on communication channels that its customers have lost interested in without knowing why.

18 Voice of the customer is a term used to describe the in-depth process of capturing customers’ expectations,

preferences and aversions.


- 56 -

Follow-up Recommendation – Conduct targeted periodic customer satisfaction surveys of Pennsylvania customers that encompass customers’ preferences for communications.


- 57 -

IX. ACKNOWLEDGEMENTS

We wish to express our appreciation to the officers and staff of SWPA for their cooperation and assistance. This audit was conducted by Krystle Daugherty, Jennie Banzhof, and Michael Flynn of the Management Audit Division of the PUC Bureau of Audits.

The Pennsylvania Public Utility Commission400 North Street, Harrisburg, PA 17120

www.puc.pa.gov

focused management and operations audit of ...significant. specific items of management...

Documents