CT Municipal Electric Energy Cooperative CMEEC

MINUTES OF THE REGULAR MEETING OF THE JOINT AUDIT COMMITTEE OF THE BOARDS OF DIRECTORS OF CONNECTICUT MUNICIPAL ELECTRIC ENERGY COOPERATIVE AND CONNECTICUT TRANSMISSION MUNICIPAL ELECTRIC ENERGY COOPERATIVE December 9, 2021 A Regular Meeting of the Joint Audit Committee of the Boards of Directors of Connecticut Municipal Electric Energy Cooperative (“CMEEC”) and Connecticut Transmission Municipal Electric Energy Cooperative (“CTMEEC” d/b/a Transco) was held via Zoom and telephonically on Thursday, December 9, 2021 at 1:00 p.m. The meeting was legally noticed in compliance with Connecticut General Statutes and all proceedings, and all actions hereafter recorded occurred during the publicly open portions of the meeting. The following Committee Members participated telephonically and via Zoom: Groton Municipal Representative: Mark Oefinger Jewett City Department of Public Utilities: Kenneth Sullivan Norwich Public Utilities: Stewart Peil, Robert Staley South Norwalk Municipal Representative: Dawn DelGreco East Norwalk, Third Taxing District: Kevin Barber The following Non-Voting Members participated telephonically and via Zoom: Bozrah Light & Power: Scott Barber Jewett City Department of Public Utilities: Louis Demicco, Richard Throwe South Norwalk Electric and Water: Alan Huth The following CMEEC Staff participated telephonically and via Zoom: Dave Meisinger, CMEEC CEO Robin Kipnis, CMEEC General Counsel Patricia Meek, CMEEC Director of Finance and Accounting Joanne Menard, CMEEC Controller Ginger Palmer, CMEEC Cyber Systems and Security Manager Leslie Williams, CMEEC Principal Billing & Rate Analyst Margaret Job, CMEEC Paralegal and Compliance Specialist The following Invited Guests participated telephonically and via Zoom: Greg Bugbee, Novus Insight Jessica Aniskoff, CliftonLarsonAllen Vanessa Rossitto, CliftonLarsonAllen Others participated telephonically and via Zoom: David Silverstone, Esquire, Municipal Electric Consumer Advocate Ms. Job recorded. Committee Chair Stewart Peil called the meeting to order at 1:01 p.m. noting for the record that today’s meeting is being held telephonically and via Zoom. Committee Chair Peil reminded participants to keep their devices on mute unless speaking to eliminate background noise. He asked participants to state their names when speaking for clarity of the record. Specific Agenda Item A Public Comment Period No public comment was made. B Roll Call Ms. Job conducted roll call with each participant responding individually as their names were called. Committee Chair Peil confirmed a quorum of this Committee was present. C Approve the Minutes of the March 19, 2021 Special Meeting of the Joint Audit Committee A motion was made by Committee Member Mark Oefinger, seconded by Committee Member Kevin Barber to Approve the March 19, 2021 Special Meeting of the Joint Audit Committee. Motion passed unanimously. D Report on Status of Ongoing Cyber Security Project – Novus Ms. Palmer introduced Greg Bugbee, Chief Technology Officer and Cyber Security Lead at Novus Insight. She explained Mr. Bugbee was engaged to a review the CMEEC Cyber Security program as requested by this Committee. He performed a gap analysis and recommended CMEEC to align its Cyber Security policies with the ISO 27001  framework, which could then perhaps form the basis for a future cyber security audit after CMEEC has operated under the new policies and framework for a period of time. Mr. Bugbee walked the Committee through the slide deck prepared by Novus Insight and provided in advance of today’s meeting. He explained that the gap analysis conducted revealed areas for improvement which included aligning the CMEEC policies with the ISO 27001 framework. He further explained that CMEEC policies have been aligned to an ISO 27001 Written Information Security Program (WISP) framework stating that almost all WISP control requirements will be addressed with updated policies. He explained the treatment of these policies noting that procedures, standards, and technical information need to be updated frequently. He added that an updated risk assessment was performed on December 3, 2021. The team will reconvene in January 2022 to complete review and update of the risk assessment which will be performed on an annual basis. Mr. Bugbee discussed technical improvements accomplished resulting from the review of the CMEEC Cyber Security Program and discussed next steps. After inquiry by Committee Chair Peil related to ransomware, Mr. Bugbee explained that the activities conducted to improve the CMEEC Cyber Security program help to maintain resilience against ransomware. He explained the line of defense against ransomware the Cyber Security plan has implemented and as discussed at today’s meeting. Mr. Bugbee also explained that the team discussed enhancing training curriculum as they went through the process of creating the Cyber Security program and that training is built into the framework. Mr. Meisinger added that the review of the CMEEC Cyber Security Program was the result of the Audit Committee choosing this topic in 2020 for the conduct of an internal audit. At this time, Mr. Bugbee and Ms. Palmer excused themselves from the meeting. E Annual Audit Planning, Vanessa Rossitto, Jessica Aniskoff, CliftonLarsonAllen, LLP Ms. Rossitto introduced herself and the team that will be conducting the audit. She discussed the scope of services stating that CLA will be engaged to conduct a financial statement audit of CMEEC and Transco and will issue a debt compliance letter as is consistent with previous years. She added that the preliminary fieldwork has begun with CLA staff at CMEEC this week. Mr. Rossitto walked the Committee through standard CMEEC management and Auditors’ responsibilities during the audit process and the audit approach. She briefly discussed the GASB Standards that may affect CMEEC in the audit. Finally, Ms. Rossitto provided a detailed Audit schedule stating that, as noted earlier in her  presentation, the preliminary fieldwork has begun this week with final fieldwork being conducted the weeks of January 31, 2022 and February 7, 2022. CLA will present early findings to this Committee at its meeting in March 2022 with the financial statements being finalized by March 31, 2022. Discussion followed. F Possible Vote to Authorize Signature on Engagement Letters A motion was made by Committee Member Oefinger, seconded by Committee Member Robert Staley to Authorize Signature of the CMEEC and CTMEEC Engagement Letters by the Chair of the Audit Committee and the CMEEC CEO. Motion passed unanimously. At this time, Ms. Rossitto and Ms. Aniskoff excused themselves from the meeting. G Review Report of 2021 Internal Audit – Employee Benefit Testing Committee Chair Peil explained that in 2021 this Committee requested that an internal audit be conducted to ensure compliance with CMEEC’s policies related to CMEEC employee benefit package. He added that Brady Martz (the “Consultant”) was engaged to conduct the audit. Ms. Menard reminded the Committee that the review/audit was focused on an accurate provision and administration of CMEEC Benefits to employees according to existing policies and plan documents. Items covered included: insurances, employee time off and accruals, employee deferrals such as FSA and HSA, and an expansion covering all employees of the NRECA Group Benefits Plan Review that was also conducted this year. She explained that there were no exceptions found during the audit. The detailed report from Brady Martz was provided to this Committee in advance of today’s meeting. Ms. Kipnis identified Linda Audet, HR Lead, and explained that her outstanding hard work and dedication to detail was a factor in these results. H Discuss Potential Policy or Focus for an Internal Audit / Examination by Third- Party for 2022 Committee Chair Peil explained that each year this Committee chooses a focus area to conduct an internal audit. He stated that CMEEC staff developed a list of potential areas for audit provided in advance of today’s meeting. He noted that a decision is not required today and encouraged discussion. Following lengthy discussion, the Committee agreed that an audit of the CMEEC business continuity – disaster plan will be conducted in 2022. I New Business Ms. Menard explained that this Committee is tasked with reporting on CMEEC Travel Policy exceptions. She stated that there were no exceptions to the Travel Policy since last reported. J Adjourn A motion was made by Committee Member Dawn DelGreco, seconded by Committee Member Oefinger to Adjourn. Motion passed unanimously. The meeting was adjourned at 2:08 p.m.