CT Municipal Electric Energy Cooperative CMEEC

MINUTES OF THE JOINT AUDIT COMMITTEE OF THE BOARDS OF DIRECTORS OF CONNECTICUT MUNICIPAL ELECTRIC ENERGY COOPERATIVE AND CONNECTICUT TRANSMISSION MUNICIPAL ELECTRIC ENERGY COOPERATIVE November 15, 2022 A Regular Meeting of the Joint Audit Committee of the Boards of Directors of Connecticut Municipal Electric Energy Cooperative (“CMEEC”) and Connecticut Transmission Municipal Electric Energy Cooperative (“CTMEEC” dba Transco) was held via Zoom and telephonically on Tuesday, November 15, 2022 at 10:00 a.m. The meeting was legally noticed in compliance with Connecticut General Statutes and all proceedings and all actions hereafter recorded occurred during the publicly open portions of the meeting. The following Committee Members participated telephonically or via Zoom: Bozrah Light & Power: Scott Barber Groton Municipal Representative: Mark Oefinger Norwich Public Utilities: Stewart Peil, Robert Staley (excused himself at 11:00 a.m.) Norwich Municipal Representative: David Eggleston South Norwalk Municipal Representative: Dawn DelGreco Third Taxing District, East Norwalk: Kevin Barber The following Non-Voting Members participated telephonically and via Zoom: Jewett City Department of Public Utilities: Louis Demicco Jewett City Municipal Representative: George Kennedy The following CMEEC Staff participated telephonically, Zoom and in-person: Dave Meisinger, CMEEC CEO (excused himself at 11:30 a.m.) Robin Kipnis, Esquire, CMEEC General Counsel (excused herself at 11:30 a.m.) Patricia Meek, CMEEC Director of Finance & Accounting Joanne Menard, CMEEC Controller Shadaya Bransford, Accounts Payable Accountant Candice DiVita, CMEEC Financial Analyst Leslie Williams, CMEEC Principal Accountant Margaret Job, CMEEC Paralegal and Compliance Specialist Others participated telephonically and via Zoom: Lindsey Intieri, CliftonLarsonAllen (excused herself at 10:36 a.m.) Jeffrey Ziplow, CliftonLarsonAllen (excused himself at 10:36 a.m.) David Silverstone, Esquire, Municipal Electric Consumer Advocate Ms. Job recorded. Committee Chair Stewart Peil called the meeting to order at 10:00 a.m. noting that today’s meeting is being held telephonically and via Zoom. Committee Chair Peil reminded participants to keep their devices on mute unless speaking to eliminate background noise. He asked participants to state their names when speaking for clarity of the record. Specific Agenda Item A Public Comment Period No public comment was made. B Roll Call Ms. Job conducted roll call. Committee Chair Peil confirmed a quorum of the Committee was present. C Approve the Minutes of the June 16, 2022 Special Meeting of the CMEEC / CTMEEC Joint Audit Committee A motion was made by Committee Member Scott Barber, seconded by Committee Member Kevin Barber to Approve the Minutes of the June 16, 2022 Special Meeting of the CMEEC / CTMEEC Joint Audit Committee. Motion passed unanimously. D Review Report of the 2022 Internal Audit – Accounts Payable: Jeffrey Ziplow, Lindsey Intrieri, CliftonLarsonAllen, LLP Committee Chair Peil introduced Mr. Ziplow and Ms. Intrieri of CliftonLarsonAllen (“CLA”). Ms. Menard explained that pursuant to the Committee’s request at the beginning of this year, CLA conducted an internal audit of the Accounts Payable/P-Card process. She added that the results of that audit were provided to the Committee in advance of today’s meeting. Mr. Ziplow and Ms. Intrieri then proceeded to walk the Committee through its audit process. Ms. Intrieri discussed the project approach and associated tasks and completed her discussion by providing a high-level review of the findings and recommendations of each component of the CMEEC Accounts Payable policies and procedures which include Purchasing, Business Expense Reimbursements and P-Card use.  Ms. Intrieri explained the overall ratings for each of the areas audited, the rating calculation and logic for each. She then identified the individual ratings awarded to each of the audit tests. Ms. Intrieri noted that the internal audit received an overall rating of Satisfactory, which was the highest available rating. Ms. Menard thanked CLA for the detail provided to the Committee. Lengthy discussion followed. E Discussion of Action Items of Management Responses to Internal Audit Ms. Menard walked the Committee through the Management Comments in response to each of the recommendations made by CLA resulting from their internal audit. She noted that CMEEC management was in agreement with the majority of the CLA recommendations and provided additional information on process improvements under consideration for some of the areas that were the subject of the internal audit. In connection with a discussion on improving vendor due diligence, Ms. Kipnis agreed to review the scope of the Ethics and Conflict of Interest policy. F Report on Status of Ongoing Cyber Security Project Ms. Menard explained that this project was started in 2021. She added that Ginger Palmer, CMEEC Cyber Systems and Security Manager, created the Cybersecurity Gap Analysis Project Key 2022 Accomplishments bulleted presentation which was provided to the Committee this morning and made a part of the package of materials for today’s meeting. Ms. Menard walked the Committee through the many items accomplished to date and highlighted the next steps of the Cybersecurity Gap Analysis. Discussion followed. G Discuss Potential Policy for Focus for an Internal Audit/Examination by Third- Party for 2023 Committee Chair Peil explained that a list of potential internal audit focus areas along with a list of historical internal audit reviews was provided to this Committee in advance of today’s meeting. He added that this is not an exhaustive list and encouraged the Committee to think of and suggest other areas of focus. Discussion followed related to an internal audit of the disaster recovery process which included current and past practices. Ms. Meek explained that with the sale of the Pierce Plant, CMEEC’s back up servers were moved from that location to a location in East Hartford. Because this has been a recent move, a disaster recovery internal audit may be premature.  After discussion, the Committee agreed to include an internal audit of CMEEC’s Disaster Recovery policy and procedures to the list of potential focus areas for 2023. The Committee also agreed that an internal audit project would not be chosen today, and that it may be preferable to allow staff time in 2023 to focus on the ongoing Cyber Security Gap Analysis project. H New Business Ms. Menard reported that there were no deviations to the CMEEC Travel, Events and Retreats Policy since the last report to this Committee. She reminded the Committee that this report is required to be made quarterly to this Committee pursuant to its Charter. Ms. Menard reminded the Committee to complete the Audit Committee Self-Evaluation by the deadline of December 5, 2022. She also reported to the Committee that the external financial audit field work has been moved to January therefore the CLA auditors conducting the external audit will be in attendance at this Committee’s meeting in January to kick off the audit and to present the Engagement Letters. I Adjourn A motion was made by Committee Member Dawn DelGreco, seconded by Committee Member Kevin Barber to adjourn. Motion passed unanimously. The meeting was adjourned at 11:32 a.m.