CT Municipal Electric Energy Cooperative CMEEC

MINUTES OF THE REGULAR HYBRID MEETING OF THE JOINT AUDIT COMMITTEE OF THE BOARDS OF DIRECTORS OF CONNECTICUT MUNICIPAL ELECTRIC ENERGY COOPERATIVE AND CONNECTICUT TRANSMISSION MUNICIPAL ELECTRIC ENERGY COOPERATIVE November 5, 2024 A Regular Hybrid Meeting of the Joint Audit Committee of the Boards of Directors of Connecticut Municipal Electric Energy Cooperative (“CMEEC”) and Connecticut Transmission Municipal Electric Energy Cooperative (“CTMEEC” dba Transco) was held in person at 30 Stott Avenue, Norwich, CT and via Zoom on Tuesday, November 5, 2024 at 10:00 a.m. The meeting was legally noticed in compliance with Connecticut General Statutes and all proceedings and all actions hereafter recorded occurred during the publicly open portions of the meeting. The following Committee Members participated via Zoom: Bozrah Light & Power: Scott Barber Groton Municipal Representative: Mark Oefinger Jewett City Department of Public Utilities: Kenneth Sullivan Norwich Public Utilities: Stewart Peil, Robert Staley Norwich Municipal Representative: David Eggleston South Norwalk Municipal Representative: Dawn Del Greco Third Taxing District, East Norwalk: Kevin Barber The following Non-Voting Members participated via Zoom: Bozrah Light & Power: William Ballinger Jewett City Department of Public Utilities: Louis Demicco, James DeRusha Jewett City Municipal Representative: George Kennedy East Norwalk Municipal Representative: Pete Johnson The following CMEEC Staff participated in person unless otherwise noted: Dave Meisinger, CMEEC CEO Patricia Meek, CMEEC Director of Finance & Accounting Joanne Menard, CMEEC Controller Candice DiVita, CMEEC Financial Analyst Heidi Winnick, CMEEC Financial Treasury Analyst The following CMEEC Staff participated in person unless otherwise noted (Cont’d): Leslie Williams, CMEEC Principal Accountant Shadaya Bransford, CMEEC Lead Accounts Payable Accountant, via Zoom Margaret Job, CMEEC Director of Administrative Services, via Zoom Lauren Gaudet, CMEEC Administrative & Sustainability Specialist Chantal Maxwell, CMEEC Administrative Services Coordinator Ginger Palmer, CMEEC Cyber Systems & Security Manager William Butts, CMEEC BI Developer Hao Ni, CMEEC Asset Performance Manager, via Zoom Others participated via Zoom: David Silverstone, Esquire, Municipal Electric Consumer Advocate Jessica Aniskoff, CliftonLarsonAllen (CLA) Brandon Cathcart, CliftonLarsonAllen (CLA) Rocky Bragg, Novus Insight Ms. Gaudet recorded. Committee Chair Stewart Peil called the meeting to order at 10:00 a.m. noting for the record that today’s meeting is being held in person at 30 Stott Avenue, Norwich, CT and via Zoom. He explained that participants should keep their device on mute unless speaking to eliminate background noise and state their name when speaking for clarity of the record. Specific Agenda Item A Public Comment Period No public comment was made. B Roll Call Ms. Gaudet conducted roll call. Committee Chair Peil confirmed a quorum of the Committee was present. C Approve the Minutes of the May 15, 2024 Special Hybrid Meeting of the CMEEC / CTMEEC Joint Audit Committee A motion was made by Committee Member Eggleston, seconded by Committee Member Scott Barber to Approve the Minutes of the May 15, 2024 Special Hybrid Meeting of the CMEEC / CTMEEC Joint Audit Committee. Motion passed unanimously. D Annual Audit Planning with CliftonLarsonAllen Committee Chair Peil introduced the Committee to Ms. Aniskoff of CliftonLarsonAllen (CLA). Ms. Aniskoff identified the team that would be responsible for this year’s audit and detailed the services that CLA would be providing. She explained that CLA would be engaged to audit the financial statements of both CMEEC and Transco and would also handle the issuance of their debt compliance letters. Ms. Aniskoff went on to detail the objectives and responsibilities of the financial statement audit along with the related responsibilities of both management and the auditor. She then outlined the audit approach and emphasized the GASB standards that may affect CMEEC in the audit. Ms. Aniskoff concluded by providing a comprehensive audit schedule, noting that preliminary fieldwork is planned for the week of January 6, 2025, followed by final fieldwork during the weeks of January 27, 2025 and February 3, 2025. CLA intends to report its findings to this Committee at its meeting in March 2025, with the financial statements finalized by March 31, 2025. E Possible Vote to Authorize Signature on Engagement Letters Committee Chair Peil entertained a motion to authorize signature on the CliftonLarsonAllen statements of work as presented to this Committee. A motion was made by Committee Member Eggleston, seconded by Committee Member Scott Barber to Authorize Signature on the CliftonLarsonAllen statements of work. Motion passed unanimously. F Status Update on Cybersecurity Gap Analysis with Novus Insight Ms. Palmer explained that CMEEC is currently engaged in a multi-year Cyber Security Gap Analysis project to align with the ISO 27001 cybersecurity framework. She introduced Mr. Bragg of Novus Insight, who led the Committee through the slide deck that had been shared in advance of today’s meeting. Mr. Bragg clarified that instead of seeking ISO 27001 certification, CMEEC is now taking a risk-based approach customized to its cybersecurity needs and risk profile to align with ISO 27001. He explained that risk and business obligation surveys were completed by each department at CMEEC in April, allowing for the results to be compiled into a risk register by Novus in May. Mr. Bragg explained that the risk register was used to develop a remediation plan of ISO controls focused on safeguarding sensitive information and meeting cybersecurity insurance policy requirements. He noted that some of these controls need to be operationalized before they can be incorporated into the CMEEC Acceptable Use Policy or supplemental policies. Mr. Bragg then opened the floor to questions.  Committee Chair Peil inquired whether an independent third-party audit of CMEEC’s alignment with ISO 27001 controls could take place within two years. Mr. Bragg indicated that some controls need to be implemented before they can be incorporated into the Acceptable Use Policy. He added that since auditing a newly written policy without adequate usage isn’t ideal, CMEEC advises against setting a strict timeline for the audit, though 2-3 years might be a reasonable estimate. Ms. Palmer and Mr. Meisinger concurred that controls and policies need to be operationalized and monitored over time before an audit would be beneficial to CMEEC’s Cybersecurity Program. Ms. Palmer added that many controls have been put in place and improvements to process made that have enhanced and evolved the organization’s Cybersecurity Program. Committee Chair Peil then questioned whether this topic should be taken up by a different body, such as the entire Board or the Risk Management Committee. The Committee agreed that this item should stay at the Committee level and that it could potentially be passed off to the Risk Management Committee, but that for the time being it should stay with the Audit Committee. G Safety Audit Close Out Report Mr. Meisinger explained that Safety Audit conducted by TRC Companies in 2023 revealed two key findings: one concerning electrical safety and the other relating to fall protection, both of which CMEEC has been working to address. The purchase of a device for racking the Microgen site breakers from a safe distance has resolved the electrical safety finding. The upcoming purchase of a bucket truck, which is included in the Proposed 2025 CMEEC Capital Budget, will address the fall protection finding. Mr. Meisinger noted that CMEEC recently completed an RFP for safety consulting services and selected TRC Companies as our new safety consultant. He explained that the internal CMEEC Safety Committee has recently expanded and will collaborate with TRC to identify and address any existing or future safety concerns. H New Business To fulfill this Committee’s requirement to report any CMEEC Travel Policy exceptions, Ms. Menard reported that there were no exceptions to the CMEEC Travel Policy since the last report to the Committee. I Adjourn A motion was made by Committee Member Del Greco, seconded by Committee Member Kevin Barber to adjourn. Motion passed unanimously. The meeting was adjourned at 10:49 a.m.