[Federal Register: December 19, 2008 (Volume 73, Number 245)]
[Notices]
[Page 77665-77678]
[DOCID:fr19de08-72]

-----------------------------------------------------------------------

DEPARTMENT OF ENERGY

Federal Energy Regulatory Commission

[Docket Nos. PA08-6-000; EL05-102-000; EL05-104-000; ER03-713-000]

Southern Company Services Inc., Alabama Power Company, Georgia
Power Company, Gulf Power Company, Mississippi Power Company, Southern
Power Company; Notice of Audit Report Issuance and Invitation To
Comment

December 12, 2008.
    On October 5, 2006, the Commission issued an Order on Settlement
(Settlement Order) accepting in part and rejecting in part an Offer of
Settlement (Settlement Offer) submitted by the settling parties \1\ in
Docket No. EL05-102-000, et al.\2\ The Settlement Order required
numerous modifications to the Settlement Offer intended to provide
immediate benefits to consumers and competitors that operate in the
Southern region.
---------------------------------------------------------------------------

    \1\ Southern Company Services, Inc. (acting for itself and as
agent for Alabama Power Company, Georgia Power Company, Gulf Power
Company, Mississippi Power Company, Savannah Electric and Power
Company, and Southern Power Company, collectively Southern Company),
Calpine Corporation, Coral Power, LLC, and the Board of Water, Light
and Sinking Fund Commissioners of the City of Dalton (collectively
the settling parties).
    \2\ Southern Company Services, Inc., 117 FERC ] 61,021 (2006).
---------------------------------------------------------------------------

    The Settlement Order also directed the Office of Enforcement to
conduct an audit of the Southern Operating Companies (Alabama Power
Company, Georgia Power Company, Gulf Power Company, Mississippi Power
Company, and Southern Power Company (Southern Power)) to: (1) ensure
that the Southern Operating Companies are fully complying with all the
conditions set forth in the Settlement Order, and (2) determine whether
the conditions imposed there were sufficient to address any remaining
opportunities for affiliate abuse under the Intercompany Interchange
Contract (IIC) related to Southern Power.\3\
---------------------------------------------------------------------------

    \3\ Settlement Order at P 60.
---------------------------------------------------------------------------

    In the Settlement Order, the Commission advised that it will notice
the audit report for comment and, after considering the comments on it,
determine what, if any, further action is appropriate.\4\ The
Commission added that if affiliate abuse concerns remain, it would
either set such concerns for hearing or require further changes
immediately.\5\ The Office of Enforcement has recently completed its
audit report. A copy of the report is attached to this Notice.
---------------------------------------------------------------------------

    \4\ Id.
    \5\ Id.
---------------------------------------------------------------------------

    All interested persons desiring to comment on what, if any, further
action is appropriate on the matters addressed by the audit report,
including the IIC and remaining opportunities for affiliate abuse, may
file written comments on or before January 12, 2009. After reviewing
these comments, the Commission will determine whether further action is
appropriate.
    The Commission encourages electronic submission of comments in lieu
of paper using the ``eFiling'' link at http://www.ferc.gov. Persons
unable to file electronically should submit an original and 14 copies
of the comments to the Federal Energy Regulatory Commission, 888 First
Street, NE., Washington, DC 20426.
    Comment Date: 5 pm Eastern Time on January 12, 2009.

Kimberly D. Bose,
Secretary.

Federal Energy Regulatory Commission

Audit Report of Southern Company's

     Compliance with the Conditions Imposed by the Commission
in Docket No. EL05-102-000, et al., and
     Remaining Opportunities for Affiliate Abuse related to
Southern Power under the Intercompany Interchange Contract

Docket No. PA08-06-000

December 12, 2008.

Office of Enforcement

Division of Audits

Table of Contents

I. Executive Summary
    A. Overview
    B. Southern Company
    C. Summary of Commission Proceedings in Docket No. EL05-102 et
al.
    D. Summary of Compliance Findings
    E. Summary of Recommendations and Corrective Actions Taken
II. Southern Company's Compliance With Commission Orders
III. Introduction
    A. Objectives
    B. Scope and Methodology
IV. Findings and Recommendations
    1. Electronic Separation
    2. Employee Separation
    3. Posting of Separation Protocol Violations on OASIS
V. Southern Companies Response on the Draft Audit Report--Appendix A

I. Executive Summary

A. Overview

    On October 5, 2006, the Commission issued an Order on Settlement
(Settlement Order) accepting in part and rejecting in part an Offer of
Settlement (Settlement Offer) submitted by the settling parties \6\ in
Docket No. EL05-102-000, et al.\7\ The Settlement Order required
numerous modifications intended to provide immediate benefits to
consumers and competitors that operate in the Southern region. The
Settlement Order also directed the Division of Audits (DA) within the
Office of Enforcement (OE) to conduct an audit of the Southern
Operating Companies (Alabama Power Company, Georgia Power Company, Gulf
Power Company, Mississippi Power Company, and Southern Power Company
(Southern Power)) to: (1) Ensure that the Southern Operating Companies
are fully complying with all the conditions set forth in the order, and
(2) determine whether the conditions imposed therein were sufficient to
address any remaining opportunities for affiliate abuse under the
Intercompany Interchange Contract (IIC) related to Southern Power.
---------------------------------------------------------------------------

    \6\ Southern Company Services, Inc. (acting for itself and as
agent for Alabama Power Company, Georgia Power Company, Gulf Power
Company, Mississippi Power Company, Savannah Electric and Power
Company, and Southern Power Company, collectively Southern Company),
Calpine Corporation, Coral Power, LLC, and the Board of Water, Light
and Sinking Fund Commissioners of the City of Dalton (collectively
the settling parties).
    \7\ Southern Company Services, Inc., 117 FERC ] 61,021 (2006).
---------------------------------------------------------------------------

    The Southern Operating Companies made a compliance filing on
November 6, 2006, notifying the Commission that they had implemented
the modifications required by the Settlement Order. The Southern
Operating Companies also provided a projected implementation schedule
reflecting the compliance efforts to date and a seven-month timeline to
complete the remaining compliance milestones. The Commission accepted
the compliance filing on April 19, 2007 (Acceptance Order), subject to
further modifications to the IIC, Separation of Functions and
Communications Protocol (Separation Protocol), and Generator Support
Service Tariff (GSS Tariff).\8\ The Commission required the Southern
Operating Companies to fully implement all the compliance efforts
included in its implementation schedule within seven months from the
issuance of the Acceptance Order. The Commission also directed OE to
monitor the Southern Operating Companies' implementation progress and,
once the implementation is complete, to commence its audit and finish
the audit within 12 months. The Southern Operating Companies completed
the implementation on November 16, 2007, and filed a Notice of
Completion with

the Commission. The Commission accepted the Southern Operating
Companies' Notice of Completion on January 11, 2008.\9\ OE commenced
the audit of the Southern Operating Companies on November 19, 2007.
---------------------------------------------------------------------------

    \8\ Southern Company Services, Inc., 119 FERC ] 61,065 (2007).
    \9\ Southern Company Services, Inc., Docket Nos. EL05-102-005
and EL05-102-006 (January 11, 2008) (unpublished letter order).
---------------------------------------------------------------------------

    OE has completed its audit of the Southern Operating Companies. The
audit examined whether the Southern Operating Companies are fully
complying with the modifications the Commission set forth in the
Settlement and Acceptance Orders and whether the conditions imposed
therein are sufficient to address any remaining opportunities for
affiliate abuse under the IIC related to Southern Power. The audit
covered the period from November 19, 2007 through August 29, 2008.
    Audit staff concluded that the Southern Operating Companies
properly implemented the modifications and generally complied with the
conditions imposed by the Commission in the Settlement and Acceptance
Orders. However, audit staff determined that Southern Company should
implement additional corrective actions to prevent the potential for
Southern Power employees to access non-public market information.
Moreover, Southern Company should follow the Commission's and its
company's policies for posting non-public market information on its
Open Access Same-Time Information System (OASIS). OE's audit findings
and recommendations are summarized below in sections D and E of this
audit report (report), and discussed comprehensively in section IV of
this report.
    Audit staff's conclusions are based on evidence obtained through 85
employee interviews, four face-to-face meetings, weekly phone
conferences, four site visits, facility inspections, extensive data
inquiries and examinations, and review of approximately 7,000 e-mails
and 2,800 voice recordings.

B. Southern Company

    Southern Company is an electric utility holding company and the
parent company of the Southern Operating Companies, Southern Company
Services, Inc., and other direct and indirect subsidiaries. The primary
business of Southern Company is the supply and sale of electricity in
the Southeast region of the United States. Southern Power, a wholesale
energy provider, constructs, acquires, and manages generation assets in
the wholesale market, where it sells electricity at market-based rates.
Southern Power is the large wholesale energy provider in the Southeast,
owning and operating more than 6,500 megawatts of generating assets.
The other Southern Operating Companies are vertically integrated
utilities that provide electric service in the states of Alabama,
Georgia, Florida, and Mississippi.
    Southern Company Services, Inc. is a centralized service company
which provides various services, at cost, to the Southern Operating
Companies and its subsidiaries. For example, Southern Company Services,
Inc. acts as agent to the Southern Operating Companies for
administering and carrying out the operational activities under the IIC
and for the sale of wholesale power at market-based rates. Southern
Company Services, Inc. also acts as agent to the Southern Operating
Companies for providing transmission service under Southern Company's
OATT. Further, Southern Company Services, Inc. enters into gas purchase
and sales agreements, and transportation and storage contracts, as
agent on behalf of the Southern Operating Companies.
    The Southern Operating Companies function as an integrated public
utility system through the joint commitment and economic dispatch of
their generating resources to meet their collective load obligations.
The integrated operation of their respective electric generating
facilities and system operations (generally referred to as the pool) is
governed by the IIC, which is a rate schedule on file with the
Commission pursuant to the Federal Power Act.\10\ The IIC provides for
the coordinated and integrated operation of the generating facilities
and resources owned, contractually controlled, and operated by the
Southern Operating Companies, as well as the pooling of surplus energy
for short-term wholesale energy sale opportunities. In essence, the
IIC: (1) Specifies the types of transactions involved in system
operations; (2) provides for the sharing of the benefits and burdens
associated with the operation of facilities that are used for the
mutual benefit of the Southern Operating Companies; and (3) provides
guidance for pool operations. Southern Company Services, Inc. operates
the pool in accordance with the IIC using a centralized economic
dispatch model to serve the obligations of the Southern Operating
Companies with the lowest cost resources while at the same time
reliably operating the interconnected system. Any energy generated in
excess of these obligations becomes available to the pool for making
short-term wholesale energy sales to third parties on behalf of the
Southern Operating Companies. Southern Company Services, Inc. is
responsible for billing the Southern Operating Companies for
transactions and services under the IIC on a monthly basis.
---------------------------------------------------------------------------

    \10\ Second Revised Rate Schedule FERC Number 138.
---------------------------------------------------------------------------

    The Southern Operating Companies also make wholesale sales at
market-based rates, pursuant to market-based rate tariffs, which
include a code of conduct and a Separation Protocol. The code of
conduct provides important protections concerning the business
relationship amongst the Southern Operating Companies and marketing
affiliates with market-based rate authority. The Separation Protocol
places protections between Southern Power and the other Southern
Operating Companies in the codes of conduct. Specifically, the
Separation Protocol requires the functional separation of the wholesale
activities that Southern Power carries out for the sole benefit of its
shareholders from the activities of the other Southern Operating
Companies. Further, the Separation Protocol allows Southern Power to
use employees of Southern Company Services, Inc. or any other affiliate
as long as those employees are dedicated exclusively to Southern Power.
Southern Power is also permitted to use shared support employees as
long as it does so consistent with the independent functioning
requirements of the Standards of Conduct.\11\ In addition, the
Separation Protocol contains other restrictions designed to protect
against Southern Power's physical and electronic access to non-public
market information, receiving preferential treatment with regard to the
purchase or sale of transmission service or electric energy, and abuses
related to the purchase or the sale of non-power goods and services.
---------------------------------------------------------------------------

    \11\ 18 CFR 358.4(a)(5)(2008).
---------------------------------------------------------------------------

C. Summary of Commission Proceedings in Docket No. EL05-102 et al.

    Southern Power is a wholly-owned subsidiary of Southern Company and
affiliate of the other Southern Operating Companies. Southern Power is
a competitive generation provider that does not have a franchised
obligation to serve at retail. In this capacity, it raises several
regulatory concerns, which were described by the Commission in the
Settlement Order. As the Commission explained therein, when a
competitive affiliate is a member of a power pool with its regulated
operating company

affiliates, an incentive exists for the regulated affiliates to
subsidize the sales of the competitive affiliate to benefit their
mutual shareholders.\12\ Second, when Southern Power sells power to
other Southern Operating Companies, there is a concern that the
competitive affiliate not be granted an undue preference.\13\ When the
competitive affiliate sells to a regulated affiliate, the Commission's
concern is that the price not be set too high.\14\ Conversely, when the
regulated affiliate sells to a competitive affiliate, the Commission's
principal concern is that the price not be set too low.\15\ When sales
are made to third parties, the Commission's principal concern is that
the regulated Southern Operating Companies continue to compete for such
sales rather than favoring sales by Southern Power.\16\ Finally, the
Commission expressed concerns that the integration of the companies
created by the pool could lead to potential violations of the Standards
of Conduct and hence the obligation to provide transmission service on
a nondiscriminatory basis.\17\ Together, these concerns form the basis
for the conditions and modifications the Commission imposed on Southern
Company that is the subject of this audit.
---------------------------------------------------------------------------

    \12\ Settlement Order, 117 FERC ] 61,021 at P 31.
    \13\ Id. at P 38.
    \14\ Id.
    \15\ Id. at P 43.
    \16\ Id. at P 47.
    \17\ Id. at P 51.
---------------------------------------------------------------------------

    The proceeding in Docket No. EL05-102-000 began on May 5, 2005,
when the Commission instituted an investigation to determine whether
the role of Southern Power in Southern Company's pool continued to be
appropriate and consistent with the Commission's regulations and
precedents regarding affiliate abuse.\18\ Specifically, the Commission
set for hearing the following issues: (1) The justness and
reasonableness of the IIC, including the justness and reasonableness of
Southern Power's inclusion in the pool and whether such inclusion
involves undue preference and undue discrimination that adversely
affected wholesale competition and wholesale customers in the
Southeast; (2) whether any of the Southern Operating Companies had
violated or were violating the Commission's Standards of Conduct which
were in effect at the time; and (3) whether the Southern Operating
Companies' Code of Conduct was just and reasonable and whether the Code
of Conduct should continue to define Southern Power as a ``system
company.''
---------------------------------------------------------------------------

    \18\ Southern Company Services, Inc., 111 FERC ] 61,146 (Hearing
Order), clarified, 112 FERC ] 61,015 (2005).
---------------------------------------------------------------------------

    On April 11, 2006, Southern Company Services, Inc., on behalf of
the Southern Operating Companies, filed the Settlement Offer to resolve
the regulatory proceedings in Docket No. EL05-102 and other related
proceedings. The purpose of the Settlement Offer was to resolve all
allegations that the IIC and certain other aspects of the Southern
Operating Companies' structure and operations provided Southern Power
with an undue preference over non-affiliated power suppliers. The
Settlement Offer also encompassed other measures that the Southern
Operating Companies were planning to implement in response to
allegations that their operations improperly favored affiliates. On
October 5, 2006, the Commission issued its Settlement Order, which
accepted in part and rejected in part the Settlement Offer.\19\ The
Commission explained that the Settlement Offer did not adequately
protect customers against affiliate abuse. As a result, the Commission
ordered the Southern Operating Companies to make significant changes to
the Settlement relating to the IIC, Separation Protocol, and GSS
Tariff, to adequately protect customers from affiliate abuse in the
sale of wholesale power and the provision of transmission service. In
the Settlement Order, the Commission directed the OE to conduct an
audit of Southern Power and its regulated Operating Company affiliates.
Further, the Commission advised that it will notice the audit report
for comment and after considering the comments on it, determine what
further action is appropriate.\20\ Moreover, the Commission stated that
if affiliate abuse concerns remained, it will either set such concerns
for hearing or require further changes immediately. Lastly, the
Commission advised that it would keep the section 206 investigation
open until receiving the audit, any public comments on it, and
determine what further action is appropriate in this docket.
---------------------------------------------------------------------------

    \19\ Settlement Order at P 3.
    \20\ Settlement Order at P 60.
---------------------------------------------------------------------------

    On November 6, 2006, Southern Company Services, Inc., acting as
agent for the Southern Operating Companies, submitted a modified
compliance filing, as directed by the Settlement Order. The compliance
filing included the required amendments to the IIC, Separation
Protocol, and GSS Tariff, as well as a projected implementation
schedule outlining the actions taken to date and the expected timeframe
for implementing the Separation Protocol over a seven-month period. On
April 19, 2007, the Commission issued an Acceptance Order, which
accepted the modified compliance filing and projected implementation
schedule, but directed a further compliance filing be made.\21\ On May
18, 2007, Southern Company Services, Inc. filed a revised compliance
filing in Docket No. EL05-102-003, as directed by the Commission in its
Acceptance Order. The Commission accepted, by delegated authority, this
revised compliance filing with minor modifications on July 16,
2007.\22\ On August 13, 2007, Southern Company Services, Inc. filed
these minor modifications in Docket No. EL05-102-004, which the
Commission accepted by delegated authority on September 12, 2007.\23\
---------------------------------------------------------------------------

    \21\ Acceptance Order, at P. 2.
    \22\ Southern Company Services, Inc., Docket No. EL05-102-003
(July 16, 2007) (unpublished letter order).
    \23\ Southern Company Services, Inc., Docket No. EL05-102-004
(September 12, 2007) (unpublished letter order).
---------------------------------------------------------------------------

    On November 16, 2007, Southern Company Services, Inc. filed, on
behalf of the Southern Operating Companies, a Notice of Completion and
Conformed Compliance Filing in connection with the Settlement and
Acceptance Orders. The Southern Operating Companies stated that the
implementation of the requirements set forth in the Settlement and
Acceptance Orders was complete. Moreover, the Southern Operating
Companies submitted an effective conformed version of the Separations
Protocol. The filing also conformed the definition of ``market
information'' used in the Separation Protocol and IIC to the definition
of that term established by the Commission in Order No. 697.\24\ The
Southern Operating Companies requested that the Commission accept the
Order No. 697 conformed rates for filing.\25\ The Southern Operating
Companies later determined that the November 16, 2007 filing should not
have included the section 205 request that the definition of ``market
information'' established by the Commission in Order No. 697 apply to
that same term as used in the Southern Operating Companies' Separation
Protocol. Accordingly, on December 4, 2007, the Southern Operating
Companies amended its Notice of Completion filing to remove the section

205 aspect of its submission. On January 11, 2008, the Commission, by
delegated authority, accepted the Southern Operating Companies' Notice
of Completion and the Separation Protocol with an effective date of
November 19, 2007.\26\
---------------------------------------------------------------------------

    \24\ Market-Based Rates for Wholesale Sales of Electric Energy,
Capacity and Ancillary Services by Public Utilities, Order No. 697,
FERC Stats. & Regs. ] 31,252, clarified, 121 FERC ] 61,260 (2007),
order on reh'g, Order No. 697-A, 73 Fed. Reg. 25,832 (May 7, 2008),
FERC Stats. & Regs. ] 31,268 (2008).
    \25\ Southern Company Services' November 16, 2007 transmittal
letter, page 1.
    \26\ Southern Company Services, Inc., Docket Nos. EL05-102-005
and EL05-102-006 (January 11, 2008) (unpublished letter orders).
---------------------------------------------------------------------------

    On November 19, 2007, OE commenced the audit of the Southern
Operating Companies in Docket No. PA08-6-000.

D. Summary of Compliance Findings

    Although audit staff determined that the Southern Operating
Companies generally complied with the conditions in the Settlement and
Acceptance Orders, audit staff identified three areas where the
Southern Operating Companies should strengthen and further its
compliance measures related to electronic separation, employee
separation, and posting of Separation Protocol violations on OASIS.\27\
Below is a summary of audit staff's compliance findings. A more
detailed discussion of audit staff's compliance findings is included in
section IV.
---------------------------------------------------------------------------

    \27\ The time frame for the audit covers a period prior to the
effective date of Order No. 717. Therefore, the audit measures
compliance with then-existing regulations. The Commission recently
changed certain posting requirements for Standards of Conduct
regulations (see Standards of Conduct for Transmission Providers,
Order No. 717, 125 FERC ] 61,064 (2008).
---------------------------------------------------------------------------

     Electronic Separation--Although Southern Company
implemented electronic controls to prevent Southern Power employees
from accessing non-public market information, audit staff detected some
gaps in the controls that potentially provided Southern Power employees
with access to non-public market information. Specifically, a Southern
Power employee was able to breach Southern Company's network access
restrictions through a non-Southern Power computer workstation and the
wireless network. Additionally, Southern Company did not have adequate
procedures in place to review for non-public market information
available through: (1) Personal network drives of employees who
transferred jobs and (2) files transferred to shared network drives by
non-Southern Power employees.
     Employee Separation--Audit staff observed an employee
performing transmission activities that support the long-term wholesale
energy transactions of Southern Power, while at the same time
performing transmission and energy trading activities that support the
short-term wholesale energy transactions made by the pool on behalf of
the Southern Operating Companies. Audit staff believes that Southern
Company should dedicate separate employees to perform the transmission
activities supporting Southern Power's long-term wholesale energy
transactions and the transmission activities supporting the short-term
wholesale energy transactions made for the pool on behalf of the
Southern Operating Companies to prevent the potential for any undue
preference.
     Posting of Separation Protocol Violations on OASIS--
Southern Company did not immediately post, date, and time stamp all the
postings it made to OASIS in accordance with the Commission's Standards
of Conduct requirements in effect during the audit period.

E. Summary of Recommendations and Corrective Actions Taken

    Audit staff provides the following recommendations to ensure
adequate corrective actions are taken by Southern Company to address
the remaining opportunities for potential affiliate abuse under the IIC
related to Southern Power.
     Create procedures for reviewing files posted to Southern
Power shared drives by non-Southern Power employees for non-public
market information. Additionally, create procedures for reviewing the
personal network drives of all employees who transfer into Southern
Power for non-public market information. For each review, remove all
files that contain non-public market information from the personal
network drive of the transferred employee.
    On November 14, 2008, Southern Company implemented new policies
governing the monitoring and review of Southern Power shared drives and
the personnel network drives of employees transferring into Southern
Power.
     Perform periodic reviews to ensure that Southern Power
employees do not have access rights to applications, databases, and
shared network drives containing non-public market information.
Additionally, these periodic reviews should include testing of the
segmented network to determine whether Southern Power employees can
bypass the segmented network and potentially access non-public market
information.
    On November 14, 2008, Southern Company implemented new procedures
requiring a periodic review of Southern Power shared drives and
periodic testing of the segmented network.
     Add the ``SPC'' designator to Southern Power employee
names in Cool Compliance, as is already done in the Global Address List
for e-mails, to spotlight a Southern Power employee having access
rights granted in Cool Compliance.\28\
---------------------------------------------------------------------------

    \28\ Cool Compliance is a computer application originally
created to maintain Sarbanes-Oxley controls, which Southern Company
also adopted as a tool to provide a consistent automated process for
evaluating and managing access requests.
---------------------------------------------------------------------------

    On November 10, 2008, Southern Company informed audit staff that it
will identify and label all Southern Power employees in Cool
Compliance. However, Southern Company did not provide an implementation
date.
     Dedicate employees performing transmission activities that
support Southern Power's long-term wholesale energy transactions solely
to Southern Power.
    On November 7, 2008, Southern Company informed audit staff that it
transferred the responsibilities associated with the procurement of
transmission service for Southern Power's long-term wholesale energy
transactions to Southern Power.
     Post all violations of the Separation Protocol
immediately, in accordance with the Standards of Conduct at 18 CFR
358.5(b)(3). In addition to the date the violation occurred, include on
each document the date and time Southern Company posted the violation
in accordance with the OASIS regulations at 18 CFR 37.6(g)(2).
    On November 14, 2008, Southern Company revised its Separation
Protocol Violations Investigative Procedure to reflect that upon
determining an actual violation has occurred, the incident must
immediately be posted on OASIS. Further, Southern Company implemented a
procedural change to include a date and time stamp for each document
posted on OASIS relating to the violation.
     Strengthen procedures and controls for maintaining e-mail
distribution lists and providing reports to Southern Power that may
contain non-public market information. Incorporate these procedures and
other pertinent procedural enhancements in the Separation Protocol
compliance training program to achieve a reduction in the number of
future violations.
    On November 14, 2008, Southern Company implemented new procedures
requiring employees to maintain and periodically review their e-mail
distribution lists to verify employee memberships. Further, Southern
Company revised its Separation Protocol training regarding electronic
communications with Southern Power employees and the development and
maintenance of e-mail distribution lists.

II. Southern Company's Compliance With Commission Orders

    The Southern Operating Companies' efforts to comply with the
Settlement and Acceptance Orders included the following activities: (1)
Tariff modifications filed with the Commission; (2) functional
separation through organizational restructuring, relocation of
employees and infrastructure changes; (3) electronic access controls
(information technology); (4) training of employees; and (5) a
compliance filing to conform to the definition of ``market
information'' used in the Separation Protocol and IIC to the definition
of that term established by the Commission in Order No. 697. Further,
the Southern Operating Companies expended almost $20 million to
implement the modifications required by the Commission's Settlement and
Acceptance Orders. In addition, the Southern Operating Companies
anticipate there will be on-going costs for compliance, including the
purchasing of equipment, additional staffing, training, and other costs
that are difficult to quantify at this time.

Tariff Modifications

    Subsequent to the issuance of the Settlement Order, the Southern
Operating Companies made several compliance filings, which the
Commission has approved, that changed the tariff language of the IIC,
Separation Protocol, and GSS Tariff to comply with the Commission's
Settlement and Acceptance Orders.\29\ The IIC changes pertained to
sales between the Southern Operating Companies that were outside the
pool operating window, but less than a year in length, opportunity
sales made on behalf of the pool members, Southern Power taking
transmission service under the OATT, Southern Power as an Energy
Affiliate under the Standards of Conduct in effect at the time, and
defining ``market information'' consistently with Order No. 697.
---------------------------------------------------------------------------

    \29\ Southern Company Services, Inc., Docket No. EL05-102-003
(July 16, 2007) (unpublished letter order); Southern Company
Services, Inc., Docket No. EL05-102-004 (September 12, 2007)
(unpublished letter order), Southern Company Services, Inc., Docket
Nos. EL05-102-005 and EL05-102-006 (January 11, 2008) (unpublished
letter order).
---------------------------------------------------------------------------

    The Separation Protocol changes pertained to broadening the
separated functions responsibilities to any function undertaken for the
benefit of Southern Power's shareholders (except joint economic
dispatch and reserve sharing), prohibiting the sharing of any
information, protecting against preferential treatment in regard to the
purchase or sale of transmission service or electric energy between the
Southern Operating Companies, and the pricing of non-power goods and
services. The GSS tariff changes pertained to filing the GSS tariff
with the Commission to provide all similarly situated merchant
generators access to back-up power by the Southern Operating Companies,
and requiring the just and reasonable standard, as opposed to the
public interest standard, to govern all revisions to the GSS tariff.
The Commission accepted all of these modifications to the IIC,
Separation Protocol, and GSS tariff.

Functional Separation

    In addition to the tariff filings, the Southern Operating Companies
made several organizational and structural changes to comply with the
Settlement and Acceptance Orders. The Southern Operating Companies
began to evaluate the measures necessary to comply with the Settlement
Order in late 2006 and, after the Commission issued the Acceptance
Order in April 2007, initiated the compliance effort. Based on the
schedule accepted by the Commission, the Southern Operating Companies
were afforded seven months to complete the functional separation of
Southern Power, implement the required information sharing
restrictions, and provide Separation Protocol training to its
employees.
    Southern Company evaluated its corporate structure and made various
organizational changes. To functionally separate Southern Power's
wholesale activities from the other Southern Operating Companies,
Southern Company created Southern Wholesale Energy and Southern Power
as divisions within Southern Company Services, Inc. Southern Wholesale
Energy, a business unit within Southern Company Services, Inc. performs
all of the bilateral, long-term wholesale activities of the Southern
Operating Companies, with the exception of Southern Power. Southern
Power, as subsidiary of Southern Company performs wholesale activities
including asset management and trading, market analysis and structure,
generation development, and asset acquisition on behalf of its
shareholders. Southern Power also created its own finance, accounting,
budgeting, and compliance groups separate from the other Southern
Operating Companies. In addition, Southern Power established separate
officer positions, including President, Chief Commercial Officer,
Senior Production Officer, Chief Financial Officer, and Compliance
Officer.
    Southern Company reviewed its physical facilities and, as a result,
relocated employees, made changes to its electronic infrastructure, and
implemented physical access controls. Southern Company relocated 65
Southern Power employees and 90 other Southern Operating Companies
employees within the Birmingham, Alabama, and Atlanta, Georgia, offices
as a result of functionally separating Southern Power from the other
Southern Operating Companies. In Birmingham, Southern Company
physically separated employees solely dedicated to Southern Power to a
separate floor and developed Southern Power's own trading floor.
Southern Power's separate floor contains its asset management and
trading, market analysis and structure, generation development, and
asset acquisition functions. Southern Power installed electronic card
key access controls on this separate floor to provide access only to
employees solely dedicated to Southern Power. Southern Company also
implemented electronic card key access controls to restrict Southern
Power employees' access to non-public market information in other areas
of the building where the other Southern Operating Companies perform
operating and trading activities. Further, Southern Company instituted
sign-in procedures for all non-authorized visitors in these areas to
provide extra protection. Southern Company included these same
protections in its Atlanta facilities and the generating plants owned
and operated by Southern Power.

Electronic Access Controls

    Southern Company conducted an extensive review of its computer and
e-mail systems, business software applications and databases, and
intranet sites to establish controls that prevent Southern Power
employees from having electronic access to or receiving non-public
market information from the other Southern Operating Companies. As a
result of this review, Southern Company installed a segmented network
to comply with the electronic separation requirements ordered by the
Commission's Settlement and Acceptance Orders. The segmented network
allows Southern Power to coexist on the same information technology
infrastructure as the rest of Southern Company, yet at the same time
precludes Southern Power from obtaining non-public market information
electronically. Southern Company also created separate intranet Web
sites for Southern Power and the other Southern Operating Companies to
ease the burden of electronic separation

and Southern Power's restriction to non-public market information.
Further, all shared drives that contain non-public market information
are electronically protected and restrict Southern Power employees'
access. In addition to these protective measures, Southern Company
added an ``SPC'' notation next to the e-mail addresses of Southern
Power employees to clearly distinguish them from non-Southern Power
employees and avoid the inadvertent exchange of non-public market
information.

Employee Training

    Southern Company informed audit staff that the Southern Operating
Companies provided the Separation Protocol training required by the
Commission's Settlement Order to over 15,000 employees. This training
educated employees on functional separation requirements, physical
separation requirements, ``prohibited information'' definitions,
electronic access requirements, no conduit rules, and violation
reporting instructions. The type of training provided (instructor-led
or on-line) was based on the priority level of employees. Employees in
the high priority level included employees of Southern Power,
generation employees, transmission employees, shared support service
employees and corporate officers of the other Southern Operating
Companies responsible for these areas. These high priority level
employees received instructor-led training while others participated in
an on-line training program. Continued education and training on the
Separation Protocol is provided on an annual basis. Additionally,
training materials for the Separation Protocol are available on the
intranets of both Southern Company and Southern Power.

Order No. 697 Compliance Filing

    In the Acceptance Order, the Commission directed Southern Company
Services, Inc. to revise its Separation Protocol and IIC to prohibit
the sharing of any market information, whether or not such information
is public.\30\ Subsequent to the Acceptance Order, the Commission
issued Order No. 697, which, among other things, codified a new
definition of ``market information.'' Pursuant to the Commission's
regulations, ``market information'' means non-public information
related to the electric energy and power business including, but not
limited to, information regarding sales, cost of production, generator
outages, generator heat rates, unconsummated transactions, and
historical generator volumes. Market information includes information
from either affiliates or non-affiliates.\31\ This new definition not
only provides greater specificity regarding the type of information
falling within its scope, but also limits its application to non-public
information.
---------------------------------------------------------------------------

    \30\ Acceptance Order at P 26.
    \31\ 18 CFR 35.36(a)(8).
---------------------------------------------------------------------------

    On December 4, 2007, Southern Company Services, Inc., on behalf of
the Southern Operating Companies, made a section 205 filing in Docket
No. ER08-298-000 to conform the definition of ``market information'' as
used in the Separation Protocol and the IIC to the definition of that
term established in Order No. 697. On January 11, 2008, the Commission
accepted the filing.\32\
---------------------------------------------------------------------------

    \32\ See Southern Company Services, Inc., Docket No. ER08-298-
000 (January 11, 2008) (unpublished letter order).
---------------------------------------------------------------------------

Standards of Conduct Compliance

    In the Settlement Order, the Commission directed Southern Operating
Companies to revise section 4.4 of the IIC to make clear that the IIC
is not to serve as a means whereby transmission information is shared
in a manner contrary to the Commission's Standards of Conduct.\33\ The
Settlement Order also required revision of section 4.4 of the IIC to
make clear that Southern Power is treated as an Energy Affiliate under
the Standards of Conduct and therefore cannot receive any nonpublic
transmission information. \34\
---------------------------------------------------------------------------

    \33\ Settlement Order, at P 55.
    \34\ The Commission recently eliminated the concept of ``energy
affiliate'' from the Standards of Conduct regulations (see Standards
of Conduct for Transmission Providers, Order No. 717, 125 FERC ]
61,064 (2008).
---------------------------------------------------------------------------

    While the Commission recently revised its Standards of Conduct
regulations, the fundamental principle prohibiting a transmission
provider's transmission function employees from disclosing nonpublic
transmission information (which includes customer information) to
marketing function employees is retained. The revisions do not affect
either Southern Operating Company's compliance with the recommendations
regarding shared employees or the information restrictions discussed
herein. We also note that the Southern Operating Companies are subject
to restrictions similar to those in the Standards of Conduct
regulations based on its market-based rate authority.\35\ In addition
to restricting information sharing between a franchised public utility
with captive customers and a market-regulated power sales affiliate,
those rules contain separation of function requirements and a no
conduit provision.
---------------------------------------------------------------------------

    \35\ 18 CFR 35.39 (2008).
---------------------------------------------------------------------------

Introduction

A. Objectives

    The primary objective of the audit was to determine whether the
Southern Operating Companies fully complied with the conditions and
modifications imposed by the Commission in its Settlement and
Acceptance Orders. The audit also evaluated whether the conditions and
modifications set forth in both orders are sufficient to address any
remaining opportunities for affiliate abuse related to Southern Power
under the IIC. The audit covered the period from November 19, 2007
through August 29, 2008.

B. Scope and Methodology

    Audit staff conducted a series of reviews prior to the commencement
of the audit to gain an understanding of Southern Company's corporate
environment, and state and federal regulatory affairs. Audit staff also
monitored the implementation of the modifications imposed upon the
Southern Operating Companies by the Commission in Docket No. EL05-102-
000 through a series of phone conferences and compliance filing
reviews. The audit activities conducted included:
     Corporate Review--Audit staff conducted a corporate review
prior to the commencement of the audit to obtain a preliminary
understanding of Southern Company's corporate structure, system design
and operations, and market and financial activities. Audit staff
reviewed publicly available materials and references including Southern
Company's: OASIS and corporate Web sites; Federal Energy Regulatory
Commission (FERC) Electric Quarterly Reports (EQR); FERC Forms No. 1,
60, and 714; IIC Annual Informational Filing; Securities and Exchange
Commission (SEC) Forms 8-K, 10-Q, and 10-K; annual stockholder reports;
various industry Web sites; and trade press releases.
     Internal Auditor and External Accountant Review--Audit
staff reviewed relevant audit reports and workpapers of the Southern
Companies' internal audit department and external audit firm, Deloitte
& Touche LLP. The audit staff also reviewed the prior SEC audit report
relating to service company costs and revenue allocations.
     Federal Regulatory Review--Audit staff reviewed numerous
company filings and Commission orders to obtain

an understanding of the issues involved in the audit, including: Docket
Nos. EL05-102, EL05-104, and ER03-713; market-based rate tariffs and
authorizations, including Docket Nos. ER95-1468, ER96-780, ER00-1655,
ER03-3240, ER01-1633, and ER03-1383; and various dockets authorizing
Southern Power to sell power to Alabama Power and Georgia Power.
Additionally, audit staff reviewed company filings and orders relating
to Southern Company's OATT and Order No. 697 compliance filings.
     State Regulatory Review--Audit staff performed a
comprehensive review of each State Commission's (Georgia, Alabama,
Mississippi, and Florida) Web site to obtain an understanding of their
oversight responsibilities and regulatory involvement with Southern
Company. Additionally, audit staff conducted phone conferences with
staff at each State Commission to establish points of contact for the
audit and to discuss its past regulatory review of Southern Company. In
particular, audit staff inquired about each State Commission's
compliance audits related to affiliated transactions and cross-
subsidization, their understanding and review of the terms and
conditions of the IIC and related billing process, and their
involvement in solicitation of competitive bids for generation
suppliers.
     Monitoring of Compliance Implementation--To ensure that
Southern Company adhered to the Commission-approved compliance
implementation schedule, audit staff monitored Southern Company's
progress prior to the audit. Specifically, audit staff reviewed
compliance filings made with the Commission by Southern Company
Services, Inc. on behalf of the Southern Operating Companies. Further,
audit staff held three phone conferences with Southern Company
regarding the status and completion of its projected compliance
implementation plan before the commencement of the audit on November
19, 2007.
    Audit staff also reviewed specific areas related to the objectives
of the audit and conducted testing in those areas to evaluate the
Southern Operating Companies' compliance with the conditions imposed by
the Settlement and Acceptance Orders, and whether those conditions were
sufficient to address any remaining opportunities for affiliate abuse
by Southern Power under the IIC. Audit staff held regular conference
calls and formal meetings with Southern Company, and performed three
site visits at Southern Company's facilities in Birmingham, Alabama,
and one site visit in Atlanta, Georgia. Further, audit staff issued
nearly two hundred data requests to obtain information for review and
testing purposes, and to collect evidence to support its conclusions.
The specific areas audit staff reviewed and tested include the
Separation Protocol, wholesale sales, transmission, and GSS tariff.
     Separation Protocol--Audit staff conducted multiple tests
to evaluate the Southern Operating Companies' compliance with the
conditions imposed by the Commission and remaining opportunities for
affiliate abuse relating to the separation of functions and employee
workspace, restriction of non-public market information, separation
protocol training, and sale of non-power goods and services.
Specifically, audit staff:
    [cir] Reviewed Southern Company's organizational structure and
conducted interviews with several employees to ensure that Southern
Company functionally separated all wholesale activities carried out for
the sole benefit of Southern Power shareholders, including its trading
activities by the other Southern Operating Companies.
    [cir] Toured and inspected Southern Power and other facilities in
Birmingham, Alabama, and Atlanta, Georgia, to ensure that the workspace
of all employees conducting separated functions of Southern Power were
separated from the workspace of the other Southern Operating Companies.
    [cir] Inspected the physical and electronic information security
restrictions in place and tested the information system processes and
controls in place at the network, application, and workstation level to
ensure non-public market information is protected from employees
conducting the separated functions of Southern Power.
    [cir] Reviewed various physical and electronic means by which
Southern Power could access or receive non-public market information
from the other Southern Operating Companies to ensure they did not
violate the Separation Protocol. The various means inspected included:
employee e-mails and voice recordings; access to shared drives and
databases containing non-public market information; electronic card key
access permissions at facilities containing non-public market
information; records of joint meetings between Southern Power and other
Southern Operating Companies; and visitor sign-in logs at facilities
containing non-public market information. Further, audit staff
conducted interviews with employees who conduct separated functions for
Southern Power and interviews with employees performing pool operations
and trading as a secondary level of testing.
    [cir] Reviewed the training program Southern Company developed to
educate employees affected by the Separation Protocol to assess its
adequacy and completeness. Audit staff also interviewed compliance
officers involved with providing training and employees receiving
training to assess their knowledge and understanding of the Separation
Protocol. As part of this testing, audit staff reviewed the processes
in place for detecting and investigating potential violations of the
Separation Protocol, and procedures for posting actual violations of
the Separation Protocol on OASIS.
    [cir] Reviewed the allocation methodologies and pricing for non-
power goods and services provided and purchased amongst Southern
Company Services, Inc., Southern Power, and the other Southern
Operating Companies, to determine whether such allocation methodologies
and pricing were consistent with the Separation Protocol and did not
result in subsidization. Audit staff reviewed all service agreements in
effect that provide for non-power goods and services to identify the
types of non-power goods and services provided and purchased amongst
Southern Company Services, Inc. and the Southern Operating Companies,
and the pricing for such non-power goods and services. Audit staff also
reviewed the methods used to allocate cost amongst the Southern
Operating Companies.
    [cir] Wholesale Sales--Audit staff conducted several tests to
evaluate the Southern Operating Companies' compliance with the
conditions imposed by the Commission and remaining opportunities for
affiliate abuse relating to wholesale sales, including the IIC
provisions for: reserve sharing and generation expansion plans; sales
between the Southern Operating Companies; and wholesale sales to third
parties. Specifically, audit staff:
    [cir] Conducted group discussions and interviews with operational,
trading, and shared employees to obtain an in-depth knowledge and
understanding of the provisions of the IIC and the operation of
Southern Company's integrated system. Further, audit staff reviewed
business practices and procedures, observed operational and trading
activities, and reviewed transactional and other business data to
determine how to apply these provisions for testing compliance.

    [cir] Reviewed Southern Company's annual IIC informational filing,
conducted employee interviews, and analyzed data to determine how the
Southern Operating Companies derived recognized capacity for the
reserve sharing calculation. As part of the data analysis, audit staff
reviewed expansion plans to verify Southern Power did not automatically
include new capacity resources in the reserve sharing calculation as
recognized capacity that was not part of the coordinated planning
process. Further, audit staff analyzed reserve sharing calculations and
billings to verify the payments to and receipts from the Southern
Operating Companies for reserve sharing were in accordance with the
provisions of the IIC.
    [cir] Analyzed transactions, billings, and other documents to
validate the payments to and receipts from the pool for interchange
energy and opportunity interchange energy were in accordance with the
provisions of the IIC. Audit staff reviewed pool interchange energy
sale transactions between the Southern Operating Companies to validate
the charges were based upon the variable costs of the generating
resource supplying the interchange energy. Audit staff also reviewed
pool opportunity interchange energy sales transactions to verify the
Southern Operating Companies received revenues based upon approved peak
period load ratios and paid costs based upon the variable dispatch
costs.
    [cir] Reviewed regulatory filings to determine whether the
Commission approved any sales between the Southern Operating Companies
outside the pool operating window for the periods of less than one year
and greater than one year. Audit staff also analyzed transactional data
and conducted employee interviews to independently assess whether any
sales between the Southern Operating Companies occurred outside the
pool operating window without prior Commission approval.
    [cir] Analyzed transactional data and other supporting documents to
verify Southern Power made all of its wholesale sales outside the pool
operating window using its own generating capacity. Audit staff also
interviewed Southern Operating Companies' employees to assess the
adequacy of procedures and controls in place for ensuring all of
Southern Power's wholesale sales occur outside the pool operating
window and that Southern Power has available capacity from its own
generating resources to support these wholesale sales.
    [cir] Reviewed the Southern Operating Companies' coordinated
planning process to verify Southern Power independently developed its
generation expansion plans and did not participate in reviewing and
recommending the generation expansion plans of the other Southern
Operating Companies. Further, audit staff reviewed e-mails and
interviewed the Southern Power Senior Production Officer on the
Operating Committee to ensure Southern Power did not receive non-public
market information from other Operating Committee members.
    [cir] Transmission--Audit staff conducted several tests to evaluate
the Southern Operating Companies' compliance with the conditions
imposed by the Commission and remaining opportunities for affiliate
abuse relating to the Southern Operating Companies' access to non-
public transmission information and Southern Power's adherence to the
terms and conditions of the OATT and treatment as an Energy Affiliate
under the Standards of Conduct. Specifically, audit staff:
    [cir] Conducted interviews with Southern Company transmission
function managers and employees to understand the physical aspects and
operations of Southern Company's electric transmission system.
    [cir] Reviewed corporate organizational charts and employee job
descriptions to assess the functional separation of Southern Power and
other marketing functions from the transmission function.
    [cir] Reviewed all transmission services provided to each of the
Southern Operating Companies by Southern Company's transmission
function and then analyzed transmission service agreements,
reservations, schedules, and billing statements to validate that
Southern Power adhered to the terms and conditions of the OATT.
    [cir] Reviewed various physical and electronic means for Southern
Power and other employees performing marketing activities to access or
receive non-public transmission information to ensure that they did not
violate the Commission's Standards of Conduct regulations in effect
during the audit period. The various means inspected included: employee
e-mails and voice recordings; marketing employees' access to shared
drives and transmission databases; transmission facilities' electronic
card key access permissions; records of joint meetings between
transmission and marketing function employees; and records for visitor
sign-in logs at the operating control center. Audit staff also
conducted interviews with personnel who work in separated functions for
Southern Power and interviews with employees performing pool operations
and trading as a secondary level of testing.
    [cir] Reviewed OASIS to determine whether the Southern Operating
Companies made required postings in accordance with the Standards of
Conduct as in effect at the time.
    [cir] GSS Tariff--Audit staff conducted testing to evaluate the
Southern Operating Companies' compliance with the conditions imposed by
the Commission and remaining opportunities for affiliate abuse relating
to similarly-situated merchant generators' access to back-up power.
Audit staff reviewed all filings made by Southern Company Services,
Inc. to validate that Southern Company complied with the Commission's
order to file a GSS tariff that offered all similarly-situated merchant
generators access to back-up power. Audit staff issued data requests
and conducted interviews to assess the internal processes and
procedures related to the administration of the GSS tariff. Audit staff
also used these data requests and interviews to verify whether any
scheduling entity requested service under the GSS tariff, and to
determine whether any scheduling entity was improperly denied service
under the GSS tariff.

III. Findings and Recommendations

1. Electronic Separation

    Although Southern Company implemented electronic controls to
prevent Southern Power employees from accessing non-public market
information, audit staff detected gaps that could have potentially
provided Southern Power employees with access to non-public market
information. Specifically, as part of our audit testing, a Southern
Power employee was able to breach Southern Company's network access
protections through a non-Southern Power computer workstation and the
wireless network.
    Additionally, Southern Company did not have adequate procedures in
place to review: (1) Personal network drives that may contain non-
public market information when employees transferred jobs and (2) files
transferred to shared network drives by non-Southern Power employees
for non-public market information.
Pertinent Guidance
    The Commission's Settlement Order required the Southern Operating
Companies to ``adopt a clear separation of functions, including
restrictions on

information sharing,'' for transactions benefitting Southern Power's
shareholders. The Settlement Order also required Southern to make clear
that Southern Power is to be treated as an Energy Affiliate under the
Standards of Conduct and therefore cannot receive any nonpublic
transmission information.\36\ In response to implementing these
modifications, Southern Company included language in its Separation
Protocol to protect against the electronic sharing of non-public market
information. Specifically, the Separation Protocol applicable to
Southern Power states in paragraph no. 4:
---------------------------------------------------------------------------

    \36\ Settlement Order at P. 3.

    Prohibited information will be electronically protected from
employees conducting the separated functions of Southern Power
through restricted access to any shared drive that includes such
information. Access to these shared drives by employees conducting
the separated functions of Southern Power will require pre-approval
under an authorization process administered by the Southern Company
Generation Compliance Officer.

Background

    Southern Company conducted a comprehensive review of its computer
network environment, business software applications and databases,
intranet Web sites, and other computer related systems to ensure it had
adequate controls in place to restrict Southern Power employees from
having electronic access to non-public market information. Southern
Company implemented a segmented network as its overarching control to
comply with the electronic separation and information sharing
requirements set forth in the Commission's Settlement Order. The
segmented network allows Southern Power to co-exist on the same
information technology infrastructure as the rest of Southern Company,
yet at the same time is designed to preclude Southern Power from
electronically accessing non-public market information. The
implementation of the segmented network and other computer
infrastructure related changes required extensive employee hours and
cost approximately $1.3 million.
    The compliance measures taken by Southern Company required re-
engineering of its existing computer infrastructure with the
implementation of a segmented network. Audit staff's review of the
segmented network determined that it is an effective first line of
defense in electronically protecting Southern Power employees' access
to non-public market information. However, audit staff's testing of
Southern Company's electronic separation control environment for the
segmented network detected some minor weaknesses that could have
potentially provided Southern Power employee's access to non-public
market information through personal employee computers workstations and
the wireless network had they been left unresolved.
    Further, Southern Company did not have adequate procedures in place
to review for non-public market information: (1) personal network
drives when employees transferred jobs and (2) files transferred to
shared network drives by non-Southern Power employees.

Segmented Network

    The segmented network was achieved by installing dedicated computer
infrastructure, such as dedicated servers, switches and firewalls, and
by implementing automated rules with Microsoft's Active Directory and
Group Policy within the infrastructure to electronically separate
Southern Power from the remainder of Southern Company and to control
access to non-public market information. Southern Company's segmented
network is an effective first line of defense in electronically
protecting non-public market information from Southern Power employees.
    The segmented network is ultimately controlled through Microsoft's
Active Directory and relies on an internally designed set of scripts to
ensure that Southern Power employees cannot access non-public market
information. The scripts, known as the Validator program, ensure that
three conditions are met before allowing Southern Power employees
electronic access: the employee must be a member of the restricted user
group, the workstation must be a member of the restricted workstation
group, and the location must be a restricted site. If any of these
three conditions is not met, the Validator program should shut down the
workstation for Southern Power employees.
    Audit staff conducted testing at non-Southern Power computer
workstations to determine whether the segmented network controls
adequately blocked Southern Power employees' access to restricted areas
containing non-public market information. One test confirmed that the
segmented network successfully blocked a Southern Power employee from
gaining access to the protected segmented network using a non-Southern
Power computer workstation located in an employee's office. However,
the other test detected that the segmented network could be breached by
a Southern Power employee through the use of a non-Southern Power
computer workstation located in a non-Southern Power conference room.
In comparing the two different outcomes, Southern Company explained
that the Southern Power employee successfully logged onto the
conference room computer workstation because it resided on the SOCOGEN
network.
    Upon discovery, Southern Company took immediate action to resolve
the conference room workstation breach. Southern Company explained that
most of the workstations on the SOCOGEN network are in secure areas to
which Southern Power employees do not have access privileges.
Therefore, Southern Company believed it was not necessary to implement
the ``deny access'' log-on controls applied to Southern Power employees
on the SOCOGEN network. Rather than applying the ``deny access'' log-on
controls to these conference room workstations, Southern Company
addressed this breach by applying the log-on restrictions across the
entire SOCOGEN network, in case there were additional SOCOGEN
workstations in non-secure areas of the building. Had this problem been
left uncorrected, this breach could have potentially provided a
Southern Power employee access to non-public market information.

Wireless Network

    Southern Company implemented a separate wireless network for
Southern Power in order to restrict access to non-public market
information. Southern Power employees should be capable of accessing
only the Southern Power wireless network, placing them behind Southern
Power's dedicated firewalls and subjecting them to all of the rules
applied to a Southern Power workstation connected to the network
through wired access. Southern Company's other employees can connect to
the ``Office wireless network.'' Southern Power employees should not be
able to connect to the Office wireless network.
    Audit staff's testing of the wireless network from a Southern Power
laptop computer revealed that the employee using a Southern Power
restricted workstation was able to connect to the Office wireless
network. Essentially, by successfully connecting to Southern Company's
Office wireless network, a Southern Power employee was able to bypass
the segmented network. This connection potentially allowed the Southern
Power employee access to non-public market information. According to
Southern Company, some users had Active Directory permission

inadvertently enabled on their laptop computers for remote access. This
permission superseded the Active Directory ``deny access''
configuration applied to all Southern Power users for the Office
wireless network. To correct this issue, Southern Company modified the
configuration to ignore this Active Directory property for remote
access, removing the conflict in permissions. Audit staff's re-testing
of the wireless network demonstrated that the system did not allow the
Southern Power employee connection.

Employee Computer Workstations

    Audit staff conducted testing of Southern Power employee computer
workstations to determine whether they could access non-public market
information through personal network drives, shared network drives, and
applications and databases. Audit staff's testing did not detect any
evidence that Southern Power employees accessed or received non-public
market information through its personal computer workstations. However,
audit staff observed that Southern Company had some procedural
weaknesses related to personal network drives, shared drives, and
computer applications and databases that could potentially provide
Southern Power the opportunity to access non-public market information.
    During interviews, audit staff learned that each employee has a
personal network drive and if an employee transfers from one area of
Southern Company to another, such as from the Transmission function
into Southern Power, the employee's personal network drive is
transferred with the employee. However, Southern Company did not have a
policy in place to review the contents of the transferred employees'
personal network drive for non-public market information. Audit staff
also learned that the network server access restrictions are one-
directional (i.e. Southern Power to the other Southern Operating
Companies). As a result, a non-Southern Power employee with write
access to a shared network drive could transfer files containing non-
public market information to the network drive it shares with Southern
Power. Southern Company also did not have a policy in place to review
shared network drives for non-public market information. Currently, the
Separation Protocol and Standards of Conduct training programs are the
only control mechanisms in place to prevent Southern Power access to
non-public market information through personal and shared network
drives.
    To prevent the type of breaches audit staff detected during its
examination of the segmented network and wireless network, Southern
Company should implement multiple strategies to electronically restrict
Southern Power employees' access to non-public market information. For
example, Southern Company should implement procedures to ensure
Southern Power employees are electronically restricted from obtaining
non-public market information through access rights to shared network
drives. Further, Southern Company should develop procedures to review
and remove non-public market information from personal network drives
for employees who transfer to Southern Power from another area of the
company.

Recommendations

    We recommend Southern Company:
    1. Create procedures for reviewing files posted to Southern Power
shared drives by non-Southern Power employees for non-public market
information. Additionally, create procedures for reviewing the personal
network drives of all employees who transfer into Southern Power for
non-public market information. For each review, remove all files that
contain non-public market information from the personal network drive
of the transferred employee.
    2. Perform periodic reviews to ensure that Southern Power employees
do not have access rights to shared network drives containing non-
public market information. Additionally, these periodic reviews should
include testing of the segmented network to determine whether Southern
Power employees can bypass the segmented network and potentially access
non-public market information.
    3. Add the SPC designator to Southern Power employee names in Cool
Compliance, as is already done in the Global Address List for e-mails,
to spotlight a Southern Power employee having access rights granted in
Cool Compliance.

Corrective Action Taken

    On November 14, 2008, Southern Company implemented new procedures
governing the monitoring and review of shared drives and personnel
network drives. For shared drives the new procedures require any non-
Southern Power employee who posts material to a Southern Power shared
folder to send an e-mail notifying the Southern Power employee of the
posting content. For personnel network drives the new procedures
requires a Southern Power business manager and transferred employee to
review and remove any documents containing non-public market
information from the personnel network drive and to a complete and
submit a transfer checklist to a compliance officer for review.
    Southern Company also implemented new procedures that require a
semi-annual review of approved access lists and content of Southern
Power shared drives by a generation compliance officer. Further, the
new procedures also require periodic testing of the segmented network
to verify the integrity of the preventive controls and to confirm that
Southern Power employees do not have access to network drives that
contain non-public market information.
    On November 10, 2008, Southern Company informed audit staff that it
will begin identifying and labeling all Southern Power employees in
Cool Compliance to help prevent inadvertent disclosure of non-public
market information. However, Southern Company did not provide an the
implementation date for this new procedure.

Employee Separation

    Audit staff observed a shared employee performing transmission
activities that support the long-term wholesale energy transactions of
Southern Power, while at the same time performing transmission and
energy trading activities that support the short-term wholesale energy
transaction made by the pool on behalf of the Southern Operating
Companies. Audit staff believes that Southern Company should dedicate
separate employees to perform the transmission activities supporting
Southern Power's long-term wholesale energy transactions and the
transmission activities supporting the short-term wholesale energy
transactions made for the pool on behalf of the Southern Operating
Companies to prevent the potential for any undue preference.

Pertinent Guidance

    The Settlement Order clarified that where a competitive affiliate
enters into transactions for its own benefit, it must separate its
functions from those of its regulated affiliates.\37\ This separation
of functions obligation includes, in part, a requirement to maintain
separate staffs to perform the sales functions and a restriction on the
sharing of any non-public market information. These protections ensure
that the parent corporation cannot favor sales by the

competitive affiliate over those of the regulated affiliates.
---------------------------------------------------------------------------

    \37\ Southern Company Services, Inc., 117 FERC ] 61,021 (2006).
---------------------------------------------------------------------------

    Moreover, the Commission's Acceptance Order further clarified that
the Southern Operating Companies must adopt a clear separation of
functions, including restrictions on information sharing, and a
separation of personnel, for any function that is undertaken for the
benefit of Southern Power's shareholders (i.e. any function except
joint economic dispatch and reserve sharing under the IIC).\38\
---------------------------------------------------------------------------

    \38\ Acceptance Order at P. 16-17.
---------------------------------------------------------------------------

    To implement these modifications, Southern Company Services, Inc.,
included specific language in its Separation Protocol regarding the
functional separation of Southern Power employees from the other
Southern Operating Companies. Specifically, the Southern Company
Services, Inc., Separation Protocol approved by the Commission
applicable to Southern Power, Items No. 1 and 2, states:

    The wholesale activities of Southern Power carried on for the
sole benefit of Southern Power are to be functionally separated from
the other Southern Operating Companies. These activities
(collectively referred to as separated functions) consist of any
function undertaken for the benefit of Southern Power's
shareholders.
    Personnel who conduct separated functions for Southern Power may
be employees of Southern Power or they may be employees of a service
company or other affiliated company. To the extent the service
company or other affiliated company employees conduct these
separated functions, such employees must be dedicated exclusively to
Southern Power and all associated costs (direct and indirect) must
be borne by Southern Power or its shareholders.

Background

    The Southern Operating Companies did not solely dedicate a shared
employee performing transmission activities that support the long-term
wholesale energy transactions of Southern Power and a different
employee to support the short-term wholesale energy transactions made
by the pool on behalf of the Southern Operating Companies. Southern
Power relies on a shared employee to procure transmission service
(e.g., negotiate transmission service agreements and reserve
transmission service) that supports its long-term wholesale energy
transactions made outside the pool operating window. This same shared
employee is responsible for performing energy trading and the
transmission activities for the pool on behalf of the Southern
Operating Companies for short-term wholesale energy transactions made
under the IIC.
    During the audit period, audit staff did not identify any
occurrences where Southern Power received an undue preference. However,
absent having an employee solely dedicated to Southern Power for
performing transmission activities, there is a potential risk for
Southern Power to receive an undue preference due to this shared
employee's co-existing duties as a term energy trader for the pool and
associated transmission responsibilities performed on behalf of the
pool and Southern Power. Audit staff believes that the Commission's
Settlement and Acceptance Orders and the Southern Company Services,
Inc., Separation Protocol require further separation of the
transmission activities performed by this shared employee by solely
dedicating this person or another employee to Southern Power.
    Audit staff's review of transmission service agreements between
Southern Power and Southern Company's transmission function
acknowledged the shared employee signed transmission service agreements
on behalf of Southern Power. In addition to transmission service
agreements, audit staff obtained transactional data from OASIS showing
that the same shared employee made transmission service reservations to
support Southern Power's wholesale energy transactions and the
wholesale energy transactions made by the pool on behalf of the
Southern Operating Companies. Further, audit staff reviewed the job
description of this shared employee and interviewed the shared employee
to confirm his job responsibilities included: (1) Optimizing daily and
long-term point-to-point (PTP) transmission positions on behalf of the
Southern Operating Companies including purchasing, reselling, and/or
redirecting transmission through OASIS; (2) querying OASIS to determine
available transfer capability on all Southern Company interfaces; (3)
requesting long-term PTP transmission for the Southern Operating
Companies (through OASIS); (4) executing transmission service
agreements; and (5) conducting term energy trading on behalf of the
pool.
    Southern Company explained that when Southern Power needs long-term
(i.e., one month or greater) transmission service as the result of its
entry into a wholesale energy purchase or sale contract, Southern Power
notifies this shared employee of that transmission need. The shared
employee then pursues available long-term transmission that meets
Southern Power's needs through queries on Southern Company's or a non-
affiliated Transmission Provider's OASIS and through inquiries to
potential counterparties. When such transmission is found, a
transmission service agreement is executed on behalf of Southern Power
and provided to it. This same shared employee, within the nearer-term
operational window as provided by the IIC, procures transmission
service for the Southern Operating Companies to support any short-term
wholesale energy transactions made on behalf of the pool. This process
applies to transmission procured from Southern Company's transmission
function as well as from non-affiliated Transmission Providers.
    Southern Company stated that it uses this shared employee to
perform the transmission activities for Southern Power and the pool on
behalf of the Southern Operating Companies because of the integrated
operating nature of the pool. Further, Southern Company stated that the
pool seeks to optimize all of the Southern Operating Companies'
resources related to unit commitment and joint economic dispatch,
including generation, purchased power, transmission and fuel
arrangements (e.g., natural gas supply, transportation and storage).
Audit staff agrees that the pool must operate on an integrated basis
and that all reserved transmission capacity should be obtained by the
pool in accordance with the terms and conditions of the OATT. However,
as required by the Commission's Settlement and Acceptance Orders and
the Southern Company Services, Inc. Separation Protocol, the
procurement of transmission service supporting Southern Power's long
term wholesale energy transactions should not be a pool responsibility
performed by a shared employee, but rather a responsibility performed
by an employee solely dedicated to Southern Power.
    Audit staff is concerned that there is a potential risk for
Southern Power to receive an undue preference if this shared employee
continues to have co-existing duties as an energy trader for the pool,
along with the transmission responsibilities associated to the
wholesale energy transactions conducted on behalf of the pool and
Southern Power.

Recommendation

    We recommend Southern Company:
    4. Dedicate employees performing transmission activities that
support Southern Power's long-term wholesale energy transactions solely
to Southern Power.

Corrective Action Taken

    On November 7, 2008, Southern Company informed audit staff that it

transferred the responsibilities associated with the procurement of
transmission service for Southern Power's long-term wholesale energy
transactions to Southern Power.

Posting of Separation Protocol Violations on OASIS

    Southern Company did not immediately post, date, and time stamp the
postings it made to OASIS in accordance with the Commission's Standards
of Conduct requirements in effect during the audit period.

Pertinent Guidance

    Pursuant to the Separation Protocol paragraph 6, the Southern
Operating Companies are required to post any violation of the
Separation Protocol on OASIS in a manner consistent with the process
under the Standards of Conduct.\39\ The Standards of Conduct require
the Transmission Provider to post immediately information that an
employee of the Transmission Provider discloses in a manner contrary to
the requirements of Sec.  358.5(b)(1) on its OASIS or Internet Web
site.\40\ The requirement of 18 CFR 358.5(b)(1) (2008) states:
---------------------------------------------------------------------------

    \39\ Southern Company Services, FERC Electric Tariff, Second
Revised Volume No. 4, Original Sheet No. 6.
    \40\ 18 CFR 358.5(b)(3)(2008).

    An employee of the Transmission Provider may not disclose to its
Marketing or Energy Affiliates any information concerning the
transmission system of the Transmission Provider or the transmission
system of another * * * through non-public communications conducted
off the OASIS or Internet Web site, through access to information
not posted on the OASIS or Internet Web site that is not
contemporaneously available to the public, or though information on
the OASIS or Internet Web site that is not at the same time publicly
---------------------------------------------------------------------------
available.

    The Commission's Standards of Conduct regulations also require all
OASIS database transactions, except other transmission-related
communications provided for under 18 CFR 37.6(g)(2)(2008), must be
stored, dated, and time stamped.\41\ Further, the Commission explained,
in 18 CFR 37.6(g)(1)(2008), that other transmission-related
communications may include ``want ads'' or ``other communications''
such as using the OASIS as a transmission-related conference space or
making transmission-related messaging services between OASIS users.
---------------------------------------------------------------------------

    \41\ 18 CFR 37.7(a)(2008).
---------------------------------------------------------------------------

Background

    On November 19, 2007, the Separation Protocol applicable to
Southern Power became effective and in part required the Southern
Operating Companies to post any violation of the Separation Protocol on
OASIS in a manner consistent with the Commission's Standards of Conduct
requirements. In accordance with this requirement, Southern Company has
made fourteen postings covering violations of the Separation Protocol
on its OASIS between November 19, 2007 and August 31, 2008. However,
Southern Company did not immediately post, date and time stamp the
postings it made to OASIS. The fourteen violations included the
following:
     Eleven e-mails containing non-public market information
that were electronically sent to Southern Power employees from
employees of the other Southern Operating Companies. The non-public
market information included in these e-mails pertained to non-Southern
Power plant outages, unit status, plant damage, plant equipment issues,
and plant performance. Some of the non-public market information shared
also pertained to system load data and financial information such as
mark-to-market accounting and budgets. The Compliance Officer's
investigation of these violations determined that Southern Power
employees viewed non-public market information in seven of the eleven
e-mails received. One of the violations involved the distribution of
the same non-public market information sent to Southern Power employees
in a previous e-mail. The other three e-mails contained non-public
market information which was received, but not viewed by, Southern
Power employees. Most of the violations occurred from having outdated
e-mail distribution lists that contained Southern Power employees and
from reports received by Southern Power employees, where the senders
did not realize the contents included non-public market information.
     One involved a Southern Power employee who obtained access
to the power pool trading floor, which is a physically restricted
access area. The review performed by a compliance official determined
that the Southern Power employee did not view or review any non-public
market information.
     One violation involved a meeting where employees from
Southern Power and the other Southern Operating Companies were present.
During this meeting, non-public market information pertaining to a
plant outage with a third party that sold the output of the plant to
Georgia Power Company was shared with Southern Power. A compliance
official informed the Southern Operating employee that they should not
do this going forward when meeting with Southern Power employees.
     One involved computer access to an application containing
load forecast data of Georgia Power Company. The initial Separation
Protocol review did not detect any problems with this application;
however, a modification to the application was made subsequent to this
review which granted Southern Power employees access to non-public
market information. A compliance official interviewed each employee
with access to the load forecast data and determined that none of these
employees accessed or viewed this information. Southern Company
resolved this problem by removing the Southern Power employee's access
to non-public information of Georgia Power Company.
    Audit staff requested copies of documents related to all potential
and actual Separation Protocol violations that were investigated since
November 19, 2007. Audit staff's review of these reports determined
Southern Company posted many of the Separation Protocol violations days
or weeks after the Southern Power employee received access to the non-
public market information. For example, Southern Company posted one
incident over one full month following the receipt of the non-public
market information by a Southern Power employee. Moreover, audit staff
determined that Southern Company identified the date of occurrence, but
did not date or time stamp any of the Separation Protocol violations it
posted on OASIS. As a result, non-affiliated transmission customers
could not determine whether Southern Company posted the Separation
Protocol violations immediately, as required by the Standards of
Conduct.
    The Standards of Conduct require Southern Company to immediately
post information that an employee of the Transmission Provider
discloses in a manner contrary to the requirements of Sec.  358.5(b)(1)
on the OASIS.\42\ Further, all OASIS database transactions, except
other transmission-related communications provided for under 18 CFR
37.6(g)(2)(2008), must be stored, dated, and time stamped.\43\
Accordingly, Southern Company should immediately post all non-public
market information that a Southern Power employee receives and include
a date and time stamp in accordance with the Standards of Conduct.\44\
---------------------------------------------------------------------------

    \42\ 18 CFR 358.5(b)(3)(2008).
    \43\ 18 CFR 37.7(a)(2008).
    \44\ 18 CFR 37.6(g)(2)(2008).

---------------------------------------------------------------------------

Recommendations

    We recommend Southern Company:
    5. Post all violations of the Separation Protocol immediately in
accordance with 18 CFR 358.5(b)(3). In addition to the date the
violation occurred, Southern Company should include on each document
the date and time Southern Company posted the violation to OASIS in
accordance with 18 CFR 37.6(g)(2).
    6. Strengthen procedures and controls for maintaining e-mail
distribution lists and providing reports to Southern Power that may
contain non-public market information. Incorporate these procedures and
other pertinent procedural enhancements in the Separation Protocol
compliance training program to achieve a reduction in the number of
future violations.

Corrective Action Taken

    On November 14, 2008, Southern Company revised its Separation
Protocol Violations Investigative Procedure to reflect that upon
determining an actual violation has occurred, the incident must
immediately be posted on OASIS. Further, Southern Company implemented a
procedural change to include a date and time stamp for each document
posted on OASIS relating to the violation.
    Southern Company also implemented new procedures requiring
employees to maintain and periodically review their e-mail distribution
lists to verify employee memberships. Further, Southern Company revised
its Separation Protocol training to provide additional and more
detailed guidance with regard to electronic communications with
Southern Power employees and, the development and maintenance of e-mail
distribution lists. The revised training will be conducted online, with
an anticipated completion deadline of December 31, 2008.

V. Southern Companies' Comments on the Draft Audit Report

FERC Docket No. PA08-6-000

    Southern Company Services, Inc., acting as agent for Alabama Power
Company, Georgia Power Company, Gulf Power Company, Mississippi Power
Company, and Southern Power Company (collectively, ``Southern
Companies''), submits the following comments on the Draft Audit Report
provided by the Division of Audits on November 4, 2008.
    In this submission, Southern Companies have purposefully sought to
focus their comments on more substantive matters, and thus have not
undertaken to address each and every aspect with which they disagree.
In like manner, Southern Companies saw no need to set forth the
substantive reasons for their disagreement with any recommendations
that they have nonetheless agreed to implement. Accordingly, the
absence of comment directed to a given statement, assertion,
representation, or conclusion in the Draft Audit Report should not be
interpreted as their agreement or tacit admission as to accuracy or
completeness thereof.
1. Electronic Separation
    Recommendation No. 1: Create procedures for reviewing files posted
to Southern Power shared drives by non-Southern Power employees for
non-public market information. Additionally, create procedures for
reviewing the personal network drives of all employees who transfer
into Southern Power for non-public market information. For each review,
remove all files that contain non-public market information from the
personal network drive of the transferred employee.
Southern Companies' Comments on Recommendation No. 1:
    Effective November 14, 2008, Southern Companies have implemented
the ``Separation Protocol Policy to Govern Monitoring of the Southern
Power Shared Folders,'' which is a new policy regarding information
posted to Southern Power Company (``Southern Power'') shared folders by
non-Southern Power employees. This new procedure includes periodic
reviews of approved access lists and content. The procedure also
includes a requirement that any non-Southern Power employee who posts
material to a Southern Power shared folder will notify the owner of
such folder by e-mail of the posting. Southern Companies have submitted
this policy to Audit Staff for review.
    Effective November 14, 2008, Southern Companies have implemented
the ``Separation Protocol Policy to Govern Employee Transfers to
Southern Power Company,'' which is a new policy that addresses the
personal network drives of employees who transfer into Southern Power.
This policy will insure that these employees do not retain any
documents (hard copy or electronic) containing Prohibited Information.
Southern Companies have submitted this policy to Audit Staff for
review.
    Recommendation No. 2: Perform periodic reviews to ensure that
Southern Power employees do not have access rights to shared network
drives containing non-public market information. Additionally, these
periodic reviews should include testing of the segmented network to
determine whether Southern Power employees can bypass the segmented
network and potentially access non-public market information.
Southern Companies' Comments on Recommendation No. 2:
    Effective November 14, 2008, Southern Companies have implemented
the ``Separation Protocol Policy to Govern Monitoring of the Segmented
Network,'' which is a new policy that requires periodic testing of the
segmented network to verify the integrity of the preventive controls
and to confirm that Southern Power employees do not have access to
network drives that contain Prohibited Information. Southern Companies
have submitted this policy to Audit Staff for review.
    Recommendation No. 3: Add the SPC designator to Southern Power
employee names in Cool Compliance, as is already done in the Global
Address List for e-mails, to spotlight a Southern Power employee having
access rights granted in Cool Compliance.
Southern Companies' Comments on Recommendation No. 3:
    The designator ``(SPC)'' will be added to Southern Power employee
names in Cool Compliance. Southern Companies have submitted evidence of
this implementation to Audit Staff.
2. Employee Separation
    Recommendation No. 4: Dedicate employees performing transmission
activities that support Southern Power's long-term wholesale energy
transactions solely to Southern Power.
Southern Companies' Comments on Recommendation No. 4:
    Southern Companies disagree with the findings in this section of
the Draft Audit Report and the related recommendation. However, in
order to resolve this issue, the procurement of long-term transmission
service associated with the long-term wholesale energy transactions of
Southern Power has been moved to Southern. Accordingly, all long-term
transmission service requests associated with Southern Power's long-
term energy transactions will be made on OASIS by Southern Power
employees.
3. Posting of Separation Protocol Violations on OASIS
    Recommendation No. 5: Post all violations of the Separation
Protocol immediately in accordance with 18 CFR

358.5(b)(3). In addition to the date the violation occurred, Southern
Company should include on each document the date and time Southern
Company posted the violation to OASIS in accordance with 18 CFR
37.6(g)(2).
Southern Companies' Comments on Recommendation No. 5:
    Southern Companies have revised their ``Separation Protocol
Violations Investigative Procedure'' to state that when ``it is
determined that an actual violation has occurred, the incident must be
posted on OASIS immediately.'' Southern Companies have submitted the
revised protocol to Audit Staff for review.
    Southern Companies have implemented the changes necessary so that
the date and time a violation is posted on OASIS will be included for
each posting.
    Recommendation No. 6: Strengthen procedures and controls for
maintaining e-mail distribution lists and providing reports to Southern
Power that may contain non-public market information. Incorporate these
procedures and other pertinent procedural enhancements in the
Separation Protocol compliance training program to achieve a reduction
in the number of future violations.
Southern Companies' Comments on Recommendation No. 6:
    Effective November 14, 2008, Southern Companies have implemented
the revised ``Fleet Operations and Trading Floor Information, Physical
Access and Visitor's Policy,'' which revision requires employees to
maintain their e-mail distribution lists and to periodically review
such lists to verify employee memberships. Southern Companies have also
revised the Separation Protocol training to provide additional and more
detailed guidance with regard to electronic communications with
Southern Power employees and, the development and maintenance of e-mail
distribution lists. This revised training will be conducted online,
with an anticipated completion deadline of December 31, 2008. In
addition, Southern Companies will continue to conduct individual
training and counseling for employees that are involved in Separation
Protocol investigations. Southern Companies have submitted the revised
policy and applicable portions of the revised training materials to
Audit Staff for review.

[FR Doc. E8-30143 Filed 12-18-08; 8:45 am]

BILLING CODE 6717-01-P