Item 7
VALLEY CLEAN ENERGY ALLIANCE
Staff Report – Item 7
______________________________________________________________________________ TO: Board of Directors
FROM: Edward Burnham, Chief Financial Officer
SUBJECT: Bi-annual Enterprise Risk Management Report
DATE: October 8, 2026
RECOMMENDATION
Accept the Bi-annual Enterprise Risk Management Report – September 2026.
BACKGROUND & DISCUSSION
In 2018, the Board approved VCE’s Enterprise Risk Management (ERM) Policy. The policy is centered on risk management best practices and policies for the energy sector. In summary, the VCE ERM policy contains the following sections:
• Introduction: This section introduces the value of ERM as a structured approach to managing risk and uncertainty. It lays out the objectives of VCE’s ERM function, providing the framework for evaluating and managing risk in the organization’s decision-making process. • ERM Roles and Responsibilities: The ERM roles are consistent with the Board-approved Wholesale Power Procurement & Risk Management Policy. The Enterprise Risk Oversight Committee (EROC) has primary responsibility for the implementation of ERM. The policy lays out the scope of the EROC’s risk management authority.
• Business Practices: This section identifies the steps of risk management and the basic process associated with each step. The intent is to provide a high-level framework. Specific tools and techniques for implementing enterprise risk management will be recommended by the portfolio manager following approval of the policy.
• Management Reporting and Metrics: The policy defines an enterprise risk report that will be provided bi-annually to the Board.
Staff has used the consistent framework described in the ERM policy to identify various risks and related mitigations, and to ensure effective mitigation and communication across all levels of the organization. The attached ERM bi-annual report describes the activities that have taken place since Item 7
September 2025 and the actions VCE is and will be taking to manage the top risks that have been identified.
Prior to this report, staff most recently presented the bi-annual update to the Board in March 2026, describing progress on the ERM plan since inception. Bi-annual updates are provided in March and September of each year.
ATTACHMENT
1. Bi-annual Enterprise Risk Management Report – September 2026 Valley Clean Energy
Enterprise Risk
Management Report
September 2026
1 Executive Summary
Introduction and Background
In 2018, the Valley Clean Energy (VCE) Board adopted an Enterprise Risk Management (ERM) framework based on the best industry practices structure developed by SMUD. The objective was to provide the Board with insight into risks that could impact the ability to execute VCE's mission and build credibility and sustain confidence in VCE's governance. In addition, the framework and reports are designed to enhance the understanding of significant risks to VCE, develop the capacity for continuous monitoring, provide for periodic reporting of risks, and establish a platform for responding to changing risk circumstances. This report is the 1st of VCE's biannual risk reports for 2026; the prior ERM biannual Report was issued in September 2025.
ERM is a strategic approach to risk management that supports the achievement of organizational objectives through the management of integrated impacts of risks as an interrelated risk portfolio. ERM is a coordinated effort by management to treat all risks effectively, thereby reducing the overall cost of risk to the organization. The Chief Executive Officer has charged functional leaders to oversee the treatment of known major risk categories and provide a risk overview to the Enterprise Risk Oversight Committee (EROC).
ERM Philosophy
VCE's ERM philosophy includes the following principles:
1. Identify, assess, prudently manage, monitor, and report on a variety of business-critical risks;
2. Provide enterprise risk context and linkage to existing core business processes to improve the allocation of limited resources; ERM Approach
Staff has applied a multi-perspective approach to evaluate and estimate the trade-off between risk and cost of mitigation across VCE business functions. This approach addresses the following issues:
Roles and responsibilities
2 Definitions and language
Risk heat map and risk exposure inventory
Risk exposure monitoring, updating, and reporting
Integration of ERM with key business processes
Integration of risk awareness within corporate culture This framework supports the Board in exercising its overall responsibility to:
o Regulate opportunities and risks for VCE;
o Develop a better understanding of appropriate opportunities and risks for VCE; o Promote active management of risk exposure down to acceptable levels; and o Assist VCE in its achievement of business plan objectives and operational performance.
Summary of Activities through September of 2026
From an implementation perspective, progress continues on multiple fronts. Significant effort has been invested in creating an enterprise risk register. Risks to VCE have been identified, categorized, and rated. Existing risk controls and risk treatment measures implemented/proposed have also been identified. The risk register provides VCE's management with a consolidated view of risks being faced by VCE, the potential impact of those risks, mitigation actions, and assessment of short-term risk trends (i.e., higher/lower/steady).
Staff is using a consistent framework to identify various risks and related mitigations, and to ensure effective communication across all levels of the organization. In doing so, staff has completed the following developmental tasks:
1. Established the Chief Executive Officer as Chief Risk Officer and the Chief Financial Officer as risk process owner, focusing on day-to-day monitoring and coordination.
2. Developed ERM framework and tools
3. Conducted a risk survey
4. Developed VCE's top risk portfolio
5. Surveyed staff and management for ongoing risk input
6. Held monthly EROC meetings
3 Key Steps Taken Since the Last Biannual Update
Some actionable steps that VCE has taken since the last Board update in September 2025 include:
1. Have actively engaged from a regulatory and legislative standpoint, including support for AB 1761 (Rogers) to improve PCIA Transparency (CalCCA Sponsored) and SB 1138 (Padilla) Resource Adequacy (RA) Transactability. (CalCCA Sponsored).
2. Approved 2025 Net Margin Allocation to preserve long-term Rate Credits of 5% for all customers and 10% for CARE/FERA customers and maintain VCE’s strong “A-” S&P Credit Rating.
3. Successful recruitment and retention of key personnel, including the Policy Analyst – Legislative and Regulatory position, to strengthen organizational continuity, expertise, and strategic objectives.
4. VCE initiated a finance modernization effort focused on upgrading core financial systems (Enterprise Resource Planning software, Banking and Line of Credit, and Investments), improving operational efficiency, strengthening internal controls, and positioning the organization for future growth.
5. Delivered 86% renewable and 100% clean electricity service in 2025, reinforcing customer value, environmental leadership, and community trust.
Key Risks
Key risks are those risks that, given VCE's current position, could negatively impact VCE's business model, future performance or prospects, solvency, liquidity, reputation, or prevent it from delivering on its local control commitment. These key risks are updated on an ongoing basis and look forward over a 5-year horizon to identify the:
Nature and extent of risks facing VCE
Likelihood and velocity of the risks and potential impacts VCE's ability to reduce or control such risks
Key Priorities for Risk Management in 2026:
1. Maintain the operational risk management process
2. Provide regular updates to the Board
3. Continue to take specific actions to mitigate risks as outlined in this document
4. Begin to develop contingency plans for unexpected and emergent events 4 Risk Portfolio
Top 5 Risks for VCE:
1. 2026 PCIA Increases (net revenue reductions)
2. Rate Affordability and Stabilization
3. Legislative & Regulatory Policy Risk
4. Resource Adequacy (Planning Reserve Margin)
5. Large Load and Commodity procurement Impacts
The following tables outline current risks (Table 1) and summarize VCE's response plan for it’s top identified risks (Table 2).
Table 1: Risk Description/Level
Risk Description
Current
Residual
Risk
Target
Residual
Risk
Power Charge
Indifference
Adjustment (PCIA)
The PCIA rate for 2026 increased significantly with revised market price benchmarks (MPB) formulas. Risk of increased customer costs and reduced rate competitiveness resulting from proposed CPUC PCIA OIR Track 2 and Track 3 decisions that may increase PCIA charges for VCE customers.
Resource Adequacy
(RA)
RA supply remains constrained; however, market conditions have stabilized, and procurement costs have become more predictable
Commodity
Procurement
the 2026 market has experienced improved stability, with lower energy and resource adequacy costs contributing to a reduction in overall portfolio expenses
Regulatory & Policy
risk
Risk of additional regulatory requirements increasing VCE's operational complexity and costs. The CPUC continues to adopt positions and policies that have shift costs from the IOUs to the CCA community. 5 Risk Description
Current
Residual
Risk
Target
Residual
Risk
Capital
availability/cashflow
Capital / Cashflow Risk has remained low through VCE’s rate, auto rate adjustment, and reserve policies. The 2026 Budget included rates and reserve policies to meet, obtain, and maintain credit rating agency requirements.
Economic Uncertainty
The risks from the ongoing geopolitical climate increase the impacts on natural gas prices, the general economy, and the renewable sector, specifically through tax reform, trade agreements, war(s), and import tariffs.
Rate structure
The risk of rate design for cost of service has been reduced with an updated rate policy and additional implementation of the "Base Green” rate option.
VCE rate stabilization funds are anticipated to be used in 2026 with changing PCIA and PG&E generation rates.
Cyber security & data
privacy
Cybersecurity, data privacy, and public records risks continue to evolve with increasing cyber threats and the growing use of artificial intelligence. VCE has adopted an AI Policy to guide responsible use, protect sensitive information, and mitigate emerging technology risks.
Financial Markets
Volatility
Swings in global energy markets, financial markets, and currencies due to current geopolitical events (e.g. Ukraine/Iran (Middle East) and trade tariffs) have created challenges that impact VCE's power costs.
Changing customer
expectations
The risk that customers' changing expectations, driven by innovation, may lead to reduced revenue and loyalty.
Opt-out rate
Recent customer opt-out activity suggests heightened risk associated with affordability challenges and billing presentation issues. VCE continues to focus on competitive rates, customer outreach, and the Base Green product option to support customer retention
6 Risk Description
Current
Residual
Risk
Target
Residual
Risk
Business model Ability to quickly identify and respond to business risks that have the potential to impact the ability to achieve VCE goals.
Media & Community Risk of unfavorable public communications or events; spillover customer dissatisfaction related to PG&E's PSPS events and affordability.
Unknown risks Businesses and utilities attempt to identify and adapt to known risks, but some potential events outside of VCE's control could have a debilitating impact on utilities in general and VCE in particular. Load Serving Entities, like VCE, are facing new operational, financial, and reliability challenges from unknown impacts from large loads, such as increased demand volatility, potential grid congestion, higher procurement costs, and the need for enhanced infrastructure and forecasting capabilities.
High Risk
High/Moderate Risk
Low/Moderate Risk
Low Risk
///
7 Table 2: Summary of VCE top risk response plan
Risk Event Response Trend1 Plan Trigger/Control Owner
PCIA
Monitor risk &
actively engage
and respond
1) Continue direct involvement
with CalCCA task groups to
seek favorable rulings and
settlements in the PCIA, ERRA,
and other filings.
2) Work towards the potential
long-term goal of attaining an
option for a PCIA buy-out and
sunset date.
Pending CPUC PCIA OIR
Track 2 and Track 3
proceedings may
increase future PCIA
costs and customer
rates.
VCE will continue to
monitor the ERRA and
PCIA proceedings and
participate in advocacy
efforts to mitigate
potential impacts
Chief Financial
Officer
Commodity
Procurement
Reduce &
manage risk
1) Continue to pursue long-term power purchase
agreements to reduce the
average cost of power in future
years
2) Pursue regulatory and
legislative avenues in
addressing the extreme swings
in pricing.
Management and
optimization of PPA
contracts
Pursue long-term RA
agreements to provide
cost stability and
mitigate risks associated
Director of
Power
Resources
1 Current trend of risk for VCE- increasing , no change or decreasing 8 Risk Event Response Trend1 Plan Trigger/Control Owner Regulatory &
Policy risk
Monitor risk &
actively engage
and respond
1) Take an active role in
legislative sessions (contract
with lobbyist and engage Board
members for support /
opposition on bills) along with
support from CalCCA legislative
committee
2) Follow and continue to
update the annual VCE
Legislative Platform
3) Take an active role in
regulatory proceedings at the
CPUC, including appeals, on
various regulations that impact
VCE and CCA's that increase
cost or bureaucracy without
any significant safety or cost
benefits to VCE and its
customers along with support
from CalCCA Regulatory
Committee
Weekly CalCCA
Regulatory and
Legislative Committee
meetings
Regulatory rulings
Legislative actions
Chief Executive
Officer
Capital
Availability /
Cash Flow
Monitor risk &
actively engage
and respond
1) Continue towards conserving
cash, reducing debt, and
lowering cash requirements.
2) Evaluate reserve policy
changes.
3) Work to maintain
investment-grade credit rating.
VCE Line of credit
agreements & extension
to 2027.
Implement VCE Rate
adjustment and
Collections Policy
Chief Financial
Officer
9 Risk Event Response Trend1 Plan Trigger/Control Owner Resource
Adequacy
Reduce &
manage risk
1) Take an active role in
regulatory proceedings at
the CPUC, including
appeals, on various
regulations that impact the
cost of electricity along with
support from the CalCCA
Regulatory Committee.
2) Monitor and participate in
CalCCA activities related to
regional developments in
RA.
3) Continue to develop
portfolio of resources that
satisfy various future RA
program scenarios.
Execution of PPA
contracts
Regulatory rulings that
affect RA cost, including
non-compliance penalty
structure
Annual review of VCE
PPA RA resources
Director of
Power
Procurement
Rate Structure Reduce &
manage risk
1) Monitor and update Board
based on analyst forecasts for
ERRA proceeding.
2) Identify and mitigate risks
outside of VCE control to limit
impacts and frequency of rate
changes.
3) Review and update rates for
rate adjustment policy.
Economic outlook and
Rate forecasts
Monitor Regulatory
proceedings that impact
PCIA, RA, and ERRA.
Monitor cash short-term
and long-term impacts to
reserve funds, credit
lines, commercial
negotiations, and PPA
covenants.
Chief Financial
Officer