<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

How Puerto Rico's Vendor Management Went Awry with Whitefish Energy

author Michael Berman
4 min read
Nov 8, 2017

As if Puerto Rico didn’t have enough troubles, it’s now making headlines over the decision to award a $300 million contract to repair the island’s electrical grid to a small two-person firm with revenues of less than $1.5 million. The contract, which has since been canceled, was awarded to Whitefish Energy, a small Montana company located in Interior Secretary Ryan Zinke’s hometown. The FBI is currently looking into the matter as many question why such a small, new firm was hired for such a large, critical job, CNN reports.

Could your institution make the same mistake? The banking regulatory agencies all have specific due diligence requirements for critical vendors (frequently called “significant” or “critical” third-party vendors), and that includes companies critical for recovering after a disaster.

Using some of the OCC’s requirements as a guide, we looked at Whitefish Energy to see how it measured up. To do this we used a website called GovTribe, which collects data on government contractors and contracts from public government documents. A relatively quick Google search quickly showed us it would be hard to justify that choice to regulators.

Experience. The two-man company has less than two years of experience, founded in 2015. It has been granted three small Department of Energy contracts during this time. They include a $1.3 million contract to work on a substation in Arizona; a $40,000 contract; and $132,000 to install a transmission line, according to GovTribe. No contract has come anywhere remotely close to eight figures, let alone nine.

Financial condition. The company has revenues of around $1 million, according to GovTribe.

Reputation. The company’s GovTribe website doesn’t mention a website, although one now exists.

Fee structure and incentives. FEMA “has not confirmed whether the contract prices are reasonable.” The company was chosen because most companies wanted an upfront deposit due to Puerto Rico’s unstable finances. The Washington Post reports “the hourly rate was set at $330 for a site supervisor, and at $227.88 for a ‘journeyman lineman.’ The cost for subcontractors, which make up the bulk of Whitefish’s workforce, is $462 per hour for a supervisor and $319.04 for a lineman. Whitefish also charges nightly accommodation fees of $332 per worker and almost $80 per day for food.”

Principals. CEO Andy Techmanski is a former lineman with over 20 years of experience and an acquaintance of Interior Secretary Zinke, having hired his son as an intern last summer.

Resilience. As a two-person shop, it’s essential that there are layers of management and a solid plan to prevent disruption in the event something happens to one of the principles.

Subcontractors. The company must rely heavily on subcontractors as it is just a two-person firm. The job will take thousands of workers.

A quick rundown of these elements makes it pretty clear that Whitefish Energy might not be well suited to such a large recovery task. They are small and lack experience in overseeing projects of this size. That’s even before delving into other areas that the OCC would have bankers address include risk management, information security, management of information systems, physical security, human resource management, insurance coverage, and incident-reporting and management programs.

There were also issues in the contract that would likely give a financial institution pause. The OCC expects contracts to have provisions addressing audit and remediation, dispute resolution and cost and compensation. I’m not sure if these provisions, reported in The Hill newspaper, would pass muster:

  • “In no event shall PREPA [the Puerto Rico Electric Power Authority], the Commonwealth of Puerto Rico, the FEMA Administrator, the Comptroller General of the United States, or any of their authorized representatives have the right to audit or review the cost and profit elements of the labor rates specified herein.”
  • “PREPA waives any claim against Contractor related to delayed completion of the work.”

Lessons Learned

Part of Puerto Rico’s problem is that it didn’t have vendors lined up in advance Hurricane Irma, leaving the authorities there to struggle to find partners to help restore the island. With lives on the line as citizens struggle without power, clean water, food and other essential supplies, there was limited time to vet vendors and find someone who was willing to work with the territory considering the very real chance that Puerto Rico could run out of cash to pay very soon.

What disaster recovery lessons can we learn from this?

  1. Your business continuity plan should include vendors. Have vendor agreements in place in the event of a business continuity issue or at least a list of potential vendors. Of course, there are some highly unlikely scenarios where it’s just not worth it to pre-vet vendors, but there are plenty of other scenarios where a little work now could have a huge impact down the road.
  2. Avoid the shadow of impropriety. There is nothing wrong with doing business with people you know and like, but those people must be qualified and meet or exceed expected standards.
  3. Due diligence is a must. Even if you don’t have a signed contract with a vendor, it’s smart to have a list of vendors who you’ve conducted due diligence on so you have an updated list of vendors to call on if something goes wrong.
  4. Review the contract carefully. Just because you’re in an emergency situation doesn’t mean you should sign any document. Make sure the contract includes everything you need to allow for adequate oversight, monitoring and remediation.

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Regulatory Compliance Management Nrisk News & Updates HMDA Risk Mortgage Lenders Vendor Management Ncomply Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Business Continuity Third-Party Vendor Management Cybersecurity Fintech NVendor Strategic Planning Ncyber Regulatory Updates Ntransmittal Audits & Findings OCC Regulatory Compliance Company Culture Audit Nverify Compliance Management Exams FDIC Nfindings Findings NCUA Contract Management Employee Intranet Business Continuity Management Contract FRB Findings Management Enterprise Risk Management FFIEC Ncontracts manager Third-Party Vendors Vendor Risk Vendor Risk Management Wealth Management 1071 ABA Bank Access Control Artificial Intelligence Audit Findings Board Portal Call Report Compliance Risk Cybersecurity Assessment Digital Tansformation Due Diligence Efficiency Employee Engagement Exam findings FIEC Governance and Risk Management Inc. 5000 Internal Audit Management Mortgage Lending Nboardportal Verify integrated risk management
Increasing Risk May Not Mean What You Think It Does
Risk & Compliance

Increasing Risk May Not Mean What You Think It Does

Apr 13, 2018 2 min read
Planning to Fail or Failing to Plan - Strategic Risk
Risk & Compliance

Planning to Fail or Failing to Plan - Strategic Risk

Dec 15, 2016 1 min read
How Confident Is Your CFO When It Comes to Managing Risk?
Risk & Compliance

How Confident Is Your CFO When It Comes to Managing Risk?

Jul 31, 2018 3 min read