7.15
Risk Assessment
Principle 7 - Identify, Analyze, and Respond to Risks
Attribute 7.15 - Management documents the results of the risk assessments, including the identification, analysis, and response to risks, that are completed on both a periodic and ongoing basis. This includes documentation of the consideration of risks related to fraud, improper payments, information security, and significant internal and external changes that could impact the internal control system [documentation requirement].
Empasis on documentation was added by US Government Accountability Office.
>>>Navigational Buttons<<<
- Index of Attributes
- Previous Attribute - ?
- Next Attribute - ?
The discussion of Attribute 7.15 is from this March 12, 2026 event, under the subheading of Motor Vehicle Department Contract.
MC was unable to provide contract or other suitable documentation to describe the risk and mitigation thereof between MC and the Motor Vehicle Department (MVD). This attribute applies to information security, which was obviously compromised based on a press released submitted by Adrian Fontes, the Arizona Secretary of State, on September 30, 2024, indicating over 218,000 Arizona residents were adversely affected by a “coding error.”
Potential Green Book Deviation:
Contrary to the Green Box, MC did not create or retain any documentation describing the interface between MC and the MVD.
