View source for Principle 17 - Evaluate Issues and Remediate Deficiencies

== 17.0 Evaluate Issues and Remediate Deficiencies ==
[https://guides.gaoinnovations.gov/greenbook/2025/principle-17-evaluate-issues-and-remediate-deficiencies/ External Link to US GAO Green Book Principle 17]

=== Overview ===

==== '''17.01''' ====
Management should remediate identified internal control deficiencies on a timely basis.

=== 17.1 Reporting of Issues ===

==== '''17.02''' ====
Personnel report internal control issues through established reporting lines to the appropriate internal and external parties on a timely basis to enable the entity to promptly evaluate those issues and complete corrective action to remediate issues that rise to the level of internal control deficiencies.
 I don’t think we can support a deviation for this because we didn’t ask for CAP documents in the original PRR. Did you ask for CAP documents?
 
 If so, who, what, when, where, how?

==== '''17.03''' ====
Personnel may identify internal control issues while performing their assigned internal control responsibilities. Personnel communicate these issues internally to the person in the key role responsible for the internal control or associated process and, when appropriate, to at least one level of management above that individual. Depending on the nature of the issues, personnel may consider reporting certain issues to the oversight body or an established hotline. Such issues may include

* issues that cut across the organizational structure or extend outside the entity to service organizations, contractors, or suppliers and issues that may not be remediated because of the interests of management, such as sensitive information regarding fraud or other illegal acts.

 We have no documentation of this, but the Covid-19 Pandemic likely caused issues that cut across organizational boundaries

==== '''17.04''' ====
Depending on the entity’s regulatory or compliance requirements, the entity may also be required to report issues externally to appropriate external parties, such as the legislators, regulators, and standard-setting.
 I don’t think we have a deviation here.

=== 17.2 Evaluation of Issues ===

==== '''17.05''' ====
Management evaluates and documents internal control issues and determines appropriate corrective actions for internal control deficiencies, including those reported from internal and external audits and evaluations, on a timely basis [documentation requirement]. Management evaluates issues identified through monitoring activities or reported by personnel to determine whether any of the issues rise to the level of an internal control deficiency. Internal control deficiencies require further evaluation and remediation by management. An internal control deficiency can be in the design, implementation, or operating effectiveness of the internal control and its related process. Management determines from the type of internal control deficiency the appropriate corrective actions to remediate it on a timely basis.
 '''April 15, 2025: Public Records Request''' – There was no objective evidence was found to confirm an Maricopa evaluated any of the election anomalies that necessitated portions of the contracts to be stricken through and amendments added.
 
 Contrary to the Green Book, there was no documentation of the evaluation of the unexpected Covid-19 pandemic conditions that necessitate contract revisions.

=== 17.3 Corrective Actions ===

==== '''17.06''' ====
Management completes and documents corrective actions to remediate internal control deficiencies, including those reported from internal and external audits and evaluations, on a timely basis [documentation requirement]. Depending on the nature of the deficiency, either the oversight body or management oversees the prompt remediation of deficiencies by communicating the corrective actions to the appropriate level of the organizational structure and delegating authority for completing corrective actions to appropriate personnel. Documentation of corrective actions may include

* root cause analysis,
* planned actions,
* interim milestones,
* completion dates,
* measurable indicators of compliance and remediation to assess and validate progress throughout the remediation process, and the entity official responsible for monitoring the status of the corrective actions.

 '''April 15, 2025: Public Records Request''' – It could be debated as to whether the election-related contracts were revised as Corrective Action. However, no documentation was found to suggest these changes were implemented as corrective action to a formal evaluation.
 
 Contrary to the Green Book, no documentation was found to attribute the contract changes as corrective action to a formal evaluation.

==== '''17.07''' ====
Corrective actions may include changes to controls within each of the five components of internal control, such as providing training on identified risks or modifying or adding control activities. Management also updates the entity’s periodic risk assessment based on the results of monitoring activities and may consider performing ongoing risk assessments when internal control deficiencies are identified.
 This will not make the list of Green Book deviations; it’s a permissive statement, “corrective actions may…”

==== '''17.08''' ====
Corrective actions also include remediating audit and evaluation findings. The remediation process begins when audit or other review results are reported to management. It is completed only after action has been taken that (1) corrects identified deficiencies, (2) produces improvements, or (3) demonstrates that the findings and recommendations do not warrant management action. Management, with oversight from the oversight body, monitors the status of remediation efforts so that they are completed on a timely basis.
 I can’t see this being a deviation
{{Principles}}

== Related Story Events ==
* [[2001: The Journey Begins|❓ 2001: The Journey Begins — No Corrective Actions]]
* [[December 2024: Gaining Support|📋 December 2024: Seeking Remediation]]