8.11

Risk Assessment

Principle 8 - Assess Fraud, Improper Payment, and Information Security Risk

Attribute 8.11 - Management considers the types of improper payments that could impact the entity to provide a basis for identifying and analyzing improper payment risks. Improper payments are any payments that should not have been made or that were made in an incorrect amount. Payments are also considered improper when there is insufficient or lack of documentation. Improper payments can result from lack of oversight, mismanagement, errors, deficiencies in internal control, abuse, or fraud. While all payments resulting from fraudulent activity are considered improper, not all improper payments are the result of fraud. Types of improper payments may include the following:

• Overpayments - These payments are those in excess of the amount due to be paid to recipients. They include payments to ineligible recipients, any payment for an ineligible good or service, payments for goods or services not received, and any duplicate payment. They could be either intentional—such as fraudulent payments—or unintentional.
• Underpayments - These payments are those in which recipients did not receive some or all the funds to which they were entitled.

>>>Navigational Buttons<<<

• Index of Attributes
• Previous Attribute -8.10
• Next Attribute - 8.12

Jamie's Story

No examples are available to illustrate governance gaps for this attribute.

Election Anomalies

The Green Book's Principle 8 addresses Assess Fraud, Improper Payment, and Information Security Risk. Obviously, improper payments is not a concern during the Assessment of Election Anomalies. However, improper payments by MC county may exist, but would require a separate assessment.

The Green Book's emphasis on fraud and information security as separate risk assessment activity is intentional. MC may be able to defer to the Arizona Secretary of State's Election Procedure Manual as general steps taken to ensure the integrity of election results. Fraud occurs when loopholes are identified and exploited by the fraudsters. The implementers of election services (i.e., Arizona Counties) are better positioned to detect fraud and assess the risk of fraud because they are handling the data, not the state. Hence, governance gaps may be identified from patterns of poor assessment and response to risk with respect to election fraud and information security.