10.10

Control Activities

Principle 10 - Design Control Activities

Attribute 10.10 - Control activities can be either preventive or detective. The main difference between preventive and detective control activities is timing, that is, when the control activity occurs within an entity's operations. A preventive control activity is designed to avoid an unintended event or result before it occurs. A detective control activity is designed to discover and timely correct an unintended event or result after it occurs. The effectiveness of a detective control activity depends on timeliness of the corrective action to address the unintended event or result. Corrective action may address the event that occurred or may correct the deficiencies in the process that led to the event.

>>>Navigational Buttons<<<

• Index of Attributes
• Previous Attribute - 10.09
• Next Attribute - 10.11

Jamie's Story

No examples are available to illustrate governance gaps for this attribute.

Election Anomalies

Maricopa Dropbox Collection (2020)

Governance issues identified from Arizona Attorney General's Office 2020 General Election Investigation of Arizona Senate allegations of Maricopa County Election Department - Drop Box Collections issues and Maricopa County - Signature Verification Process issues (see below).

Consider MC's official goal is to accurately count every valid vote, then the process should screen out ineligible votes to prevent the negating effects.

A preventive internal control would be to minimize excessive distribution of early ballots. Ideally, early ballots should be delivered to only eligible voters. In section of the investigator's report, 56,226 early ballots were noted as being undeliverable, meaning the early ballot address was invalid. If in the wrong hands, these ballots could be used for fraudulent purposes. Yet, there are more types of fraud, which includes distribution of early ballots to fictious people at a valid address. If MC allowed 56,226 invalid addresses in the voter registration database. How are we to believe they have no fictious people registered at valid addresses? Internal controls to prevent fraud appear ineffective.

The are other means to distribute extra ballots to the fraudsters than "fictious addresses." An accurate voter registration database becomes the single most import "preventive" control. Accurate voter registration database ensures early ballots are only mailed to eligible voters. Each extra early ballot mailed out may fall in the hands of a fraudster, who has a reasonably good chance of having their ballot counted given the poor performance of detective measures (next).

A detective control would identify fraudulent early ballots if introduced into the tabulation process (e.g., deposited into a voting drop box). The inspector notes that 587 "bad" signatures were identified by the Signature Verifiers out of a population of 1,910,317 early ballots processed by MC Elections. A single person being the only means of detective fraud making decisions at a pace of one ballot per seven-seconds for eight hours a day (maybe longer) does not appear to be a robust internal control for the detection of fraudulent ballots. By the way, most of the Signature Verifiers had received no training (55%) and those that received the training were not required to demonstrate competency during the training. There was no level of standard established for a single process step, which is intended to detect fraud.

There are weaknesses with internal controls for preventing and detecting fraud.

Maricopa County Signature Verification (2020)

Governance issues identified from Arizona Attorney General's Office 2020 General Election Investigation of Arizona Senate allegations of Maricopa County - Signature Verification Process issues. This Signature Verification issue is intertwined with the Drop Box issue (see above).