12.03

Control Activities

Principle 12 - Implement Control Activities

Attribute 12.03 - Management documents in policies and procedures for each unit within the entity's organizational structure its responsibility for a business process's objectives and related risks and control activity design, implementation, and operating effectiveness. Each unit, with guidance from management, determines the policies necessary to operate the business process based on the objectives and related risks. Each unit also documents policies and procedures in the appropriate level of detail to allow management to effectively monitor the control activity. The documentation may appear in various forms, such as management directives, administrative policies, or operating manuals.

>>>Navigational Buttons<<<

• Index of Attributes
• Previous Attribute - 12.02
• Next Attribute - 12.04

Jamie's Story

No examples are available to illustrate governance gaps for this attribute.

Election Anomalies

Arizona Senate Allegations

Arizona Senate allegations arose from MC's failure to recognize the Arizona Senates Oversight Role. These allegations were investigated and reported on by the Arizona Attorney General's Office 2020 General Election Investigation. The AZ AG's inspector relied on interviews to determine Information Technology (IT) practices. Evidently, no procedures were available for the inspector's review. Documented procedures ensure consistency in operations. This governance gap is most relevant to the indeterminate findings of the investigation, which are as follows:

• Maricopa Election Management Server (2020)
  • MC EMS 2020 - Election Management System Database Purged
  • MC EMS 2020 - Election Files Deleted
  • MC EMS 2020 - Corrupt Ballot Images
  • MC EMS 2020 - Missing Ballot Images
  • MC EMS 2020 - Anonymous Logins
  • MC EMS 2020 - Dual Boot System Discovered
  • MC EMS 2020 - Operating System Logs Not Preserved

Maricopa Dropbox Collection (2020)

Governance issues identified from Arizona Attorney General's Office 2020 General Election Investigation of Arizona Senate allegations of Maricopa County Election Department - Drop Box Collections issues. Control activities should have been in place to detect procedure violations had this attribute been applied. Instead, citizen allegations had to be brought to the attention to the Arizona Senate. In turn, the Arizona Senate had to dispatch an investigator to address the allegations. Ultimately, the AZ AG's inspector confirmed the allegations; five procedure violations had occurred. MC did not have sufficient control activities to detect internal procedure violations.

• See the heading Deviation: Allegations Confirmed from Maricopa Dropbox Collection (2020) webpage.
• See the heading Deviation: Missing Entries on Election Forms from Maricopa Dropbox Collection (2020) webpage.
• See the heading Deviation: Missing Ballot Counts from Maricopa Dropbox Collection (2020) webpage.
• See the heading Deviation: Used Email instead of EVBTS Forms from Maricopa Dropbox Collection (2020) webpage.
• See the heading Deviation: Unfulfilled Party Representation Requirements for Couriers from Maricopa Dropbox Collection (2020) webpage.