12.05

Control Activities

Principle 12 - Implement Control Activities

Attribute 12.05 - Management reviews policies, procedures, and related control activities on a periodic and ongoing basis for continued relevance and effectiveness in achieving the entity's objectives or mitigating related risks. If there is a significant change in an entity's process, management reviews this process in a timely manner after the change to determine that the control activities are designed and implemented appropriately. Changes may occur in personnel, business processes, or information technology. A new law or regulation may change an entity's objectives or how an entity is to achieve an objective. Further, in the federal environment, this may occur through government-wide policy or guidance issued by entities like the Office of Management and Budget, Office of Personnel Management, and the Department of the Treasury. Management considers these changes in its periodic and ongoing reviews. Management also considers the results of its monitoring activities to determine whether control activities are designed and implemented effectively.

>>>Navigational Buttons<<<

• Index of Attributes
• Previous Attribute - 12.04
• Next Attribute - 13.01

Jamie's Story

No examples are available to illustrate governance gaps for this attribute.

Election Anomalies

2020 Maricopa County Directs Use of Sharpie Pens

Elections personnel had identified issues with the Sharpie Marker, which was acknowledged by the Maricopa County Assistant Director of Recruitment and Training in email. The Assistant Director asked voting center personnel to suspend the use of Sharpie Markers, which would have been appropriate. However, the email directed voting personnel to distribute Sharpie Markers to Voters on Election Day with known issues and concerns. This change to the process (i.e., use of Sharpie Markers) was not documented; the risk was not evaluated.