7.15

Risk Assessment

Principle 7 - Identify, Analyze, and Respond to Risks

Attribute 7.15 - Management documents the results of the risk assessments, including the identification, analysis, and response to risks, that are completed on both a periodic and ongoing basis. This includes documentation of the consideration of risks related to fraud, improper payments, information security, and significant internal and external changes that could impact the internal control system [documentation requirement].

Empasis on documentation was added by US Government Accountability Office.

>>>Navigational Buttons<<<

• Index of Attributes
• Previous Attribute - 7.14
• Next Attribute - 8.01

Jamie's Story

June 25, 2025: Runbeck Contract Delivered

This Green Book Attribute requires documentation of risk assessments, which was not included in the Runbeck contracts provided by Maricopa County.

March 12, 2026: Maricopa County Defense Briefing

The discussion of Attribute 7.15 is from this March 12, 2026 event, under the subheading of Motor Vehicle Department Contract.

MC was unable to provide contract or other suitable documentation to describe the risk and mitigation thereof between MC and the Motor Vehicle Department (MVD). This attribute applies to information security, which was obviously compromised based on a press released submitted by Adrian Fontes, the Arizona Secretary of State, on September 30, 2024, indicating over 218,000 Arizona residents were adversely affected by a “coding error.” Contrary to the Green Box, MC did not create or retain any documentation describing the interface between MC and the MVD.

June 1, 2026: Judge's Decision

Maricopa County was not required to answer questions relating to fraud. Nor were they required to produce documentation explaining internal controls to prevent, detect or mitigate fraud because this was not a statutory requirement.

Election Anomalies

Principle 7 addresses the need to Identify, Analyze, and Respond to Risks. The identification and analysis of risk are presumed to have been performed at the state level, which are addressed in the Arizona Secretary of State's Election Procedure Manual. The MC leadership team's Response to Risk is the primary governance weakness with respect to the Green Book's Principle #7, including this attribute.

Arizona Senate Allegations

Arizona Senate allegations arose from MC's failure to recognize the Arizona Senates Oversight Role. These allegations were investigated and reported on by the Arizona Attorney General's Office 2020 General Election Investigation. In their oversight role, the Arizona Senate sought to understand the risk to accurate tabulation of election results given the abundance of election-related anomalies.

The AZ AG's inspector did not refer to any procedures for operation and maintenance of the EMS and ancillary equipment during the investigation. Had these procedures been available, they would have most certainly been used and referenced as an information source. Procure instructions are more objective that the interviews. This potential deviation from the Green Book standard applies to the following Arizona Senate Allegations:

• Maricopa Election Management Server (2020)
  • MC EMS 2020 - Election Management System Database Purged
  • MC EMS 2020 - Election Files Deleted
  • MC EMS 2020 - Corrupt Ballot Images
  • MC EMS 2020 - Missing Ballot Images
  • MC EMS 2020 - Failure to Follow Basic Cyber Security Practices
  • MC EMS 2020 - Subpoenaed Equipment Not Yet Provided
  • MC EMS 2020 - Anonymous Logins
  • MC EMS 2020 - Dual Boot System Discovered
  • MC EMS 2020 - Operating System Logs Not Preserved
  • MC EMS 2020 - Internet Connections to the EMS

Maricopa Dropbox Collection (2020)

Governance issues identified from Arizona Attorney General's Office 2020 General Election Investigation of Arizona Senate allegations of Maricopa County Election Department - Drop Box Collections issues. Section 2 of the AZ AG's inspector's report identifies numerous issues, which present risk to potential fraud. The Green Book requires documentation for risk analyses. None were performed with the assumption no documentation was available for the AZ AG's inspector to review. Documentation for risks associated from the following issues would have been expected if good governance had been applied:

• See the heading Deviation: Missing Entries on Election Forms from Maricopa Dropbox Collection (2020) webpage.
• See the heading Deviation: Missing Ballot Counts from Maricopa Dropbox Collection (2020) webpage.
• See the heading Deviation: Used Email instead of EVBTS Forms from Maricopa Dropbox Collection (2020) webpage.
• See the heading Deviation: Unfulfilled Party Representation Requirements for Couriers from Maricopa Dropbox Collection (2020) webpage.
• See the heading Deviation: Fictious Addresses in MC Voter Registration Database from Maricopa Dropbox Collection (2020) webpage.
• See the heading Deviation: Allegations Confirmed from Maricopa Dropbox Collection (2020) webpage.
• See the heading Noteworthy: Consequences Unknown from Maricopa Dropbox Collection (2020) webpage
• See the heading Noteworthy: Transmission of USPS Data to MC and Runbeck from Maricopa Dropbox Collection (2020) webpage

Maricopa County Signature Verification (2020)

Governance issues identified from Arizona Attorney General's Office 2020 General Election Investigation of Arizona Senate allegations of Maricopa County - Signature Verification Process issues. There was no documentation of a risk analysis for the Signature Verification step during the processing of early ballots.