8.03

Risk Assessment

Principle 8 - Assess Fraud, Improper Payment, and Information Security Risk

Attribute 8.03 - Management identifies risks related to fraud, improper payments, and information security on a periodic and ongoing basis to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. To determine the scope and frequency of these assessments, management considers the entity's objectives, risk tolerances, any legal or regulatory requirements, and other factors. However, management may determine that the risk assessments need to be performed more frequently than required by legal or regulatory requirements due to the significance of risks or other factors, such as changes to programs. For example, to adequately identify risks related to improper payments for new programs, management may perform improper payment risk assessments for a certain program or activity on a more frequent and recurring basis, regardless of the required frequency in legal or regulatory requirements for such risk assessments.

>>>Navigational Buttons<<<

• Index of Attributes
• Previous Attribute - 8.02
• Next Attribute - 8.04

Jamie's Story

June 1, 2026: Judge's Decision

The Runbeck Contract that was provided to Jamie had numerous strikeouts and amendments that were poorly documented, especially during the Covid-19 pandemic. Maricopa County would not voluntarily explain these changes and they were not required to maintain documentation because they were not specified as a statutory requirement.

Election Anomalies

The Green Book's Principle 8 addresses Assess Fraud, Improper Payment, and Information Security Risk. Obviously, improper payments is not a concern during the Assessment of Election Anomalies. However, improper payments by MC county may exist, but would require a separate assessment.

The Green Book's emphasis on fraud and information security as separate risk assessment activity is intentional. MC may be able to defer to the Arizona Secretary of State's Election Procedure Manual as general steps taken to ensure the integrity of election results. Fraud occurs when loopholes are identified and exploited by the fraudsters. The implementers of election services (i.e., Arizona Counties) are better positioned to detect fraud and assess the risk of fraud because they are handling the data, not the state. Hence, governance gaps may be identified from patterns of poor assessment and response to risk with respect to election fraud and information security.

Arizona Senate Allegations

Arizona Senate allegations arose from MC's failure to recognize the Arizona Senates Oversight Role. These allegations were investigated and reported on by the Arizona Attorney General's Office 2020 General Election Investigation. MC Elected Officials and MC leadership took no action to investigate any of the following potential fraudulent activities to the satisfaction of the Arizona Senate and the AZ AG's inspector, which was unable to resolve the Senate's allegations:

• Maricopa Election Management Server (2020)
  • MC EMS 2020 - Election Management System Database Purged
  • MC EMS 2020 - Election Files Deleted
  • MC EMS 2020 - Corrupt Ballot Images
  • MC EMS 2020 - Missing Ballot Images
  • MC EMS 2020 - Failure to Follow Basic Cyber Security Practices
  • MC EMS 2020 - Subpoenaed Equipment Not Yet Provided
  • MC EMS 2020 - Anonymous Logins
  • MC EMS 2020 - Dual Boot System Discovered
  • MC EMS 2020 - Operating System Logs Not Preserved
  • MC EMS 2020 - Internet Connections to the EMS

Maricopa Dropbox Collection (2020)

Governance issues identified from Arizona Attorney General's Office 2020 General Election Investigation of Arizona Senate allegations of Maricopa County Election Department - Drop Box Collections issues. Section 2 of the AZ AG's inspector's report identifies numerous issues, which present risk to potential fraud.

This attribute states, "...management may determine that the risk assessments need to be performed more frequently than required by legal or regulatory requirements due to the significance of risks or other factors, such as changes to programs." This assessment knows of no known legal obligation for MC leadership to conduct period fraud assessments. However, the prevalence of news reports and legal precedings would have certainly suggested the need to conduct an internal assessment, which was not performed. Instead, the AZ AG's inspector identified the following deviations and noteworthy issues from a governance gap perspective.

• See the heading Deviation: Missing Entries on Election Forms from Maricopa Dropbox Collection (2020) webpage.
• See the heading Deviation: Missing Ballot Counts from Maricopa Dropbox Collection (2020) webpage.
• See the heading Deviation: Used Email instead of EVBTS Forms from Maricopa Dropbox Collection (2020) webpage.
• See the heading Deviation: Unfulfilled Party Representation Requirements for Couriers from Maricopa Dropbox Collection (2020) webpage.
• See the heading Deviation: Fictious Addresses in MC Voter Registration Database from Maricopa Dropbox Collection (2020) webpage.
• See the heading Deviation: Allegations Confirmed from Maricopa Dropbox Collection (2020) webpage.
• See the heading Noteworthy: Consequences Unknown from Maricopa Dropbox Collection (2020) webpage
• See the heading Noteworthy: Transmission of USPS Data to MC and Runbeck from Maricopa Dropbox Collection (2020) webpage

Maricopa County Signature Verification (2020)

Governance issues identified from Arizona Attorney General's Office 2020 General Election Investigation of Arizona Senate allegations of Maricopa County - Signature Verification Process issues. The Counties appear to embrace Arizona guidance that facilitates fraud and pushback of on any suggestion to address potential fraud. In this case, MC are doing the minimum and comply with the Arizona Secretary of State's Election Procedures Manual. MC has not assessed fraud risk from have a single person, the Signature Verifier, making quick seven-second decisions with loose standards. In 2020, 1,910,317 early ballots were processed through the Signature Verification step. However, only 587 bad signatures were identified (excluding early ballots flagged with no signature).