12.02

Control Activities

Principle 12 - Implement Control Activities

Attribute 12.02 - Management establishes control activities by documenting in policies what is expected and in procedures specified actions that implement policies, to mitigate risks to achieving the entity's objectives to acceptable levels [documentation requirement].

Note: The GAO emphasized "documentation requirements."

>>>Navigational Buttons<<<

• Index of Attributes
• Previous Attribute - 12.01
• Next Attribute - 12.03

Jamie's Story

No examples are available to illustrate governance gaps for this attribute.

Election Anomalies

Arizona Senate Allegations

Arizona Senate allegations arose from MC's failure to recognize the Arizona Senates Oversight Role. These allegations were investigated and reported on by the Arizona Attorney General's Office 2020 General Election Investigation. The AZ AG's inspector relied on interviews to determine Information Technology (IT) practices. Evidently, no procedures were available for the inspector's review. Documented procedures ensure consistency in operations. This governance gap is most relevant to the indeterminate findings of the investigation, which are as follows:

• Maricopa Election Management Server (2020)
  • MC EMS 2020 - Election Management System Database Purged
  • MC EMS 2020 - Election Files Deleted
  • MC EMS 2020 - Corrupt Ballot Images
  • MC EMS 2020 - Missing Ballot Images
  • MC EMS 2020 - Anonymous Logins
  • MC EMS 2020 - Dual Boot System Discovered
  • MC EMS 2020 - Operating System Logs Not Preserved

Maricopa Dropbox Collection (2020)

Governance issues identified from Arizona Attorney General's Office 2020 General Election Investigation of Arizona Senate allegations of Maricopa County Election Department - Drop Box Collections issues. The AZ AG's inspector's report describes how MC should update the voter registration database to remove invalid voters based on invalid addresses. Given the significance of the update, an internal control document should have existed to describe how the voter registration database should be updated based on USPS undelivered early ballots. The AZ AG's inspector did not make any reference to such a critical update, which leads this assessment to conclude this control feature, which is needed to prevent fraud, has not been documented.

Maricopa County Signature Verification (2020)

Governance issues identified from Arizona Attorney General's Office 2020 General Election Investigation of Arizona Senate allegations of Maricopa County - Signature Verification Process issues. The AZ AG inspector notes that training was developed, "which mirrors recommendations by the Arizona Secretary of State's Office." Normally, an investigator would have referenced the document that directly controls the process. Apparently, there was no MC guidance for the training, so the Arizona requirement was referenced.

2020 Maricopa County Directs Use of Sharpie Pens

The Maricopa County Assistant Director of Recruitment and Training directed unethical activities, defeating an internal control. The leader informally instructed personnel using email to use Sharpie Markers on Election Day, despite known issues and concerns with the Sharpie Markers. This senior management person was interfering with internal controls.