7.06

Risk Assessment

Principle 7 - Identify, Analyze, and Respond to Risks

Attribute 7.06 - Risk identification methods may include qualitative and quantitative ranking activities, forecasting and strategic planning, data analytics, and consideration of internal control deficiencies identified through monitoring activities or reported by internal or external parties. Performing an analysis to identify the root causes of internal control deficiencies can assist management in identifying risks. Management also collaborates with relevant internal and external parties to identify risks. Internal parties include appropriate management and other personnel from all appropriate units within the entity's organizational structure, including program and financial managers. External parties may include service organizations, suppliers, contractors, regulated entities, federal entities, state and local governments, and grantees.

>>>Navigational Buttons<<<

• Index of Attributes
• Previous Attribute - 7.05
• Next Attribute - 7.07

Jamie's Story

No examples

Election Anomalies

Principle 7 addresses the need to Identify, Analyze, and Respond to Risks. The identification and analysis of risk are presumed to have been performed at the state level, which are addressed in the Arizona Secretary of State's Election Procedure Manual. The MC leadership team's Response to Risk is the primary governance weakness with respect to the Green Book's Principle #7, including this attribute.

Arizona Senate Allegations

Arizona Senate allegations arose from MC's failure to recognize the Arizona Senates Oversight Role. These allegations were investigated and reported on by the Arizona Attorney General's Office 2020 General Election Investigation. In their oversight role, the Arizona Senate sought to understand the risk to accurate tabulation of election results given the abundance of election-related anomalies. They sought a better understand of items that directly affected risk (e.g., data processing irregularities) as well as the indirect risk from the withholding of information by MC elected Officials and MC leadership.

Additionally, MC leadership did not conduct any internal investigation into the Arizona Senate's allegations to understand causal factors and root cause so that corrective actions could be implemented. This potential deviation from the Green Book standard applies to the following Arizona Senate Allegations:

• Maricopa Election Management Server (2020)
  • MC EMS 2020 - Election Management System Database Purged
  • MC EMS 2020 - Election Files Deleted
  • MC EMS 2020 - Corrupt Ballot Images
  • MC EMS 2020 - Missing Ballot Images
  • MC EMS 2020 - Anonymous Logins
  • MC EMS 2020 - Dual Boot System Discovered
  • MC EMS 2020 - Operating System Logs Not Preserved

Maricopa Dropbox Collection (2020)

Governance issues identified from Arizona Attorney General's Office 2020 General Election Investigation of Arizona Senate allegations of Maricopa County Election Department - Drop Box Collections issues. Section 2 of the AZ AG's inspector's report identifies numerous issues, which present risk to potential fraud.

This attribute specifically states, "Ongoing risk assessments are performed as needed, on a real-time basis, such as when significant internal or external change occurs or significant emerging risks are identified." External changes consisted of Public Health mandates associated with the Covid-19 pandemic. Rather than implement risk reduction actions, MC management appeared to ignore procedure requirements, which actually increased the risk of fraud. The following issues identified in the inspector's report are related to management actions or inaction related to increasing the risk of fraud:

Contrary to the Green Book statement, "Performing an analysis to identify the root causes of internal control deficiencies can assist management in identifying risks.", MC did not perform an investigation into any of the following anomalies or noteworthy situations:

• See the heading Deviation: Missing Entries on Election Forms from Maricopa Dropbox Collection (2020) webpage.
• See the heading Deviation: Missing Ballot Counts from Maricopa Dropbox Collection (2020) webpage.
• See the heading Deviation: Used Email instead of EVBTS Forms from Maricopa Dropbox Collection (2020) webpage.
• See the heading Deviation: Unfulfilled Party Representation Requirements for Couriers from Maricopa Dropbox Collection (2020) webpage.
• See the heading Deviation: Fictious Addresses in MC Voter Registration Database from Maricopa Dropbox Collection (2020) webpage.
• See the heading Deviation: Allegations Confirmed from Maricopa Dropbox Collection (2020) webpage.
• See the heading Noteworthy: Consequences Unknown from Maricopa Dropbox Collection (2020) webpage
• See the heading Noteworthy: Transmission of USPS Data to MC and Runbeck from Maricopa Dropbox Collection (2020) webpage

Contrary to the Green Book Statement, "Management also collaborates with relevant internal and external parties to identify risks.", MC management did not collaborate with the USPS to assess the risk of over 56,000 undeliverable early ballots.

• See the heading Deviation: Fictious Addresses in MC Voter Registration Database from Maricopa Dropbox Collection (2020) webpage.
• See the heading Noteworthy: Transmission of USPS Data to MC and Runbeck from Maricopa Dropbox Collection (2020) webpage