10.10
Control Activities
Principle 10 - Design Control Activities
Attribute 10.10 - Control activities can be either preventive or detective. The main difference between preventive and detective control activities is timing, that is, when the control activity occurs within an entity's operations. A preventive control activity is designed to avoid an unintended event or result before it occurs. A detective control activity is designed to discover and timely correct an unintended event or result after it occurs. The effectiveness of a detective control activity depends on timeliness of the corrective action to address the unintended event or result. Corrective action may address the event that occurred or may correct the deficiencies in the process that led to the event.
>>>Navigational Buttons<<<
- Index of Attributes
- Previous Attribute - 10.09
- Next Attribute - 10.11
Jamie's Story
No examples are available to illustrate governance gaps for this attribute.
Election Anomalies
Governance issues identified from Arizona Attorney General's Office 2020 General Election Investigation of Arizona Senate allegations of Maricopa County - Signature Verification Process issues. The inspector's report identifies weaknesses with preventive and detective aspects of internal controls.
Consider the goal is to accurately count every valid vote, then the process should screen out ineligible votes to prevent the negating effects.
A preventive internal control would be to minimize excessive distribution of early ballots. Ideally, early ballots should be delivered to only eligible voters. The investigator notes 56,226 early ballots were undeliverable, meaning the address was invalid. If in the wrong hands, these ballots could be used for fraudulent purposes. Yet, there are more types of fraud, which includes distribution of early ballots to fictious people at a valid address. If MC allowed 56,226 invalid addresses in the voter registration database. How are we to believe they have no fictious people registered at valid addresses? Internal controls to prevent fraud appear ineffective.
A detective control would identify fraudulent early ballots if introduced into the tabulation process (e.g., deposited into a voting drop box). The inspector notes that 587 "bad" signatures were identified by the Signature Verifiers out of a population of 1,910,317 early ballots processed by MC Elections. A single person being the only means of detective fraud making decisions at a pace of one ballot per seven-seconds for eight hours a day (maybe longer) does not appear to be a robust internal control for the detection of fraudulent ballots.
There are weaknesses with internal controls for preventing and detecting fraud.
