7.15
Risk Assessment
Principle 7 - Identify, Analyze, and Respond to Risks
Attribute 7.15 - Management documents the results of the risk assessments, including the identification, analysis, and response to risks, that are completed on both a periodic and ongoing basis. This includes documentation of the consideration of risks related to fraud, improper payments, information security, and significant internal and external changes that could impact the internal control system [documentation requirement].
Empasis on documentation was added by US Government Accountability Office.
>>>Navigational Buttons<<<
- Index of Attributes
- Previous Attribute - 7.14
- Next Attribute - 8.01
Jamie's Story
The discussion of Attribute 7.15 is from this March 12, 2026 event, under the subheading of Motor Vehicle Department Contract.
MC was unable to provide contract or other suitable documentation to describe the risk and mitigation thereof between MC and the Motor Vehicle Department (MVD). This attribute applies to information security, which was obviously compromised based on a press released submitted by Adrian Fontes, the Arizona Secretary of State, on September 30, 2024, indicating over 218,000 Arizona residents were adversely affected by a “coding error.” Contrary to the Green Box, MC did not create or retain any documentation describing the interface between MC and the MVD.
Election Anomalies
Governance issues identified from Arizona Attorney General's Office 2020 General Election Investigation of Arizona Senate allegations of Maricopa County Election Department - Drop Box Collections issues. Section 2 of the AZ AG's inspector's report identifies numerous issues, which present risk to potential fraud. The Green Book requires documentation for risk analyses. None were performed with the assumption no documentation was available for the AZ AG's inspector to review. Documentation for risks associated from the following issues would have been expected if good governance had been applied:
- See the heading Deviation: Missing Entries on Election Forms from Maricopa Dropbox Collection (2020) webpage.
- See the heading Deviation: Missing Ballot Counts from Maricopa Dropbox Collection (2020) webpage.
- See the heading Deviation: Used Email instead of EVBTS Forms from Maricopa Dropbox Collection (2020) webpage.
- See the heading Deviation: Unfulfilled Party Representation Requirements for Couriers from Maricopa Dropbox Collection (2020) webpage.
- See the heading Deviation: Fictious Addresses in MC Voter Registration Database from Maricopa Dropbox Collection (2020) webpage.
- See the heading Deviation: Allegations Confirmed from Maricopa Dropbox Collection (2020) webpage.
- See the heading Noteworthy: Consequences Unknown from Maricopa Dropbox Collection (2020) webpage
- See the heading Noteworthy: Transmission of USPS Data to MC and Runbeck from Maricopa Dropbox Collection (2020) webpage
Governance issues identified from Arizona Attorney General's Office 2020 General Election Investigation of Arizona Senate allegations of Maricopa County - Signature Verification Process issues. There was no documentation of a risk analysis for the Signature Verification step during the processing of early ballots.
