Principle 17 - Evaluate Issues and Remediate Deficiencies
17.0 Evaluate Issues and Remediate Deficiencies
External Link to US GAO Green Book Principle 17
Overview
17.01
Management should remediate identified internal control deficiencies on a timely basis.
17.1 Reporting of Issues
17.02
Personnel report internal control issues through established reporting lines to the appropriate internal and external parties on a timely basis to enable the entity to promptly evaluate those issues and complete corrective action to remediate issues that rise to the level of internal control deficiencies.
I don’t think we can support a deviation for this because we didn’t ask for CAP documents in the original PRR. Did you ask for CAP documents? If so, who, what, when, where, how?
17.03
Personnel may identify internal control issues while performing their assigned internal control responsibilities. Personnel communicate these issues internally to the person in the key role responsible for the internal control or associated process and, when appropriate, to at least one level of management above that individual. Depending on the nature of the issues, personnel may consider reporting certain issues to the oversight body or an established hotline. Such issues may include
- issues that cut across the organizational structure or extend outside the entity to service organizations, contractors, or suppliers and issues that may not be remediated because of the interests of management, such as sensitive information regarding fraud or other illegal acts.
We have no documentation of this, but the Covid-19 Pandemic likely caused issues that cut across organizational boundaries
17.04
Depending on the entity’s regulatory or compliance requirements, the entity may also be required to report issues externally to appropriate external parties, such as the legislators, regulators, and standard-setting.
I don’t think we have a deviation here.
17.2 Evaluation of Issues
17.05
Management evaluates and documents internal control issues and determines appropriate corrective actions for internal control deficiencies, including those reported from internal and external audits and evaluations, on a timely basis [documentation requirement]. Management evaluates issues identified through monitoring activities or reported by personnel to determine whether any of the issues rise to the level of an internal control deficiency. Internal control deficiencies require further evaluation and remediation by management. An internal control deficiency can be in the design, implementation, or operating effectiveness of the internal control and its related process. Management determines from the type of internal control deficiency the appropriate corrective actions to remediate it on a timely basis.
April 15, 2025: Public Records Request – There was no objective evidence was found to confirm an Maricopa evaluated any of the election anomalies that necessitated portions of the contracts to be stricken through and amendments added. Contrary to the Green Book, there was no documentation of the evaluation of the unexpected Covid-19 pandemic conditions that necessitate contract revisions.
17.3 Corrective Actions
17.06
Management completes and documents corrective actions to remediate internal control deficiencies, including those reported from internal and external audits and evaluations, on a timely basis [documentation requirement]. Depending on the nature of the deficiency, either the oversight body or management oversees the prompt remediation of deficiencies by communicating the corrective actions to the appropriate level of the organizational structure and delegating authority for completing corrective actions to appropriate personnel. Documentation of corrective actions may include
- root cause analysis,
- planned actions,
- interim milestones,
- completion dates,
- measurable indicators of compliance and remediation to assess and validate progress throughout the remediation process, and the entity official responsible for monitoring the status of the corrective actions.
April 15, 2025: Public Records Request – It could be debated as to whether the election-related contracts were revised as Corrective Action. However, no documentation was found to suggest these changes were implemented as corrective action to a formal evaluation. Contrary to the Green Book, no documentation was found to attribute the contract changes as corrective action to a formal evaluation.
17.07
Corrective actions may include changes to controls within each of the five components of internal control, such as providing training on identified risks or modifying or adding control activities. Management also updates the entity’s periodic risk assessment based on the results of monitoring activities and may consider performing ongoing risk assessments when internal control deficiencies are identified.
This will not make the list of Green Book deviations; it’s a permissive statement, “corrective actions may…”
17.08
Corrective actions also include remediating audit and evaluation findings. The remediation process begins when audit or other review results are reported to management. It is completed only after action has been taken that (1) corrects identified deficiencies, (2) produces improvements, or (3) demonstrates that the findings and recommendations do not warrant management action. Management, with oversight from the oversight body, monitors the status of remediation efforts so that they are completed on a timely basis.
I can’t see this being a deviation
Assessment Observations Compared to Green Book Components, Principles, & Attributes
Control Environment
Component: Control Environment - The foundation for an internal control system. It provides the discipline and structure to help an entity achieve its objectives.
- Principle 1 - Demonstrate Commitment to Integrity and Ethical Values
- Principle 2 - Exercise Oversight Responsibility
- Principle 3 - Establish Structure, Responsibility, and Authority
- Attributes (3.01, 3.02, 3.03, 3.04, 3.05, 3.06, 3.07, 3.08, 3.09, 3.10, 3.11, 3.12)
- Principle 4 - Demonstrate Commitment to Competence
- Attributes (4.01, 4.02, 4.03, 4.04, 4.05, 4.06, 4.07, 4.08)
- Principle 5 - Enforce Accountability
- Attributes (5.01, 5.02, 5.03, 5.04, 5.05, 5.06, 5.07, 5.08)
Risk Assessment
Component: Risk Assessment - The identification and analysis of risks facing the entity as it seeks to achieve its objectives. This assessment provides the basis for developing appropriate risk responses.
- Principle 6 - Define Objectives and Risk Tolerances
- Attributes (6.01, 6.02, 6.03, 6.04, 6.05, 6.06, 6.07, 6.08, 6.09, 6.10)
- Principle 7 - Identify, Analyze, and Respond to Risks
- Attributes (7.01, 7.02, 7.03, 7.04, 7.05, 7.06, 7.07, 7.08, 7.09, 7.10, 7.11, 7.12, 7.13, 7.14, 7.15)
- Principle 8 - Assess Fraud, Improper Payment, and Information
- Attributes (8.01, 8.02, 8.03, 8.04, 8.05, 8.06, 8.07, 8.08, 8.09, 8.10, 8.11, 8.12, 8.13, 8.14, 8.15, 8.16, 8.17, 8.18, 8.19, 8.20)
- Principle 9 - Identify, Analyze, and Respond to Change
- Attributes (9.01, 9.02, 9.03, 9.04, 9.05, 9.06, 9.07, 9.08, 9.09, 9.10, 9.11, 9.12, 9.13)
Control Activities
Component: Control Activities - The actions management establishes through policies and procedures to mitigate risks to achieving the entity's objectives to acceptable levels.
- Principle 10 - Design Control Activities
- Attributes (10.01, 10.02, 10.03, 10.04, 10.05, 10.06, 10.07, 10.08, 10.09, 10.10, 10.11, 10.12, 10.13, 10.14, 10.15, 10.16, 10.17, 10.18, 10.19, 10.20, 10.21, 10.22, 10.23)
- Principle 11 - Design General Control Activities over Information
- Attributes (11.01, 11.02, 11.03, 11.04, 11.05, 11.06, 11.07, 11.08, 11.09, 11.10, 11.11, 11.12, 11.13, 11.14, 11.15, 11.16, 11.17)
- Principle 12 - Implement Control Activities
- Attributes (12.01, 12.02, 12.03, 12.04, 12.05)
Information and Communication
Component: Information and Communication - The quality information management and other personnel communicate and use to support the internal control system.
- Principle 13 - Use Quality Information
- Attributes (13.01, 13.02, 13.03, 13.04, 13.05, 13.06, 13.07)
- Principle 14 - Communicate Internally
- Attributes (14.01, 14.02, 14.03, 14.04, 14.05, 14.06, 14.07, 14.08)
- Principle 15 - Communicate Externally
- Attributes (15.01, 15.02, 15.03, 15.04, 15.05, 15.06, 15.07, 15.08, 15.09)
Monitoring
Component: Monitoring - Activities management establishes and operates to assess the quality of performance over time and promptly resolve the findings of audits and other reviews.
- Principle 16 - Perform Monitoring Activities
- Attributes (16.01, 16.02, 16.03, 16.04, 16.05, 16.06, 16.07, 16.08, 16.09, 16.10)
- Principle 17 - Evaluate Issues and Remediate Deficiencies
- Attributes (17.01, 17.02, 17.03, 17.04, 17.05, 17.06, 17.07, 17.08)
