Open Recommendations

We recommend that the EAC require the Office to implement procedures to ensure federal expenditures are accounted for in the AS400 accounting system and in accordance with procedures in place for the accounting of local appropriations.

Review all current open obligations and identify all contracts entered into without proper authorization and have the EAC and/or service provider contracting officer ratify the contracts. Ensure that the authorization is properly documented.

Update the EAC Procurement Handbook to reflect current requirements in the Federal Acquisition Regulation.

Complete contractor performance evaluations for all nonexpired internal contracts.

Record the required procurement information for all nonexpired internal contracts in the Federal Procurement Data System.

Implement a process to ensure timely and accurate reporting of contractual obligations to the Federal Procurement Data System.

We recommend that EAC work with Connecticut to:a. Correct the interest income reported on the September 30, 2022, and any subsequently filed, Election Security Federal Financial Reports.b. Implement procedures to ensure accurate reporting on future Federal Financial Reports and to ensure that supporting documentation is maintained to support the amounts reported to EAC on the Federal Financial Reports.c. Ensure the implementation of proper written policies and procedures regarding the calculation and reporting of interest income.d. Implement procedures to ensure that subgrantees are properly informed of the federal requirements related to interest income and the need for subgrantees to report interest income earned, if applicable.

We recommend that EAC work with Kansas to:a. Correct the interest income reported on the September 30, 2022, and any subsequently filed, Election Security and Section 251 Federal Financial Reports.b. Implement procedures to ensure accurate reporting on future Federal Financial Reports.

We recommend that EAC work with Maine to:a. Determine the amount of lost interest due to the delay in establishing the funds as interest bearing with the Treasury and ensure that the amount is deposited into the election fund.b. Implement procedures to ensure that the Treasury is notified in a timely manner of the need to earn interest on future HAVA grants.

We recommend that EAC work with Mississippi to:a. Correct the interest income reported on the September 30, 2022, and any subsequently filed, Election Security Federal Financial Reports.b. Implement procedures to ensure accurate reporting on future Federal Financial Reports and to ensure that supporting documentation is maintained to support the amounts reported to EAC on the Federal Financial Reports.c. Ensure the implementation of proper written policies and procedures regarding the calculation and reporting of interest income.d. Determine the amount of any lost interest due to the delays in the earning of interest on the 2022 Election Security grant funds, and the amount should be deposited into the election fund.e. Implement procedures to ensure that future EAC grants are deposited into an interest-bearing election fund on a timely basis.

We recommend that EAC work with Puerto Rico to ensure that interest is now being properly credited to HAVA grant funds in a timely manner and that all lost interest is properly calculated and deposited into the election fund.

We recommend that EAC work with South Dakota to:a. Correct the interest income reported on the September 30, 2022, and any subsequently filed, Section 251 Federal Financial Reports.b. Implement procedures to ensure accurate reporting on future Federal Financial Reports.

We recommend that EAC require the DOS to implement procedures to ensure property purchased with federal funds is used, managed, and disposed of properly.

We recommend that EAC confirm that the Georgia Secretary of State’s Office implements corrective action to address recommendation 8 in Report Number 21-11 issued by the Georgia Department of Audits and Accounts.

We recommend that EAC calculate lost interest due to the untimely deposit of 2018 and 2020 Election Security funds and ensure any amounts due are deposited into to the election fund.

We recommend that EAC require the Georgia Secretary of State’s Office to reconcile interest earned reported by the Georgia Office of the State Treasurer and interest earned recorded on the general ledger and correct any impacted financial reports for the reissued Section 101, reissued Section 251, and Election Security awards.

We recommend that the Chief Information Security Officer identify qualitative and quantitative metrics on service level agreements held with third parties, then perform an analysis with monthly reporting received from those third parties to identify metrics that can be measured and documented, on either a monthly or quarterly basis, to ensure that EAC is receiving all contracted services.

We recommend that the Chief Information Security Officer develop and implement procedures to leverage the Repository for Software Attestation and Artifacts to obtain sufficient assurance that the security and supply chain controls of systems or services provided by contractors or other entities on behalf of the organization meet FISMA requirements.

We recommend that the Chief Information Security Officer provide annual Anti-Counterfeit Training for IT staff with SCRM responsibilities.

We recommend that the Election Assistance Commission's Chief Information Officer implement EL3 logging requirements in accordance with Office of Management and Budget memorandum M-21-31.

We recommend that the Election Assistance Commission's Chief Information Officer establish and implement a formal Information Security Continuous Monitoring Strategy and an effective monitoring mechanism to track the progress of ongoing lessons learned.

We recommend that the Election Assistance Commission's Chief Information Officer identify and employ an automated notification mechanism to test its system level contingency plans thoroughly and effectively.

We recommend that EAC management document policies and procedures for all significant process areas; including outlining the responsibilities of EAC personnel and the responsibilities of EAC’s service providers.

We recommend that EAC management ensure that all management and personnel, directly and indirectly responsible for performing processes outlined, have read, and understand the documented policies and procedures.

We recommend that EAC management perform periodic review of policies and procedures, and policies and procedures are updated in a timely manner.

We recommend that EAC management develop process narratives to assist new and transitioning personnel in understanding their scope of responsibilities and job function as well as help management perform review.

Implement travel procedures and processes for performing thorough routine reviews of travel authorizations, vouchers, and payments to ensure that all transactions are processed in accordance with the Federal Travel Regulation and that all appropriate supporting documentation is included with the submission of the travel voucher (for example, a signed voucher checklist). Include a provision for annual review.

Provide annual training to travelers on current policies and procedures as well as a copy of the EAC Travel Handbook.