Open Recommendations

We recommend EAC OCIO develop and implement a flaw remediation plan for vulnerabilities that cannot be remediated within the policy recommended timeframes.

Establish regular coordination with NIST and review the accreditation procedures for voting system test labs to reduce potential areas of duplication or identify efficiencies.

Develop policies to ensure periodic meetings with voting system test laboratories and voting system manufacturers occur and the non-sensitive meeting minutes are published.

Update the records disposition schedule for the testing and certification program.

Utilize federal guidance to conduct a staffing assessment for the testing and certification program. As part of this, consider what technical competencies are required for the team and if any are already covered with the NIST review.

Identify, measure, and assess risks related to its testing and certification program, ideally as part of a broader enterprise risk management program.

We recommend EAC OCIO resolve conflicting baseline configuration settings for Windows 10 devices and ensure iPhones meet the agency’s configuration setting requirements.

We recommend EAC OCIO ensure information systems meet STIGs secure configuration settings as required by the agency’s policy.

We recommend EAC OCIO update its hardware inventory system to include the level of detail needed to manage devices according to Federal requirements and document management’s oversight and review.

We recommend EAC OCIO update its POA&M procedures and, in coordination with management, develop and maintain POA&M reports based on Federal requirements.

We recommend EAC OCIO update the agency’s SSP document to align with NIST requirements and include the network environment's current state.

We recommend EAC OCIO fully implement its GRC solution to manage and monitor cybersecurity risk activities required by NIST SP 800-39 and provide a centralized enterprise-wide view of all risk across the agency.

We recommend that the EAC require the Office to implement procedures to ensure federal expenditures are accounted for in the AS400 accounting system and in accordance with procedures in place for the accounting of local appropriations.

We recommend that the EAC require the Office to return $30,991 to the EAC for the unallowable and unsupported CARES Act grant expenditures noted.

We recommend that the EAC require the Office to Implement procedures and training to ensure adequate documentation is maintained to support the allowability of expenditures charged to the HAVA grants.

We recommend that the EAC require the Office to implement procedures to ensure federal expenditures are accurately identified in the Schedule of Expenditures of Federal Awards going forward.

We recommend that the EAC require the Office to implement procedures and training to ensure required Federal Financial Reports are timely filed.

Perform thorough routine reviews of Official Personnel Files to ensure the following:
(1) All relevant employee benefit election forms are appropriately documented and retained.
(2) The information processed on the Notification of Personnel Action (SF-50) agrees to the originating Request for Personnel Action (SF-52) form.
(3) The Notification of Personnel Action (SF-50) is appropriately authorized, evidenced by an electronic signature in Box 50.
(4) The appropriate Request for Personal Action (SF-52) and Notification of Personnel Action (SF-50) forms are complete.
(5) The appropriate Request for Personal Action (SF-52) and Notification of Personnel Action (SF-50) forms are retained.
(6) Overall Official Personnel Files are complete and accurate.

Utilize an internal shared folder to store documentation so that it is readily available for authorized EAC personnel to access.

Implement appropriate segregation of duties so that no one individual or team controls custody of documentation to support transactions.

Perform periodic reviews of records to ensure that all relevant documentation is appropriately stored and accessible.

Provide BFS with all necessary documentation to support transactions recorded in the financial system. Ensure that copies are maintained by BFS in addition to EAC.

Review and maintain documentation processed and stored by GSA, to ensure that EAC can access relevant information when necessary.

Document policies and procedures for the maintenance and retrieval of documentation, including the responsibilities of EAC personnel and the responsibilities of EAC’s service providers.

Utilize a contracting officer(s), such as their designated service provider, to enter into all new contracts on behalf of the EAC.

Review all current open obligations and identify all contracts entered into without proper authorization and have the EAC and/or service provider contracting officer ratify the contracts. Ensure that the authorization is properly documented.

Ensure that all signed contracts are appropriately retained by EAC and or their service provider.

We recommend that the EAC require the Office to return $77,074 to the EAC for CARES expenditures outside of the budget period.

We recommend that the EAC require the Office to transfer to the Election Security election fund $130,945 for the unsupported non-payroll expenditures and $18,673 and associated fringe benefits for the unsupported payroll expenditures.

We recommend that the EAC require the Office to return $8,811 and associated fringe benefits to the EAC for the unsupported CARES Act payroll expenditures.

We recommend that the EAC require the Office to implement procedures and training to ensure adequate documentation is maintained to support the allowability of expenditures charged to the HAVA grants.

We recommend that the EAC require the Office to implement procedures to ensure interest is earned on any election funds received going forward.

We recommend that the EAC address and resolve the following recommendation that the Office perform a reconciliation of the grant activity for the Election Security grant through March 31, 2022 to ensure that all expenditures are fully disclosed and reconcile into the fund balance.

We recommend that the EAC address and resolve the following recommendation that the Office prepare and submit revised financial reports to the EAC for Election Security activities as of March 31, 2022.

We recommend that the EAC address and resolve the following recommendation that the Office implement procedures and training to ensure proper reporting of HAVA grant activity on future financial reports.

We recommend that the EAC require the Office to implement a policy to ensure amounts reported on the Territory-wide SEFA are properly identified by ALN title and number in compliance with Uniform Guidance.

We recommend that the EAC require the Office to implement a policy to ensure property purchased with federal funds is used, managed, and disposed in accordance with the Office’s procedures.

We recommend that the EAC require the Office to ensure all property purchased with Federal funds is placed on a compliant property record.

Separate the head of procurement position from human resources and administration and fill the position with an individual who has the appropriate knowledge, skills, and experience for the role, if EAC determines that they will continue the practice of executing procurements internally.

Perform a risk assessment of all nonexpired internal procurements and determine which, if any, should be re-awarded using competitive procedures.

Update the EAC Procurement Handbook to reflect current requirements in the Federal Acquisition Regulation.

For EAC program offices that routinely contract for goods or services, designate one or more contracting officer’s representatives, and provide training to them that meets the requirements set forth by the Office of Federal Procurement Policy.

Issue letters of delegation to contracting officer’s representatives assigned to work on all nonexpired internal contracts.

For each nonexpired internal contract that names a former employee as the alternate contracting officer’s representative, modify the contract to name a current contracting officer’s representative.

Implement an acquisition planning process for the Commission.

Create contract files containing required information for all nonexpired internal contracts.

Complete contractor performance evaluations for all nonexpired internal contracts.

Record the required procurement information for all nonexpired internal contracts in the Federal Procurement Data System.

Implement a process to ensure timely and accurate reporting of contractual obligations to the Federal Procurement Data System.

Rescind contracting authority from the executive director position until the individual in the position meets the requirements of the Federal Acquisition Certification in Contracting (FAC-C) Program set by the Office of Federal Procurement Policy.

Determine the allowability of $400,696 in questioned costs ($382,645 unsupported; $18,051 ineligible) under CARES Act Award NC20101CARES-01 and recover any amount that is unallowable.

Determine the allowability of $324,753 in questioned costs ($320,344 unsupported; $4,409 ineligible) under Election Security Award NC20101001-01 and recover any amount that is unallowable.

Require the North Carolina State Board of Elections to strengthen its policies and procedures for subawardee monitoring, including the procedures for reviewing invoices and supporting information submitted by subawardees.

Require the North Carolina State Board of Elections to implement procedures and training to ensure assets purchased with HAVA funds are completely documented in the Fixed Asset System and asset tags are affixed to the asset in a visible location.

We recommend that EAC strengthen the procedures for monitoring grantees’ compliance with the applicable requirements for interest income earned on HAVA grant funds.

We recommend that EAC work with Alabama to:
a. Determine an adequate allocation methodology, recalculate the interest allocations from the inception of the 2018 Election Security grant using this methodology, and correct the reporting of interest income on the September 30, 2022, and any subsequently filed, Election Security and Section 251 Federal Financial Reports.
b. Implement procedures to ensure that proper supporting documentation is maintained to support the amounts reported to EAC on the Federal Financial Reports.
c. Ensure the implementation of proper written policies and procedures regarding the calculation and reporting of interest income.

We recommend that EAC work with Connecticut to:
a. Correct the interest income reported on the September 30, 2022, and any subsequently filed, Election Security Federal Financial Reports.
b. Implement procedures to ensure accurate reporting on future Federal Financial Reports and to ensure that supporting documentation is maintained to support the amounts reported to EAC on the Federal Financial Reports.
c. Ensure the implementation of proper written policies and procedures regarding the calculation and reporting of interest income.
d. Implement procedures to ensure that subgrantees are properly informed of the federal requirements related to interest income and the need for subgrantees to report interest income earned, if applicable.

We recommend that EAC work with Florida to ensure the implementation of proper written policies and procedures regarding the calculation and reporting of interest income.

We recommend that EAC work with Hawaii to:
a. Determine the amount of any lost interest due to the delays in the earning of interest on the 2022 Election Security grant funds, and to ensure the amount is deposited into the election fund.
b. Determine the amount of Election Security interest that was incorrectly posted to the accounting system fund for the Section 101 and Section 251 grants, move the amounts to the appropriate fund in the accounting system, and file corrected Federal Financial Reports for the September 30, 2022, and any subsequently filed, Election Security, Section 101 and Section 251 grants.
c. Implement procedures to ensure that future EAC grants are deposited into an interest-bearing election fund on a timely basis.

We recommend that EAC work with Illinois to ensure the implementation of proper written policies and procedures regarding the calculation and reporting of interest income.

We recommend that EAC work with Kansas to:
a. Correct the interest income reported on the September 30, 2022, and any subsequently filed, Election Security and Section 251 Federal Financial Reports.
b. Implement procedures to ensure accurate reporting on future Federal Financial Reports.

We recommend that EAC work with Kentucky to:
a. Determine that the September 30, 2022, and any subsequently filed, Election Security Federal Financial Reports are properly corrected to reflect the revised interest allocations.
b. Ensure the implementation of proper written policies and procedures regarding the calculation and reporting of interest income.

We recommend that EAC work with Louisiana to implement procedures to ensure that proper supporting documentation is maintained to support the amounts reported to EAC on the Federal Financial Reports.

We recommend that EAC work with Maine to:
a. Determine the amount of lost interest due to the delay in establishing the funds as interest bearing with the Treasury and ensure that the amount is deposited into the election fund.
b. Implement procedures to ensure that the Treasury is notified in a timely manner of the need to earn interest on future HAVA grants.

We recommend that EAC work with Mississippi to:
a. Correct the interest income reported on the September 30, 2022, and any subsequently filed, Election Security Federal Financial Reports.
b. Implement procedures to ensure accurate reporting on future Federal Financial Reports and to ensure that supporting documentation is maintained to support the amounts reported to EAC on the Federal Financial Reports.
c. Ensure the implementation of proper written policies and procedures regarding the calculation and reporting of interest income.
d. Determine the amount of any lost interest due to the delays in the earning of interest on the 2022 Election Security grant funds, and the amount should be deposited into the election fund.
e. Implement procedures to ensure that future EAC grants are deposited into an interest-bearing election fund on a timely basis.

We recommend that EAC work with New Hampshire to:
a. Correct the interest income reported on the September 30, 2022, and any subsequently filed, Election Security and Section 251 Federal Financial Reports, including determining the proper reporting on the Section 251 Federal Financial Reports for the Voter Checklist sales.
b. Implement procedures to ensure accurate reporting on future Federal Financial Reports.
c. Ensure the implementation of proper written policies and procedures regarding the calculation and reporting of interest income.

We recommend that EAC work with New Mexico to:
a. Correct the interest income reported on the September 30, 2022, and any subsequently filed, Election Security Federal Financial Reports.
b. Implement procedures to ensure accurate reporting on future Federal Financial Reports.

We recommend that EAC work with Puerto Rico to ensure that interest is now being properly credited to HAVA grant funds in a timely manner and that all lost interest is properly calculated and deposited into the election fund.

We recommend that EAC work with South Carolina to:
a. Develop proper allocation calculation procedures, recalculate the interest allocations from the inception of the 2018 Election Security grant using this methodology, and correct the reporting of interest income on the September 30, 2022, and any subsequently filed, Election Security and Section 251 Federal Financial Reports.
b. Implement procedures to ensure that proper supporting documentation is maintained to support the amounts reported to EAC on the Federal Financial Reports.
c. Ensure the implementation of proper written policies and procedures regarding the calculation and reporting of interest income.

We recommend that EAC work with South Dakota to:
a. Correct the interest income reported on the September 30, 2022, and any subsequently filed, Section 251 Federal Financial Reports.
b. Implement procedures to ensure accurate reporting on future Federal Financial Reports.

We recommend that EAC work with Utah to:
a. Correct the interest income reported on the September 30, 2022, and any subsequently filed, Election Security Federal Financial Reports.
b. Implement procedures to ensure accurate reporting on future Federal Financial Reports.
c. Ensure the implementation of proper written policies and procedures regarding the calculation and reporting of interest income.
d. Determine the amount of lost interest due to the delay in investing 2018 Election Security funds and ensure that the amount is deposited into the election fund.
e. Implement procedures to ensure that the Treasury is notified in a timely manner of the need to earn interest on future HAVA grants.

We recommend that EAC work with Vermont to:
a. Correct the interest income reported on the September 30, 2022, and any subsequently filed, Section 251 Federal Financial Reports.
b. Implement procedures to ensure accurate reporting on future Federal Financial Reports.

We recommend that EAC work with West Virginia to:
a. Determine the proper allocation of interest for September 2018 and to correct the September 30, 2022, and any subsequently filed, Election Security and Section 251 Federal Financial Reports.
b. Implement procedures to ensure accurate reporting on future Federal Financial Reports.

We recommend that EAC work with Wyoming to implement procedures to ensure that subgrantees are properly informed of the federal requirements related to interest income and the need for subgrantees to report interest income earned, if applicable.