Loading...
HomeMy WebLinkAboutA0129 Election Report (PUBLISHED 9-29-25) Audit Report Election Integrity Maintained, Improved Accessibility and Data Security Transparency Needed To request this information in an alternate format, please call (541) 330-4674 or send email to internal.audit@Deschutes.org Take survey by clicking here Clerk’s Office—Elections—A0129 September 2025 Table of Contents: 1. Introduction ....................................................................................... 1 Background ..................................................................................................................... 2 Election Calendar and Activities ................................................................................ 2 2. Findings and Observations .............................................................. 6 Scope Impairment .......................................................................................................... 7 Auditor Cannot Draw Conclusions Related to Information Security ..................... 7 Findings ......................................................................................................................... 10 Ballot Drop Boxes Not Fully Accessible .................................................................. 10 Observations ................................................................................................................. 14 Voter Rolls Checked and Confirmed ....................................................................... 14 Signature Verification Worked ................................................................................ 16 Votes Cast Reflected Intent ...................................................................................... 18 Accommodations Offered, but Outreach Could Be Improved ............................. 20 3. Conclusion ........................................................................................ 21 4. Management Response .................................................................. 22 5. Appendix A: Objective, Scope, and Methodology ........................ 23 Objectives and Scope ................................................................................................... 23 Methodology ................................................................................................................. 24 Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor Highlights: Why this audit was performed: The electoral process is increasingly scrutinized and public confidence in elections has lost ground. In Deschutes County, the responsibility to uphold the integrity of elections is more vital than ever. We recommended that the County Clerk: Inspect drop boxes on a regular basis using Americans with Disabilities Act standards for accessible design. Create a plan for improving any boxes that do not meet checklist standards. Election Integrity Maintained, Improved Accessibility and Transparency Needed The objective of the audit was to determine whether the County’s election system was secure, accessible, and accurate. Auditors focused on information security for the ballot tabulation system, voter roll maintenance, the signature verification process, ballot adjudication, and accessibility for people with physical disabilities or language barriers. What was found: Overall, we found controls were working as intended. Voter rolls were appropriately maintained, signatures were verified, and staff properly interpreted voter intent. These observations inspire trust in the Deschutes County election process. However, we also found room for improvement in accessibility both for people with physical disabilities and those needing language assistance. Finally, the Clerk refused to provide auditors with information about information security related to ballot counting software. The Auditor cannot draw a conclusion related to information security for ballot counting software, provide assurance that the system is secure, or offer recommendations to support continuous improvement. Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor Page 1 of 25 1. Introduction Across the nation, we find ourselves in a moment where the electoral process is increasingly scrutinized and public confidence in elections has lost ground. In Deschutes County, the responsibility to uphold the integrity of elections is more vital than ever. The electoral system is the backbone of democracy and ensures that the voice of every citizen is heard and respected. Trust in elections is cultivated through attention to transparency, security, and inclusivity, reaffirming the value each vote contributes to our community's governance. The Clerk’s Office undertakes significant measures to ensure secure and accurate elections. Throughout the process, from maintaining voter rolls; to designing, printing, and mailing ballots; to verifying voter signatures; to interpreting voter intent; to tabulating and certifying results, staff rely on legal requirements and their own experience and expertise to ensure election integrity. Though the Office performs well in traditional election administration, increased voter diversity and concerns about data security present additional challenges. Sustaining a culture of continuous improvement will empower the Office to enhance transparency in information technology security and better support voters needing physical or language accommodations. The Deschutes County Audit Committee authorized a review of the election process in the Internal Audit Work Plan for Fiscal Years 2024 and 2025. Audit objectives, scope, and methodology can be found in Appendix A. Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor Page 2 of 25 Background The Deschutes County Clerk’s Office is responsible for overseeing elections and voter registration. The County Clerk is the chief election official in Deschutes County and is tasked with ensuring that elections are conducted according to Oregon Revised Statues and other requirements. The Office consisted of 11 employees, but only three were exclusively devoted to elections. Seven staff were dedicated to maintaining public records including recording documents related to real property transactions and other legal documents; accepting passport applications; issuing marriage licenses; and maintaining the County archive. The County Clerk oversaw both functions. During elections, the Office also hired temporary staff and assigned some staff normally devoted to records with election functions. Election Calendar and Activities Activities related to the May 2025 election began long before and extended beyond election day. Prior to the election, staff determined which elections should be on the ballot for voters located in different precincts and districts, checked ballot design for accuracy, and oversaw printing and mailing. After the election staff verified and challenged signatures and interpreted voter intent for ballots that could not be read by machine. The deadline for finalizing election results is 27 days after the election. Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor Page 3 of 25 Figure I: Timeline of May 2025 Election Activities Source: Clerk’s Office 2025 Election Calendar Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor Page 4 of 25 The Clerk’s Office published a document to explain the elections process in Deschutes County. Figure II: Clerk’s Office description of the elections process (part 1) 1. Voter Registration: To register to vote, you are required to provide valid identification proving that you are eligible to vote. After reviewing and verifying your information, we enter it into our voter registration database. 2. Equipment Testing: We use election equipment that is certified according to State and Federal standards. We test our election equipment before, during, and after each election. 3. Ballots Are Mailed: All registered voters are mailed a ballot packet containing their ballot and a postage-paid return envelope that has a printed security weave on the inside that protects your privacy and the secrecy of your vote. 4. Ballot Collection: Voters can return their voted ballot by mail or at one of our ten Official Ballot Drop Site locations, conveniently located throughout the county. Drop Site ballots are collected, and mailed ballots are received at our Clerk's Office located in the Deschutes Services Building for ballot tabulation. Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor Page 5 of 25 Figure III: Clerk’s Office description of the elections process (part 2) 5. Verify Voter Eligibility: Upon receipt of your ballot, it is sent through our ballot envelope sorting machine, which scans an image of your signature while sorting your ballot by voting precinct. Trained elections staff verify your envelope signature by comparing it to your signature on file in the voter registration database. 6. Processing Ballots: If your signatures match, your ballot envelope moves on to be opened. If they don't match, we contact you by mail to resolve the issue so we can count your ballot. If a ballot is damaged or contains machine- unreadable marks, we flag it for manual review. Our goal is to count all eligible ballots as voters intend. 7. Ballot Scanning and Tabulation: After ballots are removed from their envelopes, we scan the ballots and count all the valid votes to determine the results of each contest in the election. Our federally and state certified voting system is secure and never connected to the internet. 8. Ballot Adjudication: Teams of two staff, each of different political parties, review if ballots are damaged, have stray marks, or have corrections, undervotes, overvotes, and blank contests to verify voter intent and ensure accurate tabulation. All ballots are stored in a secure location under 24/7 surveillance. Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor Page 6 of 25 Figure IV: Clerk’s Office description of the elections process (part 3) 9. Unofficial Results: We begin publishing unofficial results after 8pm on Election Day. Results are unofficial until after all ballot return deadlines have passed and after we have counted every valid ballot we received. 10. Certification of Official Results: After the Board of Canvassers reviews and verifies the outcome of the election, official election results are certified by the county. 11. Audits: Audits are a normal check and balance that are part of every election. We use audits to confirm that election equipment accurately interpreted and tallied voters' ballots, that the outcome of the election reflects how voters voted, and that election workers followed procedures. 12. Ballot Storage: We securely store all paper ballots and other records as part of the official record for two years. After two years, the ballots are destroyed. Source: Clerk’s Office Deschutes County Elections Overview 2. Findings and Observations The objective of the audit was to determine whether the County’s election system was secure, accessible, and accurate. Reviewing the entire election process would have been too large a scope for one audit. Therefore, auditors conducted a risk assessment which resulted in a focus on information security for the ballot tabulation system, voter roll maintenance, the signature verification process, ballot adjudication, and accessibility for people with physical disabilities or language barriers. Overall, we found controls were working as intended. Voter rolls were appropriately maintained, signatures were verified, and staff Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor Page 7 of 25 properly interpreted voter intent. These observations inspire trust in the Deschutes County election process. However, we also found room for improvement in accessibility both for people with physical disabilities and those needing language assistance. Finally, the Clerk refused to provide auditors with information about information security related to ballot counting software. This scope impairment prevented the Auditor from drawing related conclusions. Scope Impairment Auditor Cannot Draw Conclusions Related to Information Security Due to the Clerk’s refusal to cooperate with part of the audit process, the Auditor cannot draw a conclusion related to information security for ballot counting software, provide assurance that the system is secure, or offer recommendations to support continuous improvement. One of the objectives for this audit was to assess information technology security for the ballot counting system using a checklist based on National Institute of Standards and Technology criteria. The Auditor’s Office has significant experience reviewing information security at this level based on integrated audit reviews. Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor Page 8 of 25 Technology is an integral component of modern elections, and its reliability is a major public concern. The Clerk’s Office uses software called Clear Ballot to tally ballot votes. The Secretary of State reviews and certifies that the software complies with state rules related to information security and is authorized for use by county elections offices. However, it is up to county elections offices to implement appropriate user controls, such as access control and system updates, to ensure that the software is secure. The Clerk described the Office's information systems as the "backbone" of elections because of how heavily the Office relies on technology. But the reliance on technology comes with risks and bad actors can try to access information systems to disrupt elections or change outcomes. During the initial risk assessment phase, community members expressed concerns about information technology risk due to its critical role in election security. Despite differing perspectives, Republicans expressing concerns versus Democrats and the League of Women Voters expressing confidence, the Auditor decided to include a security review to either assure stakeholders or recommend improvements. Previous findings related to information security also contributed to a heightened sense of risk in this area. During a 2024 integrated audit, auditors found that Clerk’s Office recording staff (not elections staff) disabled supervisor review and segregation of duties controls in software to make it easier to void receipts and to circumvent review processes. Staff were also using shared logins due to a perception that logging in and out of shared workstations took too much time. We recommended the Office either resolve these control issues or formally accept the risk of not implementing controls. Staff chose to resolve the controls issues. We also found that software access rights had not been updated during a 2008 cash handling audit. Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor Page 9 of 25 During the audit, the Clerk refused to discuss or provide any information related to Clear Ballot including • The elections security plan required by Oregon Revised Statute 254.074 • Any information technology security procedures that considered risk, addressed general and application controls, and ensured that users could be held accountable for their actions • Documentation of staff review of information technology security procedures • Information technology training records for staff with access to Clear Ballot system • A desk review of Clear Ballot components (design, tabulation, etc.) and demonstration of reports available. • Conducting the Information Security checklist Deschutes County Code section 2.14.060 states “All officers and employees of Deschutes County shall furnish the Office of County Internal Audit with unrestricted access to employees, information and records.” The Clerk cited Oregon Revised Statute 254.074 as a barrier to providing information, however this statute mandates filing security plans with the Secretary of State rather than prohibiting disclosure to auditors. It exempts security plans from disclosure through public records requests, but audit requests are not public records requests, and the Auditor often requires access to confidential information when conducting audits. Absence of additional legal justification from either the Clerk or the Secretary of State's Office suggests a lack of valid grounds for refusal. As a result, the Auditor cannot draw conclusions, provide assurance, or recommend improvements related to Clerk’s Office use of the Clear Ballot system. Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor Page 10 of 25 Findings Ballot Drop Boxes Not Fully Accessible Inaccessible ballot drop boxes can result in voter exclusion and damage public trust in the electoral system. Deschutes County had 11 ballot drop-sites located across the County. The Deschutes Services Center in downtown Bend offered outdoor walk-up and drive-through options and another walk-up box inside the Clerk’s Office on the second floor. Other locations had only one box without a designation. Though it was not designated as such in the Voter’s Pamphlet, the Clerk said that the ballot box located at Sisters City Hall was also a walk-up location. Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor Page 11 of 25 Figure V: Deschutes County Drop Box Locations Source: www.deschutes.org/clerk/page/ballot-drop-box-locations The United States Department of Justice publishes a checklist to determine whether ballot drop boxes are accessible according to the 2010 Americans with Disabilities Act standards for accessible design. The checklist includes aspects such as: • Clear ground space in front of the box • Firm and slip-resistance flooring • Floor space free from gaps or holes greater than ½ inch • Level floor space Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor Page 12 of 25 • Handles and openings between 15 and 48 inches from the ground Drop boxes met most of the criteria in the checklist, but seven of 11 exceeded the maximum height of 48 inches and four of 11 had access areas with pavement gaps larger than ½ inch. Figure VI: Some ballot boxes did not meet accessibility standards for pavement gaps and height. Location Gaps Height Bradbury Park & Ride Yes 49" Clerk’s Office No 43” Deschutes County Fair & Expo Center Yes 50" Deschutes County Road Department No 54" Deschutes Services Center No 43" La Pine Public Library Yes 49" Old Mill No 51” Pine Nursery Park Yes 43" Sisters City Hall No 43" Sunriver Public Library No 49" Redmond Public Library No 49" Source: Auditor Observation Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor Page 13 of 25 Figure VII: Photos of drop boxes with openings above 48” and gaps wider than ½” Ballot box height exceeded 48 inches at the Old Mill. Gaps in pavement at the Fair and Expo Center. A gate at the Bradbury Park and Ride site prevented use as a drive-up location. Source: Auditor Observation The Clerk contended that Americans with Disabilities Act standards did not apply because some boxes are exempt as drive-up structures. However, this interpretation raises questions about how drive-up locations were identified and how drive-up location designations affected the compliance of the overall system. Regardless of whether exemptions applied to drive-up locations, the physical specifications of many drop boxes, specifically, the height of openings exceeding the 48-inch limit and pavement gaps, fell short of design standards intended to ensure access for people with disabilities. The existing state of many drop boxes created a tangible barrier to accessibility. Clerk’s Office staff inspected drop boxes before and during elections but did not check them for criteria contained in the Americans with Disabilities Act checklist. The Office also did not have a plan for addressing height and pavement issues at drop box locations. Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor Page 14 of 25 Clerk’s Office staff should inspect drop boxes on a regular basis using Americans with Disabilities Act standards for accessible design. Clerk’s Office staff should create a plan for improving any boxes that do not meet standards. Observations Voter Rolls Checked and Confirmed During the audit risk assessment, we heard concerns from community members about ineligible people voting including unreasonable numbers of people registered at single family households (some of whom may no longer live in Deschutes County) and deceased people registered to vote. To register to vote in Oregon, a person must be: • A United States citizen • A resident of Oregon • At least 16 years old (Those who are under 18 years old do not receive a ballot until an election occurs on or after their 18th birthday.) Counties are required to perform routine voter file maintenance throughout the year. Clerk’s Office staff described many of the tasks they perform to maintain voter records including review of: • Information submitted by voters through paper forms, online registrations via OregonVotes.gov, and qualifying Department of Moter Vehicle transactions • Post Office records including the National Change of Address database and returned mail • The national voter Electronic Registration Information Center (ERIC) database Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor Page 15 of 25 • Deceased records including State and County Health Departments, Social Security Administration, and online/print newspaper obituaries Residents can also play a role in helping to maintain voter rolls: • In some cases, a ballot may be mailed to a voter who has changed residence before the Clerk’s Office is aware that the person has moved. The new resident can write “Return to Sender” on the envelope and put it back in the mail. The ballot will be returned to the Clerk’s Office where staff can inactivate the voter. • In some cases, Clerk’s Office staff may not see documentation when a voter dies, especially if it happens outside of Deschutes County. A next of kin for a recently deceased voter may call the Clerk’s Office to provide the last 4 numbers of the deceased voter’s social security number. Staff can then query the Social Security Administration database to confirm the voter’s vital status and cancel the voter’s registration. Even if Clerk’s Office staff do not take an ineligible voter off the roles, the signature verification process described in the next section should be able to identify any ballots that were not submitted by the assigned voter. Auditor reviews of household occupants and reports of death in Deschutes County indicated that rolls only contained eligible voters. Records did not indicate a high level of risk that nonresidents were registered to vote. There were only 26 households in Deschutes County with more than four people registered to vote and only six where more than four people voted. Based on frequency and the likelihood of there being some large families living together in the County this appears to be reasonable. No deceased people were registered to vote in Deschutes County based on a comparison of voter rolls to Oregon Health Authority Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor Page 16 of 25 death records. However, there were some limits to the analysis: • The only data available to the Auditor was the first name, last name, and year of birth. In some cases, there were multiple people legitimately registered to vote with those characteristics. • Vital record data only included deaths that took place in Deschutes County from January 1, 2020, to the date the report was run. If a person was still on the voter rolls and died before that date, they would not be identified. It can also take a few months for death records to be updated, so people who died recently might also not appear in the records. Signature Verification Worked Signatures play a key role as a control in Oregon's vote by mail system. If the signature verification process were not working, it could reduce confidence in the voting system or increase the likelihood of fraud. Oregon’s Vote by Mail Manual and Oregon Revised Statues require county election officials to check for and evaluate ballot envelope signatures. Clerk’s Office staff check the signature on every ballot envelope against voter registration records before forwarding the ballot for counting. The state provides training from handwriting experts to all staff involved in signature review. If staff determine that signatures don’t match, the signatures get a second level of review by a different staff person. Only ballots with signature matches are opened and counted. The Office sends a letter to all voters who submitted a ballot with an unmatched signature. Voters have 21 days after the election to update a signature and have their ballot counted. Signature mismatches can result from changes in a signature over time. The Vote by Mail Manual includes guidelines for signatures that should be challenged even though they may be valid. Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor Page 17 of 25 Reasons for different signatures might include a natural evolution over time, differences in style choice, using a nickname or initial, or a change in fine motor skills due to illness or injury. Figure VIII: Example signatures that may have changed over time or due to style differences Source: Oregon Vote By Mail Manual When differences in a signature do not appear to be due to a change over time or a style difference, the Manual recommends determining if someone else in the household signed the form. Figure IX: Example of unexplained mismatched signatures Source: Oregon Vote By Mail Manual When signatures match another person in the household staff forward the signatures to the Secretary of State for further investigation. But if signatures do not match another person in Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor Page 18 of 25 the household, there is no way to research potential fraud. The signature verification process was working based on a review of a random sample of matched and unmatched signatures. Votes Cast Reflected Intent Election staff have the authority to interpret voter intent. If staff abuse this authority it could result in reduced confidence in elections. The vote counting information system counts the number of ovals voters fill in on a ballot for each voting option. If a voter selects two options, the system will count an overvote. If no ovals are selected, the system will count an undervote. The system creates an alert for staff to review all over and undervotes to manually determine voter intent. Voting instructions call on voters to completely fill in ovals so that the counting system can read votes automatically. However, in some cases, voters do not follow instructions, and staff interpretation becomes necessary. Voting instructions also call on voters to cross out mistakes when they happen. These mistakes can also initially cause overvotes which staff must attend to manually. Staff work in pairs to determine voter intent. No two people registered from the same political party are allowed to work together to determine intent. The Oregon Vote by Mail manual provides staff with directions for interpreting voter intent. Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor Page 19 of 25 Figure X: Vote by Mail Manual guidelines for determining voter intent The voter has attempted to erase the No vote. Select only the Yes vote. Eliminate the overvote. The voter has selected two choices but there is no indication of erasure. Allow tally as an overvote (neither counts) Voter has included a stray mark. Select only the Yes vote. Eliminate the overvote. Voter selected choice but scanner will not read it because it is outside the marking zone. Select the No vote. Eliminate the undervote. Voter accidentally selected a choice and then indicated a correction. Select only the Yes vote. Eliminate the overvote. Voter crossed out an entire contest. Neither is selected. Tally as an undervote. Source: Oregon Vote by Mail Manual The process for determining voter intent was working based on a random sample of interpreted ballots. Voter intent was either clear and recorded appropriately or unclear with no vote cast. Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor Page 20 of 25 Accommodations Offered, but Outreach Could Be Improved Some voters require accommodations such as electronic ballot completion for those with visual impairments or translation for those needing language assistance. If voters are unaware that such accommodations are available there is a risk they will not know to request them, thereby creating barriers in the voting process. The Americans with Disabilities Act, National Voters Registration Act, and Voting Rights Act require assistance and translation for registering and voting. Clerk’s Office accommodations provided to people with disabilities included: • Access to the Secretary of State’s online ballot marking device which allows completing ballots on personal computers • In-person assistance • An accessible ballot marking device. The device allows voters to mark ballots privately and independently at the Clerk’s Office. Voters use headphones and a keypad/toggle system to select voting options. Once voting is complete, the voter prints the ballot, places it in the original envelope and puts it in the ballot drop box just like any other ballot. The Office has the device available, but to date, no one has requested to use it. This link provides more information on the accessible ballot marking device. Translation and interpretation services included: • A translated Deschutes County Voter’s Pamphlet on the Secretary of State’s webpage • On-demand interpretation services Accommodations and translated materials were available on request but not widely publicized other than in the Voter’s Pamphlet. Representatives from the disability community said that there was not enough awareness about available Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor Page 21 of 25 accommodations. They noted that the problem was not specific to Deschutes County, but that Multnomah County did a better job of promoting accommodations. Representatives from the Latino community had a slightly different perspective. Many were aware of translation options, possibly because they had been involved with translations and voter registration at the State level. However, they desired more community engagement including outreach through culturally specific events and Spanish-language media, and ballot translation. The Clerk’s Office website did not include information about accommodations or translation/interpretation. If it wanted to increase awareness of available accommodations, the Clerk’s Office could update the website to include information about accommodations or links to Secretary of State website resources. 3. Conclusion Deschutes County residents place immense trust in the reliability and accessibility of the election processes to ensure that the government accurately reflects the democratic choices of its citizens. Overall, we found the election process to be secure, accessible, and accurate. Core election practices such as voter roll verification, signature matching, and interpreting voter intent upheld the integrity of votes cast. However, there were opportunities for improvement. Some ballot drop boxes were not accessible, which impacts the ability of all voters to participate equally in the electoral process. A scope impairment prevented us from assessing the information security of the ballot counting system, which poses an open area for evaluation to ensure dependable election operations. To support improvements and maintain community trust, we recommend that the Clerk’s Office develop a strategy to ensure Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor Page 22 of 25 transparency and confidence in the security of information systems, enhance voter access to drop boxes, and increase awareness of voting aids and services for all eligible voters, including those with disabilities and who need language assistance. 4. Management Response Sent by email as a place-holder response: Elizabeth, We acknowledge receipt of the preliminary audit findings regarding the election process currently under review. We appreciate the detailed analysis provided by you and Susan for the portion she contributed to. Some of these findings require further clarification and discussion. Specifically, our drive- through drop boxes are designed with careful consideration of accessibility standards. The exception defined in ADA Section 228.1 states that drive-up depositories like our ballot drop boxes are designed specifically for vehicle use and thus are not required to conform to the traditional reach ranges specified for pedestrian applications specified in ADA Section 309. I'd like to request a meeting with the Audit Committee to discuss these aspects further. Pending this meeting, I will withhold a formal response, as I believe it is crucial to have this conversation with the committee in hopes of preventing any misinterpretation of our practices. Steve Steve Dennison | County Clerk DESCHUTES COUNTY CLERK’S OFFICE 1300 NW Wall Street | Bend, Oregon 97703 Tel: (541) 388-6544 Enhancing the lives of citizens by delivering quality services in a cost-effective manner. Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor Page 23 of 25 5. Appendix A: Objective, Scope, and Methodology The County Office of the Internal Auditor was created by the Deschutes County Code as an independent office conducting performance audits to provide information and recommendations for improvement. The audit included limited procedures to understand the systems of internal control. No significant deficiencies were found in this audit. The findings noted were primarily compliance and efficiency matters. Audit findings result from incidents of non-compliance with stated procedures and/or departures from prudent operation. The findings are, by nature, subjective. The audit disclosed certain policies, procedures and practices that could be improved. The audit was neither designed nor intended to be a detailed study of every relevant system, procedure, or transaction. Accordingly, the opportunities for improvement presented in the report may not be all-inclusive of areas where improvement may be needed and does not replace efforts needed to design an effective system of internal control. Management has responsibility for the system of internal controls, including monitoring internal controls on an ongoing basis to ensure that any weaknesses or non-compliance are promptly identified and corrected. Internal controls provide reasonable but not absolute assurance that an organization’s goals and objectives will be achieved. Objectives and Scope The overall objective of the audit was to determine whether the County’s election system is secure, accessible, and accurate. Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor Page 24 of 25 Subobjectives included determining whether: • Information security controls on the Clear Ballot system were adequate to prevent tampering with the system • Voting was accessible to people with physical disabilities or language barriers • Control processes to identify ineligible registered voters were effective • The signature verification process correctly identified invalid signatures • The ballot inspection process correctly identified which ballots should be counted, enhanced/reproduced, or rejected The scope included preparing for and conducting the May 2025 election. Methodology Audit procedures included: • Interviewing staff about policies and procedures for conducting elections • Interviewing community members about the elections process including the major political parties, experts in the field of elections, representatives of the disability community, and representatives of the Latino community • Conducting site reviews of ballot drop box locations • Reviewing outreach materials including the Voter’s Pamphlet and website • Reviewing the list of registered voters to look for reasonableness of the number voters registered at single household residents and cross referencing the list to records of deceased individuals from the Oregon Health Authority Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor Page 25 of 25 • Reviewing a sample of challenged and not challenged signatures. The sample included 30 unmatched signatures from a population of 294 and 30 matched signatures from a population of 36,715. Because the sample was randomly selected, results can be extrapolated to the population. • Reviewing a sample of adjudicated ballots for voter intent. The sample included 33 ballots from a population of 941. Because the sample was randomly selected, results can be extrapolated to the population. Planned methods included a review of information security for the Clear Ballot system, but the Clerk refused to cooperate with this portion of the audit. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. Some procedures could not be performed due to the Clerk’s refusal to cooperate with requests related to information security for the ballot counting software. As a result, the audit does not include a conclusion related to information security for ballot counting software, provide assurance that the system is secure, or offer recommendations to support continuous improvement. For the other areas of the audit, we believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. (2018 Revision of Government Auditing Standards, issued by the Comptroller General of the United States.) Clerk’s Office—Elections—A0129 September 2025 Deschutes County Office of the Internal Auditor The mission of the Office of Internal Audit is to improve the performance of Deschutes County government and to provide accountability to residents. We examine and evaluate the effectiveness, efficiency, and equity of operations through an objective, disciplined, and systematic approach. The Office of Internal Audit: Audit committee: Elizabeth Pape – County Internal Auditor Daryl Parrish, Chair – Public member Susan DeJoode – Performance Auditor Phil Anderson – Public member Jodi Burch – Public member Phone: 541-330-4674 Liz Foott – Public member Email: internal.audit@deschutes.org Joe Healy – Public member Web: www.deschutes.org/auditor Kristin Toney – Public member Patti Adair, County Commissioner Steve Dennison, County Clerk Lee Randall, Facilities Director Please take a survey on this report by clicking this link: https://forms.office.com/g/UYBghHnG6G Or use this QR Code: If you would like to receive future reports and information from Internal Audit or know someone else who might like to receive our updates, sign up at http://bit.ly/DCInternalAudit.