Loading...
HomeMy WebLinkAboutA0129 Election Report (UPDATED W RESP 11-3-25) Audit Report Election Integrity Maintained, Improved Accessibility and Data Security Transparency Needed To request this information in an alternate format, please call (541) 330-4674 or send email to internal.audit@Deschutes.org Take survey by clicking here This report has been updated from the original version issued in September 2025 to include a full management response from the Deschutes County Clerk. The Clerk wished to withhold his full response until after the report’s publication and an opportunity to speak with the Audit Committee. Clerk’s Office—Elections—A0129 Updated November 2025 Table of Contents: 1. Introduction ....................................................................................... 1 Background ..................................................................................................................... 2 Election Calendar and Activities ................................................................................ 2 2. Findings and Observations .............................................................. 6 Scope Impairment .......................................................................................................... 7 Auditor Cannot Draw Conclusions Related to Information Security ..................... 7 Findings ......................................................................................................................... 10 Ballot Drop Boxes Not Fully Accessible .................................................................. 10 Observations ................................................................................................................. 14 Voter Rolls Checked and Confirmed ....................................................................... 14 Signature Verification Worked ................................................................................ 16 Votes Cast Reflected Intent ...................................................................................... 18 Accommodations Offered, but Outreach Could Be Improved ............................. 20 3. Conclusion ........................................................................................ 21 4. Management Response .................................................................. 22 5. Appendix A: Objective, Scope, and Methodology ........................ 37 Objectives and Scope ................................................................................................... 38 Methodology ................................................................................................................. 39 Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Highlights: Why this audit was performed: The electoral process is increasingly scrutinized and public confidence in elections has lost ground. In Deschutes County, the responsibility to uphold the integrity of elections is more vital than ever. We recommended that the County Clerk: Inspect drop boxes on a regular basis using Americans with Disabilities Act standards for accessible design. Create a plan for improving any boxes that do not meet checklist standards. Election Integrity Maintained, Improved Accessibility and Transparency Needed The objective of the audit was to determine whether the County’s election system was secure, accessible, and accurate. Auditors focused on information security for the ballot tabulation system, voter roll maintenance, the signature verification process, ballot adjudication, and accessibility for people with physical disabilities or language barriers. What was found: Overall, we found controls were working as intended. Voter rolls were appropriately maintained, signatures were verified, and staff properly interpreted voter intent. These observations inspire trust in the Deschutes County election process. However, we also found room for improvement in accessibility both for people with physical disabilities and those needing language assistance. Finally, the Clerk refused to provide auditors with information about information security related to ballot counting software. The Auditor cannot draw a conclusion related to information security for ballot counting software, provide assurance that the system is secure, or offer recommendations to support continuous improvement. Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 1 of 40 1. Introduction Across the nation, we find ourselves in a moment where the electoral process is increasingly scrutinized and public confidence in elections has lost ground. In Deschutes County, the responsibility to uphold the integrity of elections is more vital than ever. The electoral system is the backbone of democracy and ensures that the voice of every citizen is heard and respected. Trust in elections is cultivated through attention to transparency, security, and inclusivity, reaffirming the value each vote contributes to our community's governance. The Clerk’s Office undertakes significant measures to ensure secure and accurate elections. Throughout the process, from maintaining voter rolls; to designing, printing, and mailing ballots; to verifying voter signatures; to interpreting voter intent; to tabulating and certifying results, staff rely on legal requirements and their own experience and expertise to ensure election integrity. Though the Office performs well in traditional election administration, increased voter diversity and concerns about data security present additional challenges. Sustaining a culture of continuous improvement will empower the Office to enhance transparency in information technology security and better support voters needing physical or language accommodations. The Deschutes County Audit Committee authorized a review of the election process in the Internal Audit Work Plan for Fiscal Years 2024 and 2025. Audit objectives, scope, and methodology can be found in Appendix A. Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 2 of 40 Background The Deschutes County Clerk’s Office is responsible for overseeing elections and voter registration. The County Clerk is the chief election official in Deschutes County and is tasked with ensuring that elections are conducted according to Oregon Revised Statues and other requirements. The Office consisted of 11 employees, but only three were exclusively devoted to elections. Seven staff were dedicated to maintaining public records including recording documents related to real property transactions and other legal documents; accepting passport applications; issuing marriage licenses; and maintaining the County archive. The County Clerk oversaw both functions. During elections, the Office also hired temporary staff and assigned some staff normally devoted to records with election functions. Election Calendar and Activities Activities related to the May 2025 election began long before and extended beyond election day. Prior to the election, staff determined which elections should be on the ballot for voters located in different precincts and districts, checked ballot design for accuracy, and oversaw printing and mailing. After the election staff verified and challenged signatures and interpreted voter intent for ballots that could not be read by machine. The deadline for finalizing election results is 27 days after the election. Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 3 of 40 Figure I: Timeline of May 2025 Election Activities Source: Clerk’s Office 2025 Election Calendar Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 4 of 40 The Clerk’s Office published a document to explain the elections process in Deschutes County. Figure II: Clerk’s Office description of the elections process (part 1) 1. Voter Registration: To register to vote, you are required to provide valid identification proving that you are eligible to vote. After reviewing and verifying your information, we enter it into our voter registration database. 2. Equipment Testing: We use election equipment that is certified according to State and Federal standards. We test our election equipment before, during, and after each election. 3. Ballots Are Mailed: All registered voters are mailed a ballot packet containing their ballot and a postage-paid return envelope that has a printed security weave on the inside that protects your privacy and the secrecy of your vote. 4. Ballot Collection: Voters can return their voted ballot by mail or at one of our ten Official Ballot Drop Site locations, conveniently located throughout the county. Drop Site ballots are collected, and mailed ballots are received at our Clerk's Office located in the Deschutes Services Building for ballot tabulation. Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 5 of 40 Figure III: Clerk’s Office description of the elections process (part 2) 5. Verify Voter Eligibility: Upon receipt of your ballot, it is sent through our ballot envelope sorting machine, which scans an image of your signature while sorting your ballot by voting precinct. Trained elections staff verify your envelope signature by comparing it to your signature on file in the voter registration database. 6. Processing Ballots: If your signatures match, your ballot envelope moves on to be opened. If they don't match, we contact you by mail to resolve the issue so we can count your ballot. If a ballot is damaged or contains machine- unreadable marks, we flag it for manual review. Our goal is to count all eligible ballots as voters intend. 7. Ballot Scanning and Tabulation: After ballots are removed from their envelopes, we scan the ballots and count all the valid votes to determine the results of each contest in the election. Our federally and state certified voting system is secure and never connected to the internet. 8. Ballot Adjudication: Teams of two staff, each of different political parties, review if ballots are damaged, have stray marks, or have corrections, undervotes, overvotes, and blank contests to verify voter intent and ensure accurate tabulation. All ballots are stored in a secure location under 24/7 surveillance. Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 6 of 40 Figure IV: Clerk’s Office description of the elections process (part 3) 9. Unofficial Results: We begin publishing unofficial results after 8pm on Election Day. Results are unofficial until after all ballot return deadlines have passed and after we have counted every valid ballot we received. 10. Certification of Official Results: After the Board of Canvassers reviews and verifies the outcome of the election, official election results are certified by the county. 11. Audits: Audits are a normal check and balance that are part of every election. We use audits to confirm that election equipment accurately interpreted and tallied voters' ballots, that the outcome of the election reflects how voters voted, and that election workers followed procedures. 12. Ballot Storage: We securely store all paper ballots and other records as part of the official record for two years. After two years, the ballots are destroyed. Source: Clerk’s Office Deschutes County Elections Overview 2. Findings and Observations The objective of the audit was to determine whether the County’s election system was secure, accessible, and accurate. Reviewing the entire election process would have been too large a scope for one audit. Therefore, auditors conducted a risk assessment which resulted in a focus on information security for the ballot tabulation system, voter roll maintenance, the signature verification process, ballot adjudication, and accessibility for people with physical disabilities or language barriers. Overall, we found controls were working as intended. Voter rolls were appropriately maintained, signatures were verified, and staff Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 7 of 40 properly interpreted voter intent. These observations inspire trust in the Deschutes County election process. However, we also found room for improvement in accessibility both for people with physical disabilities and those needing language assistance. Finally, the Clerk refused to provide auditors with information about information security related to ballot counting software. This scope impairment prevented the Auditor from drawing related conclusions. Scope Impairment Auditor Cannot Draw Conclusions Related to Information Security Due to the Clerk’s refusal to cooperate with part of the audit process, the Auditor cannot draw a conclusion related to information security for ballot counting software, provide assurance that the system is secure, or offer recommendations to support continuous improvement. One of the objectives for this audit was to assess information technology security for the ballot counting system using a checklist based on National Institute of Standards and Technology criteria. The Auditor’s Office has significant experience reviewing information security at this level based on integrated audit reviews. Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 8 of 40 Technology is an integral component of modern elections, and its reliability is a major public concern. The Clerk’s Office uses software called Clear Ballot to tally ballot votes. The Secretary of State reviews and certifies that the software complies with state rules related to information security and is authorized for use by county elections offices. However, it is up to county elections offices to implement appropriate user controls, such as access control and system updates, to ensure that the software is secure. The Clerk described the Office's information systems as the "backbone" of elections because of how heavily the Office relies on technology. But the reliance on technology comes with risks and bad actors can try to access information systems to disrupt elections or change outcomes. During the initial risk assessment phase, community members expressed concerns about information technology risk due to its critical role in election security. Despite differing perspectives, Republicans expressing concerns versus Democrats and the League of Women Voters expressing confidence, the Auditor decided to include a security review to either assure stakeholders or recommend improvements. Previous findings related to information security also contributed to a heightened sense of risk in this area. During a 2024 integrated audit, auditors found that Clerk’s Office recording staff (not elections staff) disabled supervisor review and segregation of duties controls in software to make it easier to void receipts and to circumvent review processes. Staff were also using shared logins due to a perception that logging in and out of shared workstations took too much time. We recommended the Office either resolve these control issues or formally accept the risk of not implementing controls. Staff chose to resolve the controls issues. We also found that software access rights had not been updated during a 2008 cash handling audit. Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 9 of 40 During the audit, the Clerk refused to discuss or provide any information related to Clear Ballot including • The elections security plan required by Oregon Revised Statute 254.074 • Any information technology security procedures that considered risk, addressed general and application controls, and ensured that users could be held accountable for their actions • Documentation of staff review of information technology security procedures • Information technology training records for staff with access to Clear Ballot system • A desk review of Clear Ballot components (design, tabulation, etc.) and demonstration of reports available. • Conducting the Information Security checklist Deschutes County Code section 2.14.060 states “All officers and employees of Deschutes County shall furnish the Office of County Internal Audit with unrestricted access to employees, information and records.” The Clerk cited Oregon Revised Statute 254.074 as a barrier to providing information, however this statute mandates filing security plans with the Secretary of State rather than prohibiting disclosure to auditors. It exempts security plans from disclosure through public records requests, but audit requests are not public records requests, and the Auditor often requires access to confidential information when conducting audits. Absence of additional legal justification from either the Clerk or the Secretary of State's Office suggests a lack of valid grounds for refusal. As a result, the Auditor cannot draw conclusions, provide assurance, or recommend improvements related to Clerk’s Office use of the Clear Ballot system. Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 10 of 40 Findings Ballot Drop Boxes Not Fully Accessible Inaccessible ballot drop boxes can result in voter exclusion and damage public trust in the electoral system. Deschutes County had 11 ballot drop-sites located across the County. The Deschutes Services Center in downtown Bend offered outdoor walk-up and drive-through options and another walk-up box inside the Clerk’s Office on the second floor. Other locations had only one box without a designation. Though it was not designated as such in the Voter’s Pamphlet, the Clerk said that the ballot box located at Sisters City Hall was also a walk-up location. Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 11 of 40 Figure V: Deschutes County Drop Box Locations Source: www.deschutes.org/clerk/page/ballot-drop-box-locations The United States Department of Justice publishes a checklist to determine whether ballot drop boxes are accessible according to the 2010 Americans with Disabilities Act standards for accessible design. The checklist includes aspects such as: • Clear ground space in front of the box • Firm and slip-resistance flooring • Floor space free from gaps or holes greater than ½ inch • Level floor space Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 12 of 40 • Handles and openings between 15 and 48 inches from the ground Drop boxes met most of the criteria in the checklist, but seven of 11 exceeded the maximum height of 48 inches and four of 11 had access areas with pavement gaps larger than ½ inch. Figure VI: Some ballot boxes did not meet accessibility standards for pavement gaps and height. Location Gaps Height Bradbury Park & Ride Yes 49" Clerk’s Office No 43” Deschutes County Fair & Expo Center Yes 50" Deschutes County Road Department No 54" Deschutes Services Center No 43" La Pine Public Library Yes 49" Old Mill No 51” Pine Nursery Park Yes 43" Sisters City Hall No 43" Sunriver Public Library No 49" Redmond Public Library No 49" Source: Auditor Observation Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 13 of 40 Figure VII: Photos of drop boxes with openings above 48” and gaps wider than ½” Ballot box height exceeded 48 inches at the Old Mill. Gaps in pavement at the Fair and Expo Center. A gate at the Bradbury Park and Ride site prevented use as a drive-up location. Source: Auditor Observation The Clerk contended that Americans with Disabilities Act standards did not apply because some boxes are exempt as drive-up structures. However, this interpretation raises questions about how drive-up locations were identified and how drive-up location designations affected the compliance of the overall system. Regardless of whether exemptions applied to drive-up locations, the physical specifications of many drop boxes, specifically, the height of openings exceeding the 48-inch limit and pavement gaps, fell short of design standards intended to ensure access for people with disabilities. The existing state of many drop boxes created a tangible barrier to accessibility. Clerk’s Office staff inspected drop boxes before and during elections but did not check them for criteria contained in the Americans with Disabilities Act checklist. The Office also did not have a plan for addressing height and pavement issues at drop box locations. Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 14 of 40 Clerk’s Office staff should inspect drop boxes on a regular basis using Americans with Disabilities Act standards for accessible design. Clerk’s Office staff should create a plan for improving any boxes that do not meet standards. Observations Voter Rolls Checked and Confirmed During the audit risk assessment, we heard concerns from community members about ineligible people voting including unreasonable numbers of people registered at single family households (some of whom may no longer live in Deschutes County) and deceased people registered to vote. To register to vote in Oregon, a person must be: • A United States citizen • A resident of Oregon • At least 16 years old (Those who are under 18 years old do not receive a ballot until an election occurs on or after their 18th birthday.) Counties are required to perform routine voter file maintenance throughout the year. Clerk’s Office staff described many of the tasks they perform to maintain voter records including review of: • Information submitted by voters through paper forms, online registrations via OregonVotes.gov, and qualifying Department of Moter Vehicle transactions • Post Office records including the National Change of Address database and returned mail • The national voter Electronic Registration Information Center (ERIC) database Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 15 of 40 • Deceased records including State and County Health Departments, Social Security Administration, and online/print newspaper obituaries Residents can also play a role in helping to maintain voter rolls: • In some cases, a ballot may be mailed to a voter who has changed residence before the Clerk’s Office is aware that the person has moved. The new resident can write “Return to Sender” on the envelope and put it back in the mail. The ballot will be returned to the Clerk’s Office where staff can inactivate the voter. • In some cases, Clerk’s Office staff may not see documentation when a voter dies, especially if it happens outside of Deschutes County. A next of kin for a recently deceased voter may call the Clerk’s Office to provide the last 4 numbers of the deceased voter’s social security number. Staff can then query the Social Security Administration database to confirm the voter’s vital status and cancel the voter’s registration. Even if Clerk’s Office staff do not take an ineligible voter off the roles, the signature verification process described in the next section should be able to identify any ballots that were not submitted by the assigned voter. Auditor reviews of household occupants and reports of death in Deschutes County indicated that rolls only contained eligible voters. Records did not indicate a high level of risk that nonresidents were registered to vote. There were only 26 households in Deschutes County with more than four people registered to vote and only six where more than four people voted. Based on frequency and the likelihood of there being some large families living together in the County this appears to be reasonable. Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 16 of 40 No deceased people were registered to vote in Deschutes County based on a comparison of voter rolls to Oregon Health Authority death records. However, there were some limits to the analysis: • The only data available to the Auditor was the first name, last name, and year of birth. In some cases, there were multiple people legitimately registered to vote with those characteristics. • Vital record data only included deaths that took place in Deschutes County from January 1, 2020, to the date the report was run. If a person was still on the voter rolls and died before that date, they would not be identified. It can also take a few months for death records to be updated, so people who died recently might also not appear in the records. Signature Verification Worked Signatures play a key role as a control in Oregon's vote by mail system. If the signature verification process were not working, it could reduce confidence in the voting system or increase the likelihood of fraud. Oregon’s Vote by Mail Manual and Oregon Revised Statues require county election officials to check for and evaluate ballot envelope signatures. Clerk’s Office staff check the signature on every ballot envelope against voter registration records before forwarding the ballot for counting. The state provides training from handwriting experts to all staff involved in signature review. If staff determine that signatures don’t match, the signatures get a second level of review by a different staff person. Only ballots with signature matches are opened and counted. The Office sends a letter to all voters who submitted a ballot with an unmatched signature. Voters have 21 days after the election to update a signature and have their ballot counted. Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 17 of 40 Signature mismatches can result from changes in a signature over time. The Vote by Mail Manual includes guidelines for signatures that should be challenged even though they may be valid. Reasons for different signatures might include a natural evolution over time, differences in style choice, using a nickname or initial, or a change in fine motor skills due to illness or injury. Figure VIII: Example signatures that may have changed over time or due to style differences Source: Oregon Vote By Mail Manual When differences in a signature do not appear to be due to a change over time or a style difference, the Manual recommends determining if someone else in the household signed the form. Figure IX: Example of unexplained mismatched signatures Source: Oregon Vote By Mail Manual Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 18 of 40 When signatures match another person in the household staff forward the signatures to the Secretary of State for further investigation. But if signatures do not match another person in the household, there is no way to research potential fraud. The signature verification process was working based on a review of a random sample of matched and unmatched signatures. Votes Cast Reflected Intent Election staff have the authority to interpret voter intent. If staff abuse this authority it could result in reduced confidence in elections. The vote counting information system counts the number of ovals voters fill in on a ballot for each voting option. If a voter selects two options, the system will count an overvote. If no ovals are selected, the system will count an undervote. The system creates an alert for staff to review all over and undervotes to manually determine voter intent. Voting instructions call on voters to completely fill in ovals so that the counting system can read votes automatically. However, in some cases, voters do not follow instructions, and staff interpretation becomes necessary. Voting instructions also call on voters to cross out mistakes when they happen. These mistakes can also initially cause overvotes which staff must attend to manually. Staff work in pairs to determine voter intent. No two people registered from the same political party are allowed to work together to determine intent. The Oregon Vote by Mail manual provides staff with directions for interpreting voter intent. Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 19 of 40 Figure X: Vote by Mail Manual guidelines for determining voter intent The voter has attempted to erase the No vote. Select only the Yes vote. Eliminate the overvote. The voter has selected two choices but there is no indication of erasure. Allow tally as an overvote (neither counts) Voter has included a stray mark. Select only the Yes vote. Eliminate the overvote. Voter selected choice but scanner will not read it because it is outside the marking zone. Select the No vote. Eliminate the undervote. Voter accidentally selected a choice and then indicated a correction. Select only the Yes vote. Eliminate the overvote. Voter crossed out an entire contest. Neither is selected. Tally as an undervote. Source: Oregon Vote by Mail Manual The process for determining voter intent was working based on a random sample of interpreted ballots. Voter intent was either clear and recorded appropriately or unclear with no vote cast. Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 20 of 40 Accommodations Offered, but Outreach Could Be Improved Some voters require accommodations such as electronic ballot completion for those with visual impairments or translation for those needing language assistance. If voters are unaware that such accommodations are available there is a risk they will not know to request them, thereby creating barriers in the voting process. The Americans with Disabilities Act, National Voters Registration Act, and Voting Rights Act require assistance and translation for registering and voting. Clerk’s Office accommodations provided to people with disabilities included: • Access to the Secretary of State’s online ballot marking device which allows completing ballots on personal computers • In-person assistance • An accessible ballot marking device. The device allows voters to mark ballots privately and independently at the Clerk’s Office. Voters use headphones and a keypad/toggle system to select voting options. Once voting is complete, the voter prints the ballot, places it in the original envelope and puts it in the ballot drop box just like any other ballot. The Office has the device available, but to date, no one has requested to use it. This link provides more information on the accessible ballot marking device. Translation and interpretation services included: • A translated Deschutes County Voter’s Pamphlet on the Secretary of State’s webpage • On-demand interpretation services Accommodations and translated materials were available on request but not widely publicized other than in the Voter’s Pamphlet. Representatives from the disability community said that there was not enough awareness about available Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 21 of 40 accommodations. They noted that the problem was not specific to Deschutes County, but that Multnomah County did a better job of promoting accommodations. Representatives from the Latino community had a slightly different perspective. Many were aware of translation options, possibly because they had been involved with translations and voter registration at the State level. However, they desired more community engagement including outreach through culturally specific events and Spanish-language media, and ballot translation. The Clerk’s Office website did not include information about accommodations or translation/interpretation. If it wanted to increase awareness of available accommodations, the Clerk’s Office could update the website to include information about accommodations or links to Secretary of State website resources. 3. Conclusion Deschutes County residents place immense trust in the reliability and accessibility of the election processes to ensure that the government accurately reflects the democratic choices of its citizens. Overall, we found the election process to be secure, accessible, and accurate. Core election practices such as voter roll verification, signature matching, and interpreting voter intent upheld the integrity of votes cast. However, there were opportunities for improvement. Some ballot drop boxes were not accessible, which impacts the ability of all voters to participate equally in the electoral process. A scope impairment prevented us from assessing the information security of the ballot counting system, which poses an open area for evaluation to ensure dependable election operations. To support improvements and maintain community trust, we recommend that the Clerk’s Office develop a strategy to ensure Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 22 of 40 transparency and confidence in the security of information systems, enhance voter access to drop boxes, and increase awareness of voting aids and services for all eligible voters, including those with disabilities and who need language assistance. 4. Management Response Auditor Comments on Management Response The Auditor appreciates the thorough response provided by the Clerk and his acknowledgement of the risks and recommendations included in the audit. It is not uncommon for auditors and management to disagree. It is an expected part of the process. That said, the scale and extent of the Clerk’s response is surprising and represents a significant gap in understanding of the purpose of the audit function. 1. Our audits are scoped according to risk and not dictated by management request. Auditors do not draw conclusions without conducting extensive work to verify success or opportunities for improvement. We trust but verify. 2. Reliable evidence and quality control are core values. Our reports are only the tip of an iceberg consisting of layers of supporting data, research, and interview results. Each datapoint is reviewed to ensure that it is relevant, valid, reliable, and provides a reasonable basis for supporting findings and conclusions. The standards we follow require us to determine whether evidence provided by management is objective and credible. 3. We can’t draw conclusions without access to information. Deschutes County Code provides auditors with unrestricted access to all employees, information, and records. We are also required by Code not to publicly disclose confidential Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 23 of 40 information and to maintain confidentiality. Our procedures manual includes directives to issue confidential reports to management when findings and recommendations are confidential in nature. For example, if they pertain to a security risk. 4. An audit isn’t just a tool for oversight. It’s a conversation. It’s a way for management to recognize opportunities, for the public to bring forward concerns, whether that’s inefficiency, safety risks, or something else, and for staff to respond with changes or clarifications. This process helps build trust. It shows that the County is listening, improving, and accountable for the services it provides. 5. Independence ensures that our reports are objective and free from bias. Audit conclusions follow the evidence, not influence from management. We commit to upholding independence even when overwhelming pressure might cause others to hedge or back down from reporting facts. The Clerk’s response includes areas of the report that he believes to be inaccurate or misleading. We disagree with those characterizations and stand by our process and the audit’s conclusions. Disagreements can lead to healthy and valuable conversations. Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 24 of 40 To: Elizabeth Pape, County Internal Auditor From: Steve Dennison, Deschutes County Clerk Date: October 29, 2025 Subject: Management’s Response to 2025 Elections Audit Report 2025 Elections Audit Response Executive Summary In light of this audit’s findings, it is imperative to address the report’s inaccuracies and emphasize the importance of factual integrity, especially during a time when elections face unprecedented challenges. Such challenges include reductions in federal funding, widespread false narratives and misinformation, threats to election workers and increasingly sophisticated cybersecurity risks. Discrepancies within audit processes that remain uncorrected and misleading only intensify these challenges. Accurate information is vital to uphold public trust in the electoral system, particularly when scrutiny is heightened. While some components of the report were seen as positives by audit committee members, this perception overlooks the harmful impact of the misinformation and false narratives this report contains. The refusal of the Internal Auditor to correct these inaccuracies before releasing the final report underscores the need for auditing reforms to ensure accountability and fairness in county publications. Unedited statements could unnecessarily harm the county's reputation and similarly impact other counties across the state. Amidst these numerous external challenges, the dedicated staff of the County Clerk’s Office work tirelessly to ensure transparent and secure elections. Their dedication to these values underscores their commitment to serving the public with integrity and honesty. The following responses address the audit report’s inaccuracies, findings, and recommendations. Despite the widespread inaccuracies identified in this report, as detailed in the responses below, the County Clerk’s Office acknowledges the risks associated with the Internal County Auditor’s recommendations. This recognition arises not from the Auditor's identification of these items, but from the fact that the recommendations COUNTY CLERK Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 25 of 40 already align with the office’s ongoing commitment to excellence in the work that is the subject of this audit. Request from Clerk’s Office to Conduct this Audit Following the 2020 Presidential Election, the County Clerk’s Office requested an audit from the County Internal Auditor, then David Givans, to address the increase in misinformation and disinformation relating to elections. The County Clerk’s Office, committed to transparency and integrity, sought to educate the public about the electoral process. This effort aimed to address concerns and misconceptions regarding critical components such as voter registration, ballot creation, vote tabulation, election results, and audits. David Givans understood the scope and significance of the Clerk’s audit request, recognizing it as a proactive measure to demonstrate how the County safeguards democracy and voter integrity, rather than as a reactionary audit focused on performance or compliance issues. David Givans retired before the audit was initiated, possibly taking with him an understanding of the original intent and objectives of the elections audit. Reputation The Deschutes County Clerk’s Office has a strong history of excellence in fulfilling its diverse responsibilities. The office maintains essential responsibilities such as overseeing elections, maintaining voter registrations, recording of real property records, issuing marriage licenses, processing passport applications, running the County Archives and Records Center and facilitating the Property Value Appeals Board, all while ensuring compliance with relevant regulations and laws. In 1999, the Deschutes County Clerk’s Office demonstrated its commitment to innovation by becoming the first county in Oregon to offer online access to public records. In August 2017, it led the state again by allowing couples to apply for marriage licenses online, enabling them to apply from anywhere in the world before visiting the office to complete the purchase. In his effort to meet with staff and observe operations for each county throughout the state, on April 15, 2025 Oregon Secretary of State, Tobias Reed visited the Deschutes County Clerk’s Office. As a testament to the positive reputation the office maintains, one month later, on May 14, Secretary Reed chose to return to Deschutes County for his first ride-along to ballot drop boxes to observe the ballot collection processes during the May 20, 2025 Special District Election. Secretary Reed “rode along to observe the process of gathering ballots from drop boxes, sorting, counting Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 26 of 40 and security of the election system—says…ballots are safe and the results are accurate.”1 The Chief Elections Official in the state partnered with the Deschutes County Clerk’s Office on a media tour because of the office’s reputation for providing consistently accurate, transparent and compliant elections. The County Clerk’s Office is honored to build on these successes and continue its dedication to quality public service to the voters of Deschutes County. 1 Snavely, Brooke. (2025, May 14). Oregon Secretary of State tours Deschutes County's voting system ahead of May 20 election. Central Oregon Daily. https://www.centraloregondaily.com/news/elections/oregon-may-20-special-election-voting- info/article_34956c7f-a7ed-40f8-b3b5-2c02833a26f0.html Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 27 of 40 Key Findings and Responses from the Audit: 1. Security Concerns Audit Finding: Incomplete cooperation with the audit regarding information security of the Clear Ballot system. “Scope Impairment: Auditor Cannot Draw Conclusions Related to Information Security.” Response: With election infrastructure and systems under constant attack from state and non- state actors, it is more imperative than ever to safeguard the federal and state election security measures established to protect our election systems. In accordance with ORS 254.074 and OAR 165-007-0310, the County Clerk’s Office develops and maintains a comprehensive Election Security Plan addressing various components. At a minimum, the plan must include the following components: (a) Ballot security at the printer; (b) Ballot storage security; (c) Ballot security during transport to inserter (if applicable), to the county, or to the post office; (d) Ballot security during insertion; (e) Ballot security at dropsites; (f) Security of voted ballots awaiting verification; (g) Security of voted ballots verified and awaiting inspection; (h) Security of voted ballots opened and inspected; (i) Facsimile ballot security; (j) Ballot tally system; (k) Early scanning procedure (if applicable); (l) Preventing the premature release of vote tally; (m) Post election security; and (n) Information about whether or not secrecy envelopes or sleeves will be used. Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 28 of 40 The County Clerk’s Office is mandated by Oregon Revised Statutes, Oregon Administrative Rule, and Secretary of State’s Critical Directive 2022-3 to keep the Election Security Plan and information pertaining to it confidential and free from public disclosure. Secretary of State’s Critical Directive 2022-3 (See attached) addresses Critical Infrastructure Security. This includes but is not limited to the physical security of elections offices, secure ballot storage, ballot scanning and tabulation machines, vote-by-mail infrastructure, information processing systems, communications systems, and elections security plans. The U.S. Department of Homeland Security has designated elections as Critical Infrastructure. To safeguard this infrastructure, the Clerk’s Office maintains strong partnerships with the Secretary of State, OACC, the FBI, and local law enforcement to protect personnel, facilities, and systems. This collaboration also ensures adherence to federal guidelines and best practices. Additionally, the Clerk’s Office has had multiple assessments by Homeland Security to ensure its facilities are safe. Upon receiving the Internal Auditor’s request to access this Election Security Plan, the County Clerk deliberated, after thorough consultation with the State Elections Division of the Secretary of State, the County Legal Department, other County Clerks throughout the state, and the Oregon Association of County Clerks (OACC), and concluded to safeguard the Election Security Plan from the public processes of the Internal Auditor. The County Clerk’s Office could not provide the Internal Auditor the Election Security Plan or information pertaining to it without risk of violating the aforementioned laws and directives – a decision that was unanimously shared by County Clerks throughout Oregon. While the Election Security Plan remains confidential, the Clerk’s Office has been fully transparent with all other information requested by the Internal Auditor. The details provided confirm that the office: • Complies with legal requirements and regulations in conducting elections. • Maintains robust procedures. • Conducts regular audits of election results to ensure all systems are working as designed. • Provides public access to information. • Is transparent in communication. Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 29 of 40 • Permits public observation, enabling the public to monitor processes for fairness and accuracy, demonstrating a transparent environment open to scrutiny and verification. • Actively engages with community organizations to foster inclusive participation. • Engages in public education initiatives to inform voters about their rights and the voting process. • Receives feedback from voters and stakeholders to provide feedback and report issues. 2. Ballot Drop Box Accessibility Audit Finding: Ballot drop boxes exceeded the height and had gaps, making them non-compliant with accessibility standards. “Ballot Drop Boxes Not Fully Accessible.” Response: Deschutes County is deeply committed to ensuring accessibility and legal compliance across its voting infrastructure, reflecting a dedication to inclusivity and equity. By offering solutions for different access needs, such as designing drive- through ballot drop boxes for vehicle access and walk-up boxes with pedestrian- friendly routes, the county addresses specific user requirements and complies with federal and state guidelines. This approach ensures all voters, especially those with disabilities, can participate effortlessly, showcasing Deschutes County's proactive stance in maintaining functional integrity and enhancing the overall voting experience. Additionally, vote-by-mail significantly enhances the accessibility of Deschutes County’s election system by allowing all voters the convenience of returning their ballots, postage-paid, through the mail. Furthermore, the Secretary of State’s Online Ballot-Marking Tool provides voters with disabilities and qualified military and overseas voters an alternate-format ballot that is fully accessible with screen-reader systems. These options eliminate the need to travel to drop sites, thereby accommodating individuals with mobility challenges, transportation issues, or scheduling conflicts. By ensuring every voter receives a ballot by mail, the county provides a flexible and inclusive option that aligns with Oregon's vote-by-mail system, further promoting civic engagement and participation across diverse populations. The County’s Internal Auditor erroneously applied a US DOJ Checklist to judge Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 30 of 40 accessibility of the County’s drive-through ballot drop boxes. The US DOJ Checklist referenced by the Auditor is specific to Polling Places and walk-up ballot drop boxes. Deschutes County has one Polling Place and that is within the County Clerk’s Office. This Polling Place is fully compliant with applicable ADA laws. The United States Department of Justice Civil Rights Division details the American Disability Act requirements for accessibility. The 2010 ADA Standards for Accessible Design Section 228 Depositories, Vending Machines, Change Machines, Mail Boxes, and Fuel Dispensers states: “228.1 General. Where provided, at least one of each type of depository, vending machine, change machine, and fuel dispenser shall comply with 309. EXCEPTION: Drive-up only depositories shall not be required to comply with 309.”2 Section 309 mandates that operable parts such as depositories need to meet certain clear floor space, height, and force specifications.3 ADA Section 228 clearly exempts drive-through depositories from the Section 309 requirements referenced in DOJ Checklist the Auditor used to judge the county’s drive-through drop boxes. Despite bringing this information to the Auditor’s attention, the Auditor chose to keep this error in the report. Deschutes County Clerk’s Office ensures compliance with ADA guidelines through close coordination with the County’s Facilities Department. Inspections of each drop box occur before, during and after each election cycle confirm their operational integrity and accessibility. During the Audit Committee Meeting held on October 10, 2025, County Facilities Director Lee Randall clarified his department’s ADA acumen and familiarity with ADA standards. Director Randall stated a distinction should be made between a drive- through and a walk-up ballot drop box. • Drive-through ballot drop box (Drive Aisle) • Drive aisles are designed solely for vehicular use and not intended for 2 (2010, September 15). 2010 ADA Standards for Accessible Design. ADA.GOV. https://www.ada.gov/law-and-regs/design-standards/2010-stds/#section54 3 (2010, September 15). 2010 ADA Standards for Accessible Design. ADA.GOV. https://www.ada.gov/law- and-regs/design-standards/2010-stds/#309-operable-parts Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 31 of 40 pedestrian foot traffic. • Drive-through drop boxes are exempt from ADA Section 309 requirements. • Walk-up ballot drop box (Accessible Route) • Must maintain an accessible route for pedestrians and be designed to ensure inclusivity and compliance with legal requirements, enabling individuals with disabilities to navigate public spaces safely and efficiently. Director Randall further clarified that since “Accessible Route” is specifically for pedestrians, he would not apply [accessible route requirements] to a drive up box. “They (walk-up and drive-up boxes) are mutually exclusive: you would never route an accessible pedestrian route through a drive by where vehicles use it. We would not even want to encourage people to use a drive up box. The height standards vary due to pavement variability.... If it met the lowest standard of a walkup box which this checklist applies to, it would actually be too low to use from a vehicle.”4 The reach range for a walk-up depository is 48-15 inches. If a drive-through drop box had a handle and opening at 15 inches above the ground, Director Randall is affirming this would be too low to use from a vehicle. Director Randall emphasized this point further by stating, “We work with the ADA every day. We have an in-house expert who [has] a master’s degree in architecture. I asked him to review this [and] he came to the same conclusion that this standard would apply to the walk-up boxes that we have but not to the drive up.”5 The Internal Auditor is incorrectly applying the US DOJ Checklist to the County’s drive- through drop boxes, falsely stating that they fall out of ADA compliance. What is even more concerning is the Auditor’s decision to continue apply this non-applicable standard despite being informed of the error on multiple occasions. In the same section regarding drop box accessibility, the Auditor states, “locations had only one box without a designation.” It should be noted that the Clerk’s Office publishes locations and details regarding each dropsite on its website and in the 4 (2025, October 10). Audit Committee Meeting. Deschutes County. https://www.deschutes.org/bc- ac/page/audit-committee-meeting-7 5 (2025, October 10). Audit Committee Meeting. Deschutes County. https://www.deschutes.org/bc- ac/page/audit-committee-meeting-7 Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 32 of 40 Voters’ Pamphlet. The Office also partners with the County Facilities Department to deploy ample traffic signage for every ballot drop box throughout the county. These efforts exceed state requirements. If the issue at hand is signage or communication regarding drop boxes, the Auditor should have simply stated this request rather than conflate it with ADA walk-up drop box requirements. The Clerk’s Office is committed to continuous improvement and will enhance its processes and checklists to ensure that all components of the drop boxes are thoroughly examined during routine checks. 3. Voter Accommodation Awareness Audit Finding: Limited awareness of available voter accommodations and translations. “Accommodations Offered, but Outreach Could Be Improved.” Response: Deschutes County Clerk’s Office ensures compliance with federal and state voting accessibility requirements by providing diverse resources and accommodations. The Voters’ Pamphlet is distributed to all registered voters and is available online.6 7 An audio version is also available and posted online to assist visually impaired individuals. For non-English speakers, the pamphlet contains links to translated versions on the Secretary of State’s website. The county website enhances accessibility further with a translation feature that supports nine languages, addressing the linguistic diversity. This robust approach fosters an inclusive voting environment, ensuring that all voters, regardless of language or ability, have access to critical election information. The Auditor did not provide specific information on what standard she is measuring Deschutes County against. The County Clerk’s Office has not received feedback of any kind from the public regarding communication about available accommodations. The Auditor somehow received feedback from unknown “representatives from the disability community” who said “there was not enough awareness about available accommodations. The report goes on to walk back this statement by stating, “the 6 (2023). Chapter 251 – Voters’ Pamphlet. Oregon Legislature. https://www.oregonlegislature.gov/bills_laws/ors/ors251.html 7 (2025, October 28). Secretary of State Elections Division – Chapter 165. Oregon Secretary of State Tobias Read. OAR 165-022 https://secure.sos.state.or.us/oard/displayChapterRules.action?selectedChapter=179 Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 33 of 40 problem was not specific to Deschutes County, but that Multnomah County did a better job of promoting accommodations.” It is unreasonable to compare these two counties given the vast differences in population, demographics and budgetary resources. If the standard of measure is Multnomah County instead of federal and state law, the Deschutes County Clerk’s Office asks for a more reasonable measurement. In a similar fashion, the Auditor referred to feedback provided by “the Latino community” but would not provide additional information when requested by the County Clerk. Missing from the audit report was the fact that the Clerk’s Office makes significant efforts to conduct various outreach initiatives despite limited funding and resources. Below are examples of how the Clerk’s Office disseminates and promotes accurate information regarding voter registration, elections, and voting: • Website Management: Maintain a website with up-to-date election information. • Public Communication: Collaborate with the County Communication Team to share key dates and processes through county social media and press releases. • Voters’ Pamphlet Distribution: Create and distribute a Voters’ Pamphlet for every election, sent to every household during countywide elections. Contents include: • Access to translated information • Key dates and deadlines • Voting Information: • Qualifications and procedures for registration • Registration deadlines and contact info • Voting Instructions • List of ballot drop sites and locations • Overview of the election process • Information about candidates and measures • Additional necessary information Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 34 of 40 • Media Engagement: Conduct interviews and participate in podcasts and spotlight articles with the County Public Information Officer (PIO). • Public Engagement: • Provide office tours office and processes for interested parties. • Present to groups upon request. • Conduct "Election Observer" training during primary and general elections to educate those interested in the overall process. • Youth Engagement: Organize art and coloring contests, including an "I Voted" sticker contest, to engage and educate youth about voting. • Educational Programs: Present at the County College program to explain the election process. • Community Involvement: Volunteer at the county booth during fairs when available. This comprehensive approach shows the commitment of the Clerk’s Office to providing transparent and accessible voting information to the community, while managing resource constraints effectively. Additional interest might focus on exploring innovative digital outreach techniques or partnerships to enhance voter engagement and education. This approach is regularly reassessed to identify opportunities for improvement. This continuous improvement process ensures that outreach efforts remain effective, relevant, and responsive to community needs. 4. Other Concerns with Audit Report Audit statement: The electoral process is increasingly scrutinized and public confidence in elections has lost ground. In Deschutes County, the responsibility to uphold the integrity of elections is more vital than ever. Response: The audit was initiated at the County Clerk's request in an effort to enhance transparency in response to public concerns about election integrity. However, the Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 35 of 40 focus on inaccuracies rather than the election process may have hindered potential benefits. By concentrating on the mechanics of what the County Clerk’s Offices does and how the department consistently achieves accuracy, this audit could have provided more substantial insights into the reliability of election systems. While some counties face audits after costly errors, proactive auditing of successful processes ensures continuous improvement without financial repercussions. Addressing how the County Clerk’s Office maintains secure and accurate elections time and again would offer deeper value and reinforce public confidence. Audit statement: Previous findings related to information security also contributed to a heightened sense of risk in this area. During a 2024 integrated audit, auditors found that Clerk’s Office recording staff not elections staff) disabled supervisor review and segregation of duties controls in software to make it easier to void receipts and to circumvent review processes. Staff were also using shared logins due to a perception that logging in and out of shared workstations took too much time. We recommended the Office either resolve these control issues or formally accept the risk of not implementing controls. Staff chose to resolve the controls issues. We also found that software access rights had not been updated during a 2008 cash handling audit. Response: The County Clerk’s Office requested that this paragraph be removed since its topic is unrelated to the scope of work of the elections audit. This paragraph highlights past information security issues that were acknowledged and resolved last year as part of a different audit. There is no apparent direct link between last year's control issues and the specific objectives of this election audit; consequently it's important to recognize that off-topic references such as references to past, resolved audits, could indirectly influence public trust in the Clerk's Office. This, in turn, might affect perceptions of election integrity. The Auditor denied the request of the Clerk to remove this paragraph from the report. Audit statement: The Americans with Disabilities Act, National Voters Registration Act, and Voting Rights Act require assistance and translation for registering and voting. Response: This statement is not true. Neither the National Voter Registration Act (NVRA) nor the Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 36 of 40 Voting Rights Act (VRA) requires translation for registration and voting nationwide. Only specific jurisdictions must provide translated materials and assistance, based on demographic criteria set by the VRA. Audit statement: Election staff have the authority to interpret voter intent. If staff abuse this authority it could result in reduced confidence in elections. Response: The suggestion that the Clerk’s Office staff might "abuse this authority," leading to reduced confidence in elections, is unwarranted and does not reflect the commitment and integrity that team consistently demonstrates. Staff adhere to strict guidelines from the Oregon Vote by Mail Manual for interpreting voter intent. Training is provided to ensure they follow procedures accurately. Ballot interpretation guidance is clearly laid out, and staff follow these protocols diligently to uphold electoral integrity. Ballot adjudication follows a strict two-person integrity policy where staff different political party affiliations work together to verify the voter intent of ballots that contain overvotes, undervotes, write-in names, and stray marks. Additionally, adjudication is done in a secure room under camera surveillance. Control processes, consistent with federal and state best practices for election security, abound here. The Clerk’s Office team is highly trained and dedicated to maintaining the electoral process's integrity, ensuring transparency and accountability at every step. Any implication otherwise fails to recognize the robust checks and balances in place that support fair and accurate election outcomes. These practices ensure that every vote is counted as intended, reflecting the team’s unwavering commitment to a fair and transparent electoral process. Audit statement: The Clerk’s Office website did not include information about accommodations or translation/interpretation. Response: This statement is not true. Information about accommodations and links to translated materials are provided in each Voters’ Pamphlet created by the Clerk’s Office. These pamphlets are also posted on the election webpage for each election. Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 37 of 40 Closing Comments In response to the audit report's concerns, it is crucial to address the vague reference to the "disability community" and “representatives from the Latino community” by seeking clarification from the Auditor as well as highlighting the Clerk’s Office’s proactive outreach and accessibility (such as ADA-compliant facilities and accessible voting machines). The lack of specific ORS and OAR citations in the report necessitates a request for these details to ensure compliance with laws such as the ADA and Help America Vote Act (HAVA). The efforts of the Clerk’s Office already exceed statutory requirements through enhanced election worker training, user- friendly voting guides, and collaboration with community organizations. However, budgetary and staffing constraints limit initiatives, despite the office’s efficient use of resources to maximize accessibility benefits. The Clerk’s Office maintains a strong commitment to accessibility, with plans for future enhancements contingent on resources, and seek ongoing engagement with advocacy groups for guidance. This situation underscores the need to explore additional funding opportunities, examine best practices from other jurisdictions, and ensure alignment with evolving needs in the disability community. 5. Appendix A: Objective, Scope, and Methodology The County Office of the Internal Auditor was created by the Deschutes County Code as an independent office conducting performance audits to provide information and recommendations for improvement. The audit included limited procedures to understand the systems of internal control. No significant deficiencies were found in this audit. The findings noted were primarily compliance and efficiency matters. Audit findings result from incidents of non-compliance with stated procedures and/or departures from prudent operation. The findings are, by nature, subjective. The audit disclosed certain policies, procedures and practices that could be improved. The audit was neither designed nor intended to be a detailed study of every relevant system, procedure, or transaction. Accordingly, the Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 38 of 40 opportunities for improvement presented in the report may not be all-inclusive of areas where improvement may be needed and does not replace efforts needed to design an effective system of internal control. Management has responsibility for the system of internal controls, including monitoring internal controls on an ongoing basis to ensure that any weaknesses or non-compliance are promptly identified and corrected. Internal controls provide reasonable but not absolute assurance that an organization’s goals and objectives will be achieved. Objectives and Scope The overall objective of the audit was to determine whether the County’s election system is secure, accessible, and accurate. Subobjectives included determining whether: • Information security controls on the Clear Ballot system were adequate to prevent tampering with the system • Voting was accessible to people with physical disabilities or language barriers • Control processes to identify ineligible registered voters were effective • The signature verification process correctly identified invalid signatures • The ballot inspection process correctly identified which ballots should be counted, enhanced/reproduced, or rejected The scope included preparing for and conducting the May 2025 election. Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 39 of 40 Methodology Audit procedures included: • Interviewing staff about policies and procedures for conducting elections • Interviewing community members about the elections process including the major political parties, experts in the field of elections, representatives of the disability community, and representatives of the Latino community • Conducting site reviews of ballot drop box locations • Reviewing outreach materials including the Voter’s Pamphlet and website • Reviewing the list of registered voters to look for reasonableness of the number voters registered at single household residents and cross referencing the list to records of deceased individuals from the Oregon Health Authority • Reviewing a sample of challenged and not challenged signatures. The sample included 30 unmatched signatures from a population of 294 and 30 matched signatures from a population of 36,715. Because the sample was randomly selected, results can be extrapolated to the population. • Reviewing a sample of adjudicated ballots for voter intent. The sample included 33 ballots from a population of 941. Because the sample was randomly selected, results can be extrapolated to the population. Planned methods included a review of information security for the Clear Ballot system, but the Clerk refused to cooperate with this portion of the audit. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. Some procedures could not be performed due to the Clerk’s refusal to Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor Page 40 of 40 cooperate with requests related to information security for the ballot counting software. As a result, the audit does not include a conclusion related to information security for ballot counting software, provide assurance that the system is secure, or offer recommendations to support continuous improvement. For the other areas of the audit, we believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. (2018 Revision of Government Auditing Standards, issued by the Comptroller General of the United States.) Clerk’s Office—Elections—A0129 Updated November 2025 Deschutes County Office of the Internal Auditor The mission of the Office of Internal Audit is to improve the performance of Deschutes County government and to provide accountability to residents. We examine and evaluate the effectiveness, efficiency, and equity of operations through an objective, disciplined, and systematic approach. The Office of Internal Audit: Audit committee: Elizabeth Pape – County Internal Auditor Daryl Parrish, Chair – Public member Susan DeJoode – Performance Auditor Phil Anderson – Public member Jodi Burch – Public member Phone: 541-330-4674 Liz Foott – Public member Email: internal.audit@deschutes.org Joe Healy – Public member Web: www.deschutes.org/auditor Kristin Toney – Public member Patti Adair, County Commissioner Steve Dennison, County Clerk Lee Randall, Facilities Director Please take a survey on this report by clicking this link: https://forms.office.com/g/UYBghHnG6G Or use this QR Code: If you would like to receive future reports and information from Internal Audit or know someone else who might like to receive our updates, sign up at http://bit.ly/DCInternalAudit.