Audit Report

State Board of Elections

October 2023

Public Notice

In compliance with the requirements of the State Government Article Section

2-1224(i), of the Annotated Code of Maryland, the Office of Legislative Audits
has redacted cybersecurity findings and related auditee responses
from this public report.

OFFICE OF LEGISLATIVE AUDITS

DEPARTMENT OF LEGISLATIVE SERVICES
MARYLAND GENERAL ASSEMBLY
 Joint Audit and Evaluation Committee
Senator Clarence K. Lam, M.D. (Senate Chair) Delegate Jared Solomon (House Chair)
Senator Joanne C. Benson Delegate Steven J. Arentz
Senator Paul D. Corderman Delegate Nicholas P. Charles II
Senator Katie Fry Hester Delegate Andrea Fletcher Harrison
Senator Shelly L. Hettleman Delegate Steven C. Johnson
Senator Cheryl C. Kagan Delegate Mary A. Lehman
Senator Cory V. McCray Delegate David Moon
Senator Justin D. Ready Delegate Julie Palakovich Carr
Senator Bryan W. Simonaire Delegate Stephanie M. Smith
Senator Craig J. Zucker Delegate M. Courtney Watson

To Obtain Further Information

Office of Legislative Audits
The Warehouse at Camden Yards
351 West Camden Street, Suite 400
Baltimore, Maryland 21201
Phone: 410-946-5900
Maryland Relay: 711
TTY: 410-946-5401 ꞏ 301-970-5401
E-mail: [email protected]
Website: www.ola.state.md.us

To Report Fraud
The Office of Legislative Audits operates a Fraud Hotline to report fraud, waste, or abuse involving State
of Maryland government resources. Reports of fraud, waste, or abuse may be communicated anonymously
by a toll-free call to 1-877-FRAUD-11, by mail to the Fraud Hotline, c/o Office of Legislative Audits, or
through the Office’s website.

Nondiscrimination Statement
The Department of Legislative Services does not discriminate on the basis of age, ancestry, color, creed,
marital status, national origin, race, religion, gender, gender identity, sexual orientation, or disability in the
admission or access to its programs, services, or activities. The Department’s Information Officer has been
designated to coordinate compliance with the nondiscrimination requirements contained in Section 35.107
of the United States Department of Justice Regulations. Requests for assistance should be directed to the
Information Officer at 410-946-5400 or 410-970-5400.
 October 31, 2023

Senator Clarence K. Lam, M.D., Senate Chair, Joint Audit and Evaluation Committee
Delegate Jared Solomon, House Chair, Joint Audit and Evaluation Committee
Members of Joint Audit and Evaluation Committee
Annapolis, Maryland

Ladies and Gentlemen:

We have conducted a fiscal compliance audit of the State Board of Elections

(SBE) for the period beginning December 3, 2018 and ending July 31, 2022. SBE
is responsible for managing and supervising elections and voter registrations in
the State. SBE directs, supports, monitors, and evaluates the activities of each of
the 24 local boards of election (LBE).

Our audit disclosed opportunities to strengthen SBE’s existing oversight process

of voter registration records (MDVOTERS) and its election oversight
responsibilities. Specifically, SBE could enhance its procedures to fully identify
deceased or duplicate voters in MDVOTERS and ensure local boards of election
(LBEs) corrected errors in voter data identified during periodic reviews. For
example, our analysis identified 2,426 potentially deceased individuals with
active voter registration and 327 individuals with potential duplicate voter
registrations. Additionally, our audit disclosed certain controls that could enhance
the integrity of the automated vote tabulation process. Specifically, although SBE
and our post-election testing did not identify material discrepancies in the voting
results, we found that one employee was responsible for programming and
distributing the electronic ballot databases to the 24 LBEs without an independent
review to ensure the electronic ballot was accurate and consistent with the printed
ballots.

Our audit also disclosed that SBE did not always timely refer potential improper
voter activity to the Office of the State Prosecutor (OSP) for investigation and
prosecution. For example, for the 2020 general election, SBE identified 134
voters who voted more than once and 1,371 voters who attempted to vote multiple
times (generally twice) but did not report these individuals to OSP until April
2022 (approximately 16 months after the election results were certified).

We noted a number of deficiencies with SBE’s security and control over its
information systems. However, in accordance with the State Government Article,
Section 2-1224(i) of the Annotated Code of Maryland, we have redacted the
findings from this audit report. Specifically, State law requires the Office of
Legislative Audits to redact cybersecurity findings in a manner consistent with
auditing best practices before the report is made available to the public. The term
“cybersecurity” is defined in the State Finance and Procurement Article, Section
3.5-301(b), and using our professional judgment we have determined that the
redacted findings fall under the referenced definition. The specifics of the
cybersecurity findings were previously communicated to those parties responsible
for acting on our recommendations.

Our audit also disclosed that SBE had not established adequate controls over the
processing of payroll transactions and SBE did not always post Board meeting
agendas on its website for the public at least 48 hours in advance of the scheduled
meeting start time as required by the State’s Open Meetings Act.

Finally, our audit included a review to determine the status of the three findings
contained in our preceding audit report. For the non-cybersecurity-related finding
we determined that SBE did not satisfactorily address this one prior finding and it
is repeated in this report.

SBE’s response to this audit is included as an Appendix B to this report. In

accordance with State law, we have reviewed the response and, while SBE
generally agrees with the recommendations in this report, we identified several
significant instances in which statements in the response conflict or disagree with
the report findings. In each instance, we reviewed and reassessed our audit
documentation, and reaffirmed the validity of our finding.

In accordance with generally accepted government auditing standards, we have

included general “auditor’s comments” in Appendix A in relation to SBE’s
disagreements with the report findings. In relation to those significant instances
in which SBE did not agree with specific information included in the report
finding, we have also inserted “auditor’s comments” within the SBE’s response to
explain our position. In accordance with our policy, we have also redacted any
vendor names or products mentioned by SBE in this document. In addition,

2
consistent with State law, we have redacted the elements of SBE’s response
related to the cybersecurity audit findings.

We will advise the Joint Audit and Evaluation Committee of any outstanding
issues that we cannot resolve with the SBE. Notwithstanding the aforementioned
disagreements, we wish to acknowledge the cooperation extended to us during the
audit by SBE, its agreement with our recommendations and willingness to address
the audit issues and implement appropriate corrective actions.

Respectfully submitted,

Gregory A. Hook, CPA

Legislative Auditor

3
4
 Table of Contents

Background Information 7

Agency Responsibilities 7
Status of Findings From Preceding Audit Report 8

Findings and Recommendations 10

Statewide Voter Registration

* Finding 1 – The State Board of Elections (SBE) could enhance its 10
procedures to fully identify deceased or duplicate voters in the
Statewide voter registration system (MDVOTERS). Additionally,
SBE did not ensure local boards of election corrected
errors in voter data identified during periodic reviews.

Election Oversight
Finding 2 – Although testing did not identify material discrepancies in 13
voting results, we identified opportunities to enhance the integrity
of the automated vote tabulation process.

Finding 3 – SBE did not always timely refer potential improper voter 14
activity to the Office of the State Prosecutor for investigation.

Information Systems Security and Control

Finding 4 – Redacted cybersecurity-related finding 15

Finding 5 – Redacted cybersecurity-related finding 15

Finding 6 – Redacted cybersecurity-related finding 15

Payroll
Finding 7 – SBE had not established adequate controls to ensure the 15
propriety of payroll transactions, including adjustments to employee
leave balances.

Board Meetings
Finding 8 – SBE did not always post Board meeting agendas on its 17
website at least 48 hours in advance of the scheduled meeting start
time as required by the State’s Open Meetings Act.

* Denotes item repeated in full or part from preceding audit report

5
Audit Scope, Objectives, and Methodology 18

Auditor’s Comments Appendix A

Agency Response Appendix B

6
 Background Information

Agency Responsibilities

The Election Law Article, Section 2-101 of the Annotated Code of Maryland,
established the State Board of Elections (SBE) under the direction of a five-
member Board appointed by the Governor, with the advice and consent of the
Senate. In addition, in accordance with Section 2-201 of the aforementioned
Article, the Governor appoints local boards of election within each of the State's
24 subdivisions. Each local board is charged with overseeing the conduct of all
elections within its respective jurisdiction.

SBE is responsible for managing and supervising elections and voter registrations
in the State. SBE directs, supports, monitors, and evaluates the activities of each
local board. In addition, SBE administers sections of the Election Law Article
that govern the receipt and expenditure of funds for election campaigns and
administers the Public Financing Act, which provides for public financing of the
campaigns of eligible gubernatorial candidates who elect to use such funds. SBE
also serves as a depository for election and registration records, campaign
financial reports, and other election information.

According to the State's records, during fiscal year 2022, SBE had 46 authorized
positions and expenditures totaled approximately $49.2 million (see Figure 1 on
the following page). SBE also processes the payroll for 20 of the 24 local boards
of election, which during fiscal year 2021 totaled an additional $15.7 million, and
is subsequently reimbursed for these costs by the respective local boards of
elections.

7
 Figure 1
SBE Positions, Expenditures, and Funding Sources
Full-Time Equivalent Positions as of June 30, 2022
Positions Percent
Filled 43 93.5%
Vacant 3 6.5%
Total 46

Fiscal Year 2022 Expenditures

Expenditures Percent
Salaries, Wages, and Fringe Benefits $5,054,254 10.3%
Technical and Special Fees 126,763 0.2%
Operating Expenses 44,056,966 89.5%
Total $49,237,983

Fiscal Year 2022 Funding Sources

Funding Percent
General Fund $22,705,664 46.1%
Special Fund 23,836,524 48.4%
Federal Fund 943,687 1.9%
Reimbursable Fund 1,752,108 3.6%
Total $49,237,983

Source: State financial and personnel records

Status of Findings From Preceding Audit Report

Our audit included a review to determine the status of the three findings contained
in our preceding audit report dated December 12, 2019. As disclosed in Figure 2
on the following page, for the non-cybersecurity-related finding, we determined
that the finding was not satisfactorily addressed and it is repeated in this report.

8
 Figure 2
Status of Preceding Findings
Preceding Implementation
Finding Description
Finding Status
SBE did not perform periodic documented reviews of access
Finding 1 to the Statewide voter registration system (MDVOTERS) to Status Redacted1
ensure access capabilities were appropriately restricted.
SBE’s oversight processes were not sufficient to ensure the Repeated
Finding 2
accuracy of voter registration data recorded in MDVOTERS. (Current Finding 1)
SBE had not established adequate application maintenance
controls for developing, reviewing, approving, documenting, Status Redacted1
Finding 3
and placing program changes into production related to two
SBE maintained application systems.

1
Specific information of the current status of this cybersecurity–related finding has been redacted
from the publicly available report in accordance with State Government Article, Section 2-
1224(i) of the Annotated Code of Maryland.

9
 Findings and Recommendations

Statewide Voter Registration

Background
State and federal law require the State Board of Elections (SBE) to establish,
maintain, and administer a Statewide voter registration database. The Statewide
voter registration system (MDVOTERS) contains the State’s official voter
registration database and is separate from the Statewide electronic voting system.
Employees from each of the State’s 24 local boards of election (LBE) are
primarily responsible for processing (adding, deleting, changing) voter
registration data on MDVOTERS. SBE is responsible for maintaining
MDVOTERS and ensuring that the LBEs are properly processing voter data.

In addition, SBE, in concert with 25 other states and the District of Columbia,
takes part in an initiative to help ensure the accuracy of voter registration data.
Under a multi-state compact, SBE provides certain voter information to the
nonprofit Electronic Registration Information Center (ERIC) 2, including the
name, date of birth, driver’s license number, and last four digits of the social
security number of each registered voter in Maryland. ERIC compares voter data
from various sources, including voters recorded as deceased on the federal death
registry, and provides state election officials with reports of potential ineligible
voters, such as voters registered in multiple states. ERIC makes use of a third-
party vendor to store and process the collected voter data.

According to SBE records, there were 4,148,651 active registered voters in

MDVOTERS as of December 2022. During calendar year 2022, there were
295,572 new voters added to and 302,208 voters removed from the database.

Finding 1
SBE could enhance its procedures to fully identify deceased or duplicate
voters recorded in MDVOTERS. Additionally, SBE did not ensure local
boards of election corrected errors in voter data identified during periodic
reviews.

Analysis
SBE could enhance its procedures to fully identify deceased or duplicate voters
recorded in MDVOTERS. Additionally, SBE did not ensure LBEs corrected
errors in voter data identified during periodic reviews.

2
States’ membership in ERIC is currently in flux, as a number of states have taken actions to
withdraw from the compact. SBE advised that it intends to continue ERIC membership.

10
Procedures to Identify Potentially Deceased or Duplicate Voters Could be
Enhanced
We found that SBE’s match of voter records to State death records were not as
comprehensive as necessary to identify certain potentially deceased voters. For
identifying potentially deceased voters in MDVOTERS, SBE only followed up on
individuals that were exact matches (such as identical spelling and format of
names) based on records of potentially deceased voters it receives from the
Maryland Department of Health (MDH).3 SBE could be investigating the MDH
results of broader matching parameters, which would include both exact matches
and results that are very close to certain user-defined parameters (called “fuzzy”
matching). For example, “fuzzy” matching would provide match results that
reflect John T. Smith on one data set and John Thomas Smith on the other data
set. Furthermore, based on our inquiries into SBE’s procedures to identify
potentially deceased voters, SBE management advised that it determined that the
information received by SBE from MDH was not complete as it did not include
all individuals who died in Maryland.

We performed a comparison of MDVOTERS records as of December 15, 2022 to

records we obtained from MDH of deceased individuals as of May 24, 2022 using
“fuzzy” matching and identified 2,426 potentially deceased individuals with
active voter registration. Our limited review of five of these individuals disclosed
that four were deceased.

The current manual review conducted by the LBEs to identify duplicate voters
does not appear to detect all duplicate voters and we believe that a periodic
analysis of MDVOTERS could enhance SBE’s procedure. When a new voter
record is created, MDVOTERS will automatically determine if potential duplicate
voter registration records exist. If the system identifies a potential duplicate, the
corresponding LBE will be notified, and a manual review is performed by the
LBE to determine if the new voter record should be merged with an existing
record or should be considered a new record. However, we performed an analysis
of MDVOTERS records as of December 15, 2022 to identify individuals with the
same name and date of birth with different voter ID numbers. Our analysis
identified 327 potential duplicate voter registrations. We reviewed five of these
potential duplicate voter registrations with SBE management and confirmed that
all five were duplicate voter registrations.

SBE Did Not Ensure LBEs Corrected Errors in Voter Data

SBE did not ensure LBEs corrected errors in voter data identified during periodic
reviews. For example, SBE used data from ERIC to identify voters also

3
Additionally, SBE receives death records from ERIC every two months, which are uploaded into
MDVOTERS for manual review by the LBEs.

11
registered in other states and voters recorded as deceased on the federal death
registry. The results of these reviews were provided to the appropriate LBEs,
which were responsible for correcting voter registration in MDVOTERS. In
addition, LBEs were required to conduct monthly peer reviews of voter data
entered by other LBEs. Our review disclosed that SBE did not ensure that errors
identified by these periodic reviews were corrected by the LBEs.

 Our test of 14 LBE peer reviews performed during the period from October
2020 through August 2021 disclosed that, as of May 2022, the LBEs had not
corrected 15 of the 19 identified errors that were outstanding for 240 to 483
days. For example, as of May 2022, one LBE had not removed a voter for
332 days after receiving notification of the voter’s death.

 Our test of 10 SBE reviews performed during the period from July 2020
through October 2021 disclosed that SBE had not verified that the correction
had been made by the LBE for 11 of the 13 identified errors that were
outstanding from 117 to 398 days. For example, as of May 2022, one LBE
had not obtained support for the reactivation of a voter’s registration 329 days
after the review.

A similar finding regarding the accuracy of voter registration data was

commented upon in our preceding audit report. In response to our prior report,
SBE indicated that it had established a process to implement the recommended
corrective action in August 2019. Specifically, SBE advised that if LBEs did not
perform corrective action timely, SBE would make the correction on the LBE’s
behalf and notify the appropriate Election Director, local board members, and the
State Administrator. However, as noted above, the established process was not
performed, and the review of voter registration data remained inadequate.

Recommendation 1
We recommend that that SBE
a. enhance its procedures as noted above to fully identify deceased and
duplicate voters recorded in MDVOTERS; and
b. ensure that the LBEs have taken the appropriate corrective actions to
update voter registration records in MDVOTERS for results of various
reviews performed by the LBEs and SBE, including those noted above
(repeat).

12
Election Oversight

Finding 2
Although testing did not identify material discrepancies in the voting results,
we identified opportunities to enhance the integrity of the automated vote
tabulation process.

Analysis
Although SBE and our post-election testing did not identify material
discrepancies in the voting results, we identified certain controls that could
enhance the integrity of the automated vote tabulation process. Specifically, our
review disclosed one employee was responsible for programming and distributing
the electronic ballot databases to the 24 LBEs without an independent review to
ensure the ballot as scanned and recorded in the database was accurate and
consistent with the printed ballots.

The programming of the ballot is important because the system counts votes
based on the location of the names on the ballot so discrepancies between the
printed ballots and the electronic database could result in the wrong vote being
counted. For example, if candidate A was listed before candidate B on the written
ballot but reversed in the programming of the database used to record the scanned
ballot results, it would result in the vote being credited to the wrong candidate.4

In accordance with State law SBE performed a post-election manual ballot

tabulation audit for the 2020 general election and found no significant vote
differences between the manual audit and the voting system results. In addition,
our judgmental test of 50 ballots from 5 LBEs from the 2020 general election and
the 2022 primary election did not identify variances between paper ballots and the
electronic ballot databases used to program election equipment.

Recommendation 2
We recommend that SBE establish an independent supervisory review of its
programming and distribution of the electronic ballot database. We advised
SBE on using existing personnel to establish an independent supervisory
review.

4
Although SBE performed logic and accuracy testing of election equipment after electronic ballot
databases were programmed and distributed to ensure that equipment was functioning properly,
the testing did not compensate for the lack of supervisory review over the programming and
distribution of the electronic ballot database.

13
Finding 3
SBE did not always timely refer potentially improper voter activity to the
Office of the State Prosecutor (OSP) for investigation.

Analysis
SBE did not always timely refer potentially improper voter activity to OSP for
investigation. SBE conducts various reviews to identify improper voter activity,
including voters who voted or attempted to vote multiple times and votes cast
after voters were deceased. SBE forwards the results of its review to OSP for
further investigation and possible prosecution.

For the 2020 general election, SBE identified 134 voters who successfully voted
multiple times and 1,371 voters who attempted to vote multiple times.5
Additionally, for the July 2022 primary election, SBE identified 4 individuals
who successfully voted multiple times and 263 voters who attempted to vote
multiple times. While SBE timely referred the voters from the July 2022 primary
election to OSP, SBE did not refer the individuals it identified in the 2020 general
election to OSP until April 2022 (approximately 16 months after the election
results were certified). SBE explained the untimely referral was due to personnel
turnover.

At the time of our audit, State law provided that OSP had three years from the
date when the election offense occurred to pursue prosecution for violations of
State voting statutes, although there is no criteria for the timing of SBE reporting
of a potential election offense to the OSP. In our opinion, more timely reporting
by SBE would provide OSP sufficient time to investigate and pursue action
against individuals improperly voting.

Recommendation 3
We recommend that SBE, in conjunction with the OSP, establish guidance
for timely referral to the OSP of potentially improper voter activity.

5
Although we have used “multiple”, in the overwhelming number of cases, the individuals voted
or attempted to vote twice.

14
Information Systems Security and Control

We determined that the Information Systems Security and Control section,

including Findings 4 through 6 related to “cybersecurity”, as defined by the State
Finance and Procurement Article, Section 3.5-301(b) of the Annotated Code of
Maryland, and therefore are subject to redaction from the publicly available audit
report in accordance with the State Government Article 2-1224(i). Consequently,
the specifics of the following findings, including the analysis, related
recommendations, along with SBE’s responses, have been redacted from this
report copy.

Finding 4
Redacted cybersecurity-related finding.

Finding 5
Redacted cybersecurity-related finding.

Finding 6
Redacted cybersecurity-related finding.

Payroll

Finding 7
SBE had not established adequate controls to ensure the propriety of payroll
transactions, including adjustments to employee leave balances.

Analysis
SBE had not established adequate controls over the processing of payroll
transactions on the Statewide Personnel System (SPS). According to the State’s
records, payroll expenditures totaled approximately $21.1 million during fiscal
year 2022, which includes $15.9 million of payroll expenditures for the 20 LBEs
whose payrolls are processed by SBE.

 SBE did not ensure that all employees recorded their time in SPS and that
designated supervisors approved the reported time prior to processing payroll.
We judgmentally selected 17 employees’ time entries from 19 different pay
periods and found 5 employees who did not record all their time in SPS during

15
 11 pay periods.6 For example, one employee did not record time in SPS for 3
pay periods. In addition, the designated supervisor did not approve the time
recorded by 9 employees over 7 pay periods. We noted that for 6 of these 9
employees, 224 leave hours (personal, annual, and sick) used during the pay
periods tested were not reduced from the employee's leave balance.

 SBE did not use available system output reports to ensure leave adjustments in
SPS were proper. During the period of December 3, 2018 through July 31,
2022, SBE processed 456 leave adjustments (such as leave bank enrollments)
that increased employee leave balances by 5,523 hours and decreased leave
balances by 7,423 hours. Our test of 10 leave adjustments processed by SBE
disclosed 4 adjustments that did not appear to be justified or proper. For
example, 2 adjustments tested included 107 hours of parental leave awarded to
2 employees valued at $1,660 that exceeded the 555 hours parental leave
allowed by State law.

 SBE did not verify that the total payroll, as reflected in the Comptroller of
Maryland’s Central Payroll Bureau (CPB) payroll registers, agreed with SPS
payroll summary reports reflecting the amount that should have been paid
based on each employee’s approved work time and salary information. The
verification is necessary because certain unique SPS design features often
result in differences between the CPB and SPS. For example, CPB payroll
registers only reflect activity processed during the particular pay period while
SPS payroll summary reports will reflect all activity relevant to the pay period
irrespective of when the transactions were processed. We compared SBE’s
CPB payroll registers with the SPS payroll summary report for the pay period
ending January 25, 2022 and did not identify any unexplainable differences.

Recommendation 7
We recommend that SBE
a. ensure that all employee time is properly recorded by employees and
approved by designated supervisors prior to payroll processing;
b. independently verify leave balance adjustments to ensure that only
authorized adjustments have been processed and take appropriate
corrective action when errors are noted, including those noted above; and
c. reconcile total payroll as reflected in CPB payroll registers each pay
period with SPS payroll summary reports, investigate any differences,
and ensure that those reconciliations are documented.

6
The employees were judgmentally selected from the Report of CPB earnings by pay period and
the SPS Reporting of unapproved time and time off.

16
Board Meetings

Finding 8
SBE did not always post Board meeting agendas on its website at least 48
hours in advance of the scheduled meeting start time as required by the
State’s Open Meetings Act.

Analysis
SBE did not always post Board meeting agendas on its website at least 48 hours
in advance of the scheduled meeting start time as required by the Open Meetings
Act. The Open Meetings Act of 2020 requires a number of agencies, including
SBE, to (publicly) share meeting agendas online at least 48 hours in advance of
convening in order to help improve transparency and accountability. Our Fraud
Investigation Unit received a referral to our fraud, waste, and abuse hotline
regarding concerns with the untimely public posting of SBE agendas in advance
of scheduled meetings. As a result, we reviewed SBE’s website for its posting of
agendas for the six regular meetings held between January 2022 and August 2022.

Our test disclosed three meetings in which SBE posted the related agenda less
than 48 hours in advance of the meeting's start time as required by the Act.
Specifically, SBE posted these agendas 1.5 hours, 26.5 hours and 45.57 hours in
advance of the meeting’s scheduled start time instead of the required 48 hours.
SBE advised us that the posting delays were due to additional time needed to
prepare the agenda or human error.

Recommendation 8
We recommend that SBE comply with the Open Meetings Act and publicly
post all meeting agendas on its website at least 48 hours in advance of the
meeting starting time.

7
These times reflect the posting of the original agenda, certain of which were subsequently
updated with the final agenda posted closer to the meeting. For example, the aforementioned
agenda posted 45.5 hours before the meeting was subsequently updated with the final agenda
posted only 5.5 hours before the meeting. The Act makes no provision or allowance for posting
a “final” agenda less than 48 hours before the meeting; in other words, the final agenda should
be posted 48 hours prior to the regularly scheduled meeting.

17
 Audit Scope, Objectives, and Methodology
We have conducted a fiscal compliance audit of the State Board of Elections
(SBE) for the period beginning December 3, 2018 and ending July 31, 2022. The
audit was conducted in accordance with generally accepted government auditing
standards. Those standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our findings and
conclusions based on our audit objectives. We believe that the evidence obtained
provides a reasonable basis for our findings and conclusions based on our audit
objectives.

As prescribed by the State Government Article, Section 2-1221 of the Annotated

Code of Maryland, the objectives of this audit were to examine SBE’s financial
transactions, records, and internal control, and to evaluate its compliance with
applicable State laws, rules, and regulations.

In planning and conducting our audit, we focused on the major financial-related

areas of operations based on assessments of significance and risk. The areas
addressed by the audit included voter registration, election oversight,
procurements, disbursements, and payroll. We also determined the status of the
findings included in our preceding audit report.

Our audit did not include an evaluation of internal controls over compliance with
federal laws and regulations for federal financial assistance programs and an
assessment of SBE’s compliance with those laws and regulations because the
State of Maryland engages an independent accounting firm to annually audit such
programs administered by State agencies, including SBE.

Our assessment of internal controls was based on agency procedures and controls
in place at the time of our fieldwork. Our tests of transactions and other auditing
procedures were generally focused on the transactions occurring during our audit
period of December 3, 2018 to July 31, 2022, but may include transactions after
this period as we considered necessary to achieve our audit objectives.

To accomplish our audit objectives, our audit procedures included inquiries of

appropriate personnel, inspections of documents and records, tests of transactions,
and to the extent practicable, observations of SBE’s operations. Generally,
transactions were selected for testing based on auditor judgment, which primarily
considers risk, the timing or dollar amount of the transaction, or the significance
of the transaction to the area of operation reviewed. As a matter of course, we do
not normally use sampling in our tests, so unless otherwise specifically indicated,
neither statistical nor non-statistical audit sampling was used to select the

18
transactions tested. Therefore, unless sampling is specifically indicated in a
finding, the results from any tests conducted or disclosed by us cannot be used to
project those results to the entire population from which the test items were
selected.

We also performed various data extracts of pertinent information from the State’s
Financial Management Information System (such as revenue and expenditure
data) and the State’s Central Payroll Bureau (payroll data). The extracts are
performed as part of ongoing internal processes established by the Office of
Legislative Audits and were subject to various tests to determine data reliability.
We determined that the data extracted from these sources were sufficiently
reliable for the purposes the data were used during this audit. We also extracted
data from the MDVOTERS voter registration database, the Maryland Department
of Health’s Vital Records database, and the Administrative Office of the Courts
for the purpose of performing certain tests and to compare these data sets for
testing purposes. We performed various tests of the relevant data and determined
that the data were sufficiently reliable for the purposes the data were used during
the audit. Finally, we performed other auditing procedures that we considered
necessary to achieve our objectives. The reliability of data used in this report for
background or informational purposes was not assessed.

SBE’s management is responsible for establishing and maintaining effective

internal control. Internal control is a process designed to provide reasonable
assurance that objectives pertaining to the reliability of financial records,
effectiveness and efficiency of operations including safeguarding of assets, and
compliance with applicable laws, rules, and regulations are achieved. As
provided in Government Auditing Standards, there are five components of
internal control: control environment, risk assessment, control activities,
information and communication, and monitoring. Each of the five components,
when significant to the audit objectives, and as applicable to SBE, were
considered by us during the course of this audit.

Because of inherent limitations in internal control, errors or fraud may

nevertheless occur and not be detected. Also, projections of any evaluation of
internal control to future periods are subject to the risk that conditions may
change or compliance with policies and procedures may deteriorate.

Our reports are designed to assist the Maryland General Assembly in exercising
its legislative oversight function and to provide constructive recommendations for
improving State operations. As a result, our reports generally do not address
activities we reviewed that are functioning properly.

19
This report includes findings relating to conditions that we consider to be
significant deficiencies in the design or operation of internal control that could
adversely affect SBE’s ability to maintain reliable financial records, operate
effectively and efficiently, and/or comply with applicable laws, rules, and
regulations. Our report also includes findings regarding significant instances of
noncompliance with applicable laws, rules, or regulations. Other less significant
findings were communicated to SBE that did not warrant inclusion in this report.

State Government Article Section 2-1224(i) requires that we redact in a manner

consistent with auditing best practices any cybersecurity findings before a report
is made available to the public. This results in the issuance of two different
versions of an audit report that contains cybersecurity findings – a redacted
version for the public and an unredacted version for government officials
responsible for acting on our audit recommendations.

The State Finance and Procurement Article, Section 3.5-301(b), states that
cybersecurity is defined as “processes or capabilities wherein systems,
communications, and information are protected and defended against damage,
unauthorized use or modification, and exploitation”. Based on that definition, and
in our professional judgment, we concluded that certain findings in this report fall
under that definition. Consequently, for the publicly available audit report all
specifics as to the nature of cybersecurity findings and required corrective actions
have been redacted. We have determined that such aforementioned practices, and
government auditing standards, support the redaction of this information from the
public audit report. The specifics of these cybersecurity findings have been
communicated to SBE and those parties responsible for acting on our
recommendations in an unredacted audit report.

SBE’s response to our findings and recommendations is included as an appendix

to this report. Depending on the version of the audit report, responses to any
cybersecurity findings may be redacted in accordance with State law. As
prescribed in the State Government Article, Section 2-1224 of the Annotated
Code of Maryland, we will advise SBE regarding the results of our review of its
response.

20
 APPENDIX A

The State Board of Elections (SBE) has indicated disagreement with the factual
accuracy of several findings in this report, and in some cases, indicates that we
mischaracterized or did not support the issues being presented in the finding.
Despite these disagreements, SBE has agreed to implement the related
recommendations. While we welcome and appreciate SBE explanations and
justifications for the deficiencies to provide added insight, as noted below the
information provided by SBE did not refute our findings.

For each SBE disagreement, we reviewed and reassessed our audit documentation
and reaffirmed the validity of our findings and related recommendations.
Contrary to the assertions made in the response, the findings contained in this
audit report are factually accurate, fairly presented, and properly supported in
accordance with government auditing standards. In relation to those significant
instances in which SBE did not agree with specific information included in the
report finding, additional details to explain our position are included in the
auditor’s comments within SBE’s response.
 APPENDIX B
MARYLAND
STATE BOARD OF ELECTIONS
P.O. BOX 6486, ANNAPOLIS, MD 21401-0486 PHONE (410) 269-2840
Michael G. Summers, Chairman Jared DeMarinis
William G. Voelp, Vice Chairman State Administrator
Carlos Ayala
Janet Millenson Katherine Berry
Yaakov “Jake” Weissmann Deputy Administrator

October 6, 2023

Via Electronic Mail

Gregory A. Hook, CPA

Legislative Auditor
Department of Legislative Services
351 West Camden Street
Baltimore, MD 21201

Dear Mr. Hook:

Thank you for the opportunity to respond to the Legislative Auditor’s audit report for
the period from December 3, 2018, through July 31, 2022. Enclosed is SBE’s response to the
audit report.

If you have any questions, please feel free to contact me.

Sincerely,

Jared DeMarinis
State Administrator

FAX (410) 974- 2019 Toll Free Phone Number (800) 222-8683 151 West Street Suite 200
MD Relay Service (800) 735-2258 https://elections.maryland.gov Annapolis, Maryland 21401
 State Board of Elections
Agency Response Form

Statewide Voter Registration

Finding 1
SBE could enhance its procedures to fully identify deceased or duplicate voters recorded in
MDVOTERS. Additionally, SBE did not ensure local boards of election corrected errors in
voter data identified during periodic reviews.

We recommend that SBE

a. enhance its procedures as noted above to fully identify deceased and duplicate voters
recorded in MDVOTERS; and
b. ensure that the LBEs have taken the appropriate corrective actions to update voter
registration records in MDVOTERS for results of various reviews performed by the
LBEs and SBE, including those noted above (repeat).

Agency Response
Analysis
Please provide Procedures to Identify Potentially Deceased or Duplicate Voters Could
additional comments as be enhanced.
deemed necessary.
While SBE agrees to enhanced procedures to identify deceased and
duplicate voters, it maintains that the current processes are
comprehensive and effective and notes that OLA’s characterization of
the current process and the figures in the discussion notes are
mischaracterized. Moreover, the manual review required to enhance
procedures will require additional staff given the current workload of the
unit.

This response addresses each of the areas separately below:

Potentially Deceased Voters

OLA states that “for identifying potentially deceased voters in
MDVOTERS, SBE only followed up on individuals that were exact
matches (such as identical spelling and format of names) based on
records of potentially deceased voters it receives from ERIC and the
Maryland Department of Health (MDH).” This is inaccurate. SBE
follows up on all records received to determine if they are a match to a
voter in the voter registration database. In determining whether a match
exists, SBE requires an exact match on date of death, date of birth, and
first name. A fuzzy match is performed on last name. OLA next states
that its proposed solution “would provide match results that reflect John
T. Smith on one data set and John Thomas Smith on the other data set.”

Page 1 of 13
 State Board of Elections
Agency Response Form

This statement implies that SBE logic would currently not provide a
match. However, current matching logic would provide such a match.

OLA identified 2,426 potentially deceased voters with dates of death

from 1984 to the end of the audit period - a 38-year window. SBE
reviewed the information provided for each of the 2,426 voters by first
searching MDVOTERS to ensure that the voter was not canceled. If the
voter was still active, the information was searched in the MDH
Interface in MDVOTERS. If an exact match was not found, the date of
death or date of birth was used to complete the search. The MDH record
that matched either date of death or date of birth was compared against
the voter record to determine if the records were for the same person. If
the voter record and death record had a “fuzzy match” on one name
(potential misspelling, special character, different middle name or initial)
but the same first or last name, same date of birth, and same date of
death, the voter was identified as a match.

During this process to review all 2,426 records, SBE did not locate
information for 761 voters on the MDH interface. This means that MDH
did not provide SBE death records for 761 of the voters. Upon
researching these voters, it was determined that the voters died in
Maryland but listed another state as their residence on their death
certificate. Both OLA and MDH acknowledge that this data was not
sent to SBE and, currently, cannot be provided to SBE by MDH due to
agency policy. However, OLA has issued a finding holding SBE
accountable for not processing records that it has not
received. Furthermore, SBE requested that OLA provide the source of
this data several times so that it could ensure proper follow up, but this
information has not yet been provided.

In addition, three of the potentially deceased voters were not deceased,

as the information identified by OLA was not a match for a voter in the
MDH interface. This information was provided to OLA, yet the voters
remain in the finding. If these results are removed from the number of
records for which death records were received but not processed, the
number of records received but not processed is 1,662 records.

In order to quantify the effectiveness of SBE’s current matching process,

these numbers must be viewed in context. One thousand fifty-nine
(1,059) of all records provided by OLA had dates of death during the
audit period. All other dates of death preceded the audit period. SBE
did not receive death information from MDH for 150 individuals and
one was a duplicate, leaving 908 voters that were not canceled during the
audit period. In context, during the same time the LBEs canceled

Page 2 of 13
 State Board of Elections
Agency Response Form

145,931 voters due to receiving death notices from all sources - ERIC,
MDH, reports of family members, etc. The 908 potentially deceased
voters that were not canceled account for 0.62% of all voters that should
have been removed. Regarding the voters that were not canceled after
receiving notification of death, none of these voters were an exact match
to an active voter in our database. Rather, all had either a special
character in their name or different spelling of their first or last name that
prevented MDVOTERS from identifying the voter as a match.

Given this percentage of successful cancellation of deceased voters, SBE

maintains that the current procedures are sufficient to identify deceased
voters and cancel them. However, noting that there is room for
improvement, SBE will make the following changes to its processing of
MDH death records. SBE will implement changes to the matching
process to include non-exact matches on first or last name due to
hyphens or apostrophes. These will be sent to the LBEs for processing
as normal. In addition, SBE will create a monthly list of all deceased
residents who are not forwarded to LBEs for processing, because they do
not match a voter in MDVOTERS. Additional SBE staff has been
requested to facilitate a manual “fuzzy match” analysis on those records.

Duplicate Voters
SBE disagrees with the finding that “a periodic analysis of
MDVOTERS” is not completed by SBE. SBE uses a multiple step
process to identify potential duplicate voters. As described in the
finding, the MDVOTERS system has logic that identifies potential
duplicate voters as a duplicate when a new voter record is created. If a
duplicate voter is erroneously entered into MDVOTERS, there are
several period reviews that identify duplicate entries. SBE receives
ERIC reports every two months that identify potential duplicate voters.
Prior to each election, SBE staff exports from MDVOTERS a list of all
registered voters to load into the electronic pollbooks that are used at
voting locations. These processes are so effective that OLA identified
only 268 duplicate records of 4,148,651 active voter records in the SBE
database. This number represents 0.00645% of all active registered
voters.

OLA identified 327 pairs of records as potential duplicates. SBE

reviewed all duplicate records using the following process: each of the
327 pairs of records provided were compared using information in
MDVOTERS to ensure that the records were the same voter.

SBE found that fifty-nine of the 327 records had previously been

Page 3 of 13
 State Board of Elections
Agency Response Form
identified and corrected after the close of the 2022 General Election.
Since records cannot be merged during an election, there was a backlog
that was alleviated between December 2022 and March 2023, and none
of the pairs of records contained duplicate voting history. This left 268
duplicate records - 0.00645% - of 4,148,651 active voter records in
MDVOTERS. We have provided OLA with this information, but the
number has not been adjusted in the findings. Furthermore, SBE lacks
sufficient information to respond to the finding regarding five sample
cases. The cases were not identified, such that SBE could review the
records to determine.

SBE Did Not Ensure LBEs Corrected Errors in Voter Data

OLA found that SBE did not ensure that the LBEs corrected errors in
voter data identified during periodic reviews. Specifically, 15 of 19
identified errors from peer reviews were not corrected and eleven of 13
identified errors from SBE reviews were not corrected.

Each month, the LBEs perform peer reviews of changes made to critical
data in MDVOTERS. Each LBE is assigned another LBE and using
procedures and requirements set out by SBE, reviews certain
transactions performed by that LBE. SBE randomly selects four of the
peer reviews to audit monthly in a quality assurance review. If an LBE
fails to follow the proper procedure in making changes to critical data in
MDVOTERS, an exception is noted by SBE. SBE notifies the LBEs of
exceptions discovered during the SBE quality assurance review and
requires the LBE to submit a corrective action plan, with an estimated
completion date.

During the audit period, the LBEs reviewed 618,977 transactions using
the peer review process. SBE audited 10,748 of these transactions and
identified 738 exceptions. Of the 738 exceptions, 712 were corrected by
the LBE using the process described above. There were 26 errors that
were not corrected, which accounts for .0042% of all transactions,
0.24% of audited transactions, and 3.52% of all exceptions identified
during the review process. That said, the process will be updated to
ensure that 100% of identified exceptions are corrected. The new
process is described below in the Recommendations portion of this
discussion note.

Auditor’s Comment: Although SBE agrees with the audit recommendations, SBE
indicated that the Office of Legislative Audits (OLA) did not provide the source of its
data used to identify deceased voters. Contrary to these assertions, during the course of
the audit, OLA provided SBE with the deceased voter information as well the source of
the information on which the finding was based. OLA also referred SBE to appropriate

Page 4 of 13
 State Board of Elections
Agency Response Form

personnel at the Maryland Department of Health (MDH) from which OLA obtained the
information. Consequently, it remains for SBE to work in conjunction with legal counsel
and MDH to obtain a complete record of deceased individuals or determine if any
statutory limitations exist preventing MDH from providing a complete record.

SBE also stated that our analysis included individuals with dates of death that preceded
the current audit period. As noted in the “Audit Scope, Objectives, and Methodology”
section of our audit report, activity subject to audit may extend beyond the audit period.
Regardless, we contend that deceased individuals should be promptly removed from
voter registration records upon identification especially if they have been deceased for
extended periods.

SBE further disagreed with our finding related to deceased voters and stated that the
current SBE match logic would identify deceased individuals who are contained on voter
records such as the example “John T. Smith and John Thomas Smith” noted in our
finding. However, SBE’s current procedures require exact match of first name, date of
death, and date of birth. These procedures would not produce a match result as the first
name field in the two data sets was formatted differently. Specifically, one data set
included first name and middle initial within the first name field while the other data set
has a separate middle name field. The current match does not use “fuzzy” match on the
first name field, so “John T.” will not match “John”.

SBE also indicated that our counts related to potentially deceased voters and duplicate
voters included errors. We provided summaries of all records included in our audit
finding to SBE personnel for review. Our audit staff worked extensively with SBE
personnel to ensure our analysis was accurate and the audit report reflects adjustments
made based on supporting documentation provided by SBE to OLA. If there are errors
remaining, of which we know of no specific example, it is directly due to inaccurate or
unreliable information provided us by SBE.

Recommendation 1a Agree Estimated Completion Date: ongoing

Please provide details of Agree. Additional SBE staff has been requested to facilitate a manual
corrective action or “fuzzy match” analysis on those records, as the workload exceeds
explain disagreement. current agency resources.

Page 5 of 13
 State Board of Elections
Agency Response Form

1. Death Records: SBE has implemented manual “fuzzy

matching” criteria to improve upon its already existing
“fuzzy matching” logic and comprehensive review
process. SBE created a monthly list of all deceased
residents who are not forwarded to LBEs for processing,
because they do not match a voter in MDVOTERS.
Additional SBE staff has been requested to facilitate a
manual “fuzzy match” analysis on those records, as the
workload exceeds current agency resources. The request
of a new position is dependent on the outcome of the
process to request and fund a new position. SBE has
initiated this process.
2. Duplicate Voters: SBE will continue to use the existing
“fuzzy matching” criteria, given the success of
identifying duplicate records. SBE will supplement the
existing list maintenance processes with a quarterly
review of the Potential Duplicate Voters
Report. Implementation of the new quarterly review will
commence in the 4th quarter of calendar year 2023.

Recommendation 1b Agree Estimated Completion Date: completed

Please provide details of SBE has changed the critical oversight process to ensure all identified
corrective action or exceptions are corrected. The data audit summary report will continue
explain disagreement. to be forwarded to the LBE Election Director and Deputy Director when
complete. SBE will make corrections during the review and note the
same in the summary report.

Page 6 of 13
 State Board of Elections
Agency Response Form

Election Oversight

Finding 2
Although testing did not identify material discrepancies in the voting results, we identified
opportunities to enhance the integrity of the automated vote tabulation process.

We recommend that SBE establish an independent supervisory review of its programming

and distribution of the electronic ballot database. We advised SBE on using existing
personnel to establish an independent supervisory review.

Agency Response
Analysis
Please provide We agree with the finding. In February 2023, we established an
additional comments as independent supervisory review of the programming and distribution of
deemed necessary. the ballot database. This review will be used in all future elections.

Recommendation 2 Agree Estimated Completion Date: 2/1/2023

Please provide details of Established the ElectionWare Database & Paper Ballot Verification
corrective action or Policy
explain disagreement.

Page 7 of 13
 State Board of Elections
Agency Response Form

Finding 3
SBE did not always timely refer potentially improper voter activity to the Office of the
State Prosecutor (OSP) for investigation.

We recommend that SBE, in conjunction with the OSP, establish guidance for timely
referral to the OSP of potentially improper voter activity.

Agency Response
Analysis
Please provide OLA states that “for the 2020 general election, SBE identified 134
additional comments as voters who successfully voted multiple times and 1,371 voters who
deemed necessary. attempted to vote multiple times.” This number of voters who attempted
to vote multiple times is not accurate. A scheduling error in
MDVOTERS assigned an additional voting credit to 28 Harford County
voters. These voters’ records have been corrected. The number of voters
who voted more than once is 106, not 134.

The totals for the 2022 elections are accurate. However, it should be
noted that the review is ongoing and supplemental information is being
reviewed and provided to OSP on a rolling basis.

Recommendation 3 Agree Estimated Completion Date: 12/31/2023

Please provide details of SBE agrees generally with this recommendation but notes that the
corrective action or review process depends on receiving the LBE’s analysis and
explain disagreement. documents. Given these limitations, SBE will keep OSP informed on
the estimated timeline for submitting this information.

Page 8 of 13
 State Board of Elections
Agency Response Form

Information Systems Security and Control

The Office of Legislative Audits (OLA) has determined that the Information Systems Security
and Control section, including findings 4 through 6 related to “cybersecurity”, as defined by the
State Finance and Procurement Article, Section 3.5-301(b) of the Annotated Code of Maryland,
and therefore are subject to redaction from the publicly available audit report in accordance with
the State Government Article 2-1224(i). Although the specifics of the following findings,
including the analysis, related recommendations, along with SBE’s responses, have been
redacted from this report copy, SBE’s responses indicated agreement with the findings and
related recommendations.

Finding 4
Redacted cybersecurity-related finding.

Agency Response has been redacted by OLA.

Finding 5
Redacted cybersecurity-related finding.

Agency Response has been redacted by OLA.

Finding 6
Redacted cybersecurity-related finding.

Agency Response has been redacted by OLA.

Page 9 of 13
 State Board of Elections
Agency Response Form

Payroll

Finding 7
SBE had not established adequate controls to ensure the propriety of payroll transactions,
including adjustments to employee leave balances.

We recommend that SBE

a. ensure that all employee time is properly recorded by employees and approved by
designated supervisors prior to payroll processing;
b. independently verify leave balance adjustments to ensure that only authorized
adjustments have been processed and take appropriate corrective action when errors
are noted, including those noted above; and
c. reconcile total payroll as reflected in CPB payroll registers each pay period with SPS
payroll summary reports, investigate any differences, and ensure that those
reconciliations are documented.

Agency Response
Analysis
Please provide OLA’s analysis includes unclear statements about their findings related
additional comments as to the 17 employees’ time entries tested as part of the audit. The
deemed necessary. statement “5 employees [] did not record all their time in SPS during 11
pay periods” could be read to mean that each of the five employees did
not record time entries in eleven pay periods (which would be incorrect)
or there were eleven pay periods when the five employees did not record
time entries (which would be correct). Similarly, the statement that
supervisors “did not approve the time recorded by 9 employees over 7
pay periods” could be read to mean that 9 employees’ time was not
approved for 7 pay periods (which would be incorrect) or there were 7
pay periods when 9 employees’ time was not approved (which would be
correct). In OLA’s analysis, it states that used leave hours were not
reduced from the employee’s leave balance. Once OLA identified this
issue, we corrected the employee’s leave balances.

Auditor’s Comment: SBE’s response claims that some statements in our analysis are
unclear. During the audit, we met with SBE to clarify the statements and it was our
understanding that they were understood by SBE at the time. Nevertheless, to again
clarify, we judgmentally selected time entries for 17 employees over 19 different pay
periods and determined that 5 employees did not record their time in 11 pay periods.
Additionally, the 224 leave hours used during the pay periods tested which were not
reduced from the leave balance related to 6 of the 9 employees that we identified as not
having supervisory review of the recorded time.

Page 10 of 13
 State Board of Elections
Agency Response Form

Recommendation 7a Agree Estimated Completion Date: Every 2

weeks
Please provide details of In September 2022, we implemented new timesheet
corrective action or procedures. Employees who have not submitted and supervisors who
explain disagreement. have not approved a timesheet by the end of the pay period are sent
email reminders. This procedure ensures that all timesheets are
submitted and approved by the end of the pay period.
Recommendation 7b Agree Estimated Completion Date: complete
Please provide details of The new leave adjustment procedure was implemented in November
corrective action or 2022. The procedure ensures that there is documentation of all leave
explain disagreement. adjustments. Leave adjustments are now handled by two individuals,
with one person entering into SPS the adjustment and the other person
verifying that the information is authorized and accurate.
Recommendation 7c Agree Estimated Completion Date: complete
Please provide details of In December 2022, we implemented a new reconciliation process for
corrective action or payroll. Each pay period, CPB’s payroll registers are reconciled with the
explain disagreement. SPS’s payroll summary reports ensuring there are no discrepancies. The
documents are uploaded to a Smartsheet and signed by the individual
who verified the information.

Page 11 of 13
 State Board of Elections
Agency Response Form

Board Meetings

Finding 8
SBE did not always post Board meeting agendas on its website at least 48 hours in advance
of the scheduled meeting start time as required by the State’s Open Meetings Act.

We recommend that SBE comply with the Open Meetings Act and publicly post all meeting
agendas on its website at least 48 hours in advance of the meeting starting time.

Agency Response
Analysis
Please provide SBE concurs with OLA’s analysis and would like to explain why the
additional comments as agenda for three meetings was not posted within 48 hours of the
deemed necessary. meeting.

 March 10, 2022 Meeting: The agenda was posted on SBE’s

website on March 9, 2022 at 11:11 am (26 hours before the
meeting). This meeting was a combined February and March
2022 meeting - the agenda was robust and there were many
documents to compile and distribute. This meeting was held
during a busy time, when SBE was in the midst of litigation
challenging the 2022 redistricting plans and revising election
calendars to reflect court-ordered changes to key election
deadlines.
 June 2, 2022 Meeting: The agenda was posted on SBE’s website
on May 31, 2022 (45.83 hours before the meeting). This meeting
was held the week of Memorial Day, and May 31 was the first
business day of the week. This meeting was also held during a
busy time with two court cases heard the prior week and the
webmaster was converting the certified ballots into other ballot
formats (e.g., formats for web delivery ballots, sample ballots for
the local boards).
 August 15, 2022 Meeting: Although this meeting was the
monthly meeting, the primary purpose of this meeting was for the
State Board of Elections to certify the results of the 2022 Primary
Election. This date was dependent on the local boards of
canvassers certifying the local results, including the re-scanning
of ballots in Frederick County, and the meeting was held in the
midst of receiving ballot questions, LBE requests for emergency
polling place changes, and internal discussions about a lawsuit to
allow for pre-election day counting of mail-in ballots. The
failure to post the agenda for this meeting was purely an

Page 12 of 13
 State Board of Elections
Agency Response Form

oversight. The Chairman approved the agenda on August 5,

2022, meeting materials were distributed to the members on
August 8, 2022, and speakers were added to the virtual meeting
invite on August 12, 2022. The agenda and materials were
distributed in a timely manner, but the posting of the same was
not done.
Recommendation Agree Estimated Completion Date: monthly
Please provide details of SBE agrees with the recommendation.
corrective action or
explain disagreement.

Page 13 of 13