ODOT Motor Voter Program Audit

Summary

Prompted by an inquiry from an outside entity, the Oregon Driver & Motor Vehicle Services (DMV) Division of the Oregon Department of Transportation (ODOT) conducted a review of customer data that went to the Oregon Secretary of State (SoS) Elections Division for registration as part of Oregon Motor Voter Program. DMV’s review of roughly 1.4 million records to date found clerical, technical and policy errors that resulted in more than 1,500 records sent in error to SoS. ODOT is an Executive Branch agency that falls under the authority of the Oregon Governor. The Secretary of State is an independent, constitutional office, which is responsible for overseeing Oregon elections.

On Oct. 7, 2024, Governor Kotek and Secretary of State LaVonne Griffin-Valade jointly called for an independent, external audit of the Oregon Motor Voter Program. They directed the Oregon Department of Administrative Services (DAS) to immediately identify an independent, external third-party vendor to conduct the audit, specifying that the scope of the audit would be determined by the vendor.

On Nov. 7, 2024, DAS executed a contract with an independent, external third-party vendor to conduct the audit of the Oregon Motor Voter Program in compliance with auditing standards. The Baker Tilly Advisory Group operates nation-wide and has a demonstrated history of work in states of all backgrounds, and experience with voter registration systems. Baker Tilly is also up to date on GAGAS (Generally Accepted Government Auditing Standards) external review, which confirms an audit firm is operating in compliance with auditing standards. Baker Tilly received a 'Pass,' which is the highest rating a firm can receive, in their most recent review.

On Nov. 14, 2024, the audit was initiated to conduct an independent, external audit of the Oregon Motor Voter program.

The audit of the Oregon Motor Voter program concluded that processes and internal controls have been established around areas of previously identified errors and are generally effective, although some control gaps and exceptions were noted. Controls are in place to ensure the accuracy of voter registration data; however, one unsupported issuance transaction was identified during audit testing. There is a reliance on legacy citizenship records, resulting in potentially inaccurate or unsupported citizenship designations made prior to the strengthened control environment to persist, potentially leading to inaccurate data being transmitted by the program. The vendor found that the systems and technologies supporting the program are appropriately configured, leverage automation effectively and are adequately secured to protect voter registration data, with opportunities to improve user access management and oversight.

During the audit, key strengths were noted that reflect a commitment to improvement and a proactive approach to program oversight. Program staff consistently exhibit a culture of continuous improvement, often identifying and addressing potential control gaps independently and ahead of audit inquiries. Additionally, the program shows strong legislative awareness, with teams actively monitoring and preparing for changes in state legislation that could impact the Oregon Motor Voter program. Collectively, these strengths underscore the program’s commitment to accountability, transparency and ongoing service enhancement.

FAQs About the Motor Voter Program Audit

An audit is an objective examination of evidence for the purpose of providing an independent assessment and is performed in accordance with audit standards. Audit standards are the conceptual framework that organizes authoritative guidance promulgated by trustworthy, guidance-setting bodies.

The Oregon Motor Voter Program audit will be conducted in accordance with the Generally Accepted Governmental Auditing Standards from the Government Accountability Office (GAO) and will provide objective analysis, findings and conclusions. These findings and conclusions serve to help improve performance and operations, facilitate decision-making by parties with responsibility to oversee or initiate corrective action, and contribute to public accountability.

The Oregon Motor Voter Act is a law that took effect in January 2016. The Oregon Secretary of State has information about the Oregon Motor Voter Act, including a process manual and frequently asked questions.

The audit is focused on the Oregon Motor Voter Program because the errors identified at Oregon Driver & Motor Vehicle Services (DMV) were all related to this program. It is standard auditing procedure to focus audit work based on identified risks. A focus area promotes the audit team’s ability to ensure quality and relevance, as well as to complete the audit in an efficient and timely manner.

The Department of Administrative Services Office of Internal Audit is responsible for the following:

Procurement of the independent, external third-party vendor to conduct the audit of the Oregon Motor Voter Program.
Contract management to ensure the audit process is completed efficiently and deliverables are sufficient.

The Oregon Driver & Motor Vehicle Services (DMV) Division of ODOT is responsible for the intake of information for the Oregon Motor Voter (OMV) program, including validating customer-provided proof of citizenship and securely transmitting data to the Secretary of State’s Elections Division. The DMV is considered an auditee in this audit, meaning that the organization is subject to the audit. As an auditee, the DMV is responsible for cooperating with the auditors and providing them will all requested information, as well responding to audit recommendations..

The Oregon Secretary of State Elections Division is responsible for certain aspects of the Oregon Motor Voter (OMV) program, including setting rules, providing information on the OMV process to the Driver & Motor Vehicle Services (DMV) Division, processing individuals listed in DMV files, and issuing Oregon Motor Voter cards, among other tasks. The Oregon Secretary of State Elections Division is considered an auditee in this audit, meaning that the organization is subject to the audit. As an auditee, the Oregon Secretary of State Elections Division is responsible for cooperating with the auditors and providing them will all requested information, as well as responding to audit recommendations.

Baker Tilly Advisory Group was selected as the vendor.

The Department of Administrative Services used an official Statewide Price Agreement (Price Agreement) for audit services in compliance with Oregon procurement law. The Department of Administrative Services made the decision as to which procurement method to use by considering the procurement options in the required order. We then identified Baker Tilly Advisory Group as the one vendor included in the Price Agreement that offered all of the services required for this audit. They were vetted as a qualified vendor for performance and information technology (IT) audit services during the establishment of the Price Agreement. We subsequently executed a Service Order Contract (SOC) with Baker Tilly Advisory Group on Nov. 7, 2024.

The Baker Tilly Advisory Group has extensive experience and knowledge of the public sector. The auditors selected for this engagement are professionally certified, including the Certified Internal Auditor (CIA) designation, and abide by ethical expectations imbedded within auditing standards. The project team includes a subject matter expert who has specialized experience with voter registration systems. You can learn more by visiting the Baker Tilly Advisory Group website.

A Statewide Price Agreement (Price Agreement) is a master agreement for the procurement of products or services at agreed upon terms for use by all state entities. It comprises a group of common items or services competitively bid to set the prices contractually for a specified time period. A supplier awarded a Price Agreement contract is obligated to provide the specified products or services, at or below the contracted price and terms, to all agencies using the contract.

Using a Statewide Price Agreement (Price Agreement) is the most efficient acquisition method. Price Agreements benefit agencies by obtaining price discounts and leveraging the ability to compromise through volume purchases. Procuring through a price agreement is faster to complete and more efficient to manage. More information on Price Agreements can be found on the Oregon Procurement Manual website.

The contract cost is not to exceed $175,000. As of June 25, 2025, we have spent $148,271.96. As is standard contract procedure, this amount may change depending on whether there are any necessary amendments.

Per the contract, the vendor proposed the scope of the audit based on audit objectives, criteria, risk assessment and control frameworks. The scope was approved by the DAS Director.

An audit risk assessment happens at the beginning of the audit process and is the identification of risks and analysis of their likelihood and potential impact on the achievement of business objectives. The risk assessment will be used by the independent, external third-party vendor to determine the audit objectives, scope, criteria and procedures.

This audit was conducted in accordance with the Generally Accepted Government Auditing Standards (GAGAS), commonly referred to as the Yellow Book, and the Institute of Internal Auditors’ (IIA) International Standards for the Professional Practice of Internal Auditing. The vendor also used relevant control frameworks, including the COSO Internal Control Framework and the National Institute of Standards and Technology Special Publication 800-53 (NIST 800-53). These frameworks provide comprehensive guidance for evaluating internal controls, information security, and risk management practices.

The audit was further guided by applicable Oregon statutes and criteria:

ORS 247, Governing automatic voter registration procedures.
ORS 807, Outlining DMV responsibilities related to voter registration.
House Bill 2177 (2015), the legislative basis for Oregon’s automatic voter registration program, which mandates that DMV collect and transmit voter registration data to the SOS.
Oregon Administrative Rule No. 165-005-0170 (OMV Manual)
Internal policies and procedures established by ODOT and the SOS, including inter-agency agreements, system protocols, and training requirements.

The duration of an audit depends on its scope and objectives. Audits with several or broadly described objectives and a large scope could take more than a year to complete, while a tightly scoped audit can be completed in a matter of weeks. The timeline of a typical audit of this magnitude is estimated to be five to six months. If determined to be appropriate by the vendor, emerging issues and preliminary findings will be communicated to agency leadership in real time if it will assist in implementing corrective actions.

If you have questions about this audit, please contact Eli Ritchie, Department of Administrative Services Chief Audit Executive and Statewide Internal Audit Coordinator at eli.ritchie@das.oregon.gov.