I have a long-ish and nerdy thread of thoughts I need to get off my chest. I would recommend reading it with an open mind regardless of where you fall on the current debate over fraud in this election. Let's get into it. 1/

My professional background is in financial statement auditing. There are a LOT of parallels between auditing a company and certifying election results. When you audit a company you establish materiality and risk levels. The more complex a 2/

company the lower the materiality and risk thresholds are set. If you have a private equity firm with a complicated organizational structure, you are going to lower the thresholds of acceptable risk. One of those forms of risk is control risk, or the risk 3/

that internal controls set up to prevent fraud are inadequate. In that scenario, you are going to perform more testing of the controls than an average audit in order to attain a high enough degree of assurance in their operational integrity. It's impossible 4/

to test every single transaction at a company. So auditors establish these thresholds in order to give themselves a high enough degree of trust that everything that relies on them is accurate. Easy example: a company could have 1,000 different inventory SKUs 5/

and you want to know if the company is recording them at cost and not fudging it. If you have a high degree of faith in the company's internal controls around inventory, you can test fewer inventory items to gain a required assurance level that inventory is accurately 6/

stated. So you might test 25 items, all 25 were perfect and then you go, "well, our random sample was perfect and we trust the controls, so we can assume the other 975 are reasonably accurate as well." When you begin an audit, you first document all controls around 7/

key operations, one being inventory in this example. If, in testing those controls, however, you discover a missing control, a control failing to work as stated or failing to work at all, you can no longer test just 25 inventory items and have the same degree of 8/

assurance as you had in the previous example. Now, to gain the same level of assurance, you may have to test 200 items. What does this have to do with the election, you ask? Well, election security is essentially internal controls in an election. 9/

The found memory cards with uncounted ballots in GA is what we call in the audit profession, a material control weakness. It's material, not because of the number of ballots on the memory card but because of its implication on the entire control environment 10/

To have confidence that a system is fully accurate and legitimate requires faith in the controls and in this instance, TWO controls failed: 1) the control in place to ensure all ballots are counted and 2) the control in place to ensure any uncounted ballots 11/

are caught and rectified before election certification. These were found because of a recount, not by the system itself. This is akin to an audit team finding mistakes and the company claiming "well, the control in place was the audit team!" --that's not how it works, folks. 12/

The failure of system controls to count all ballots in even ONE instance is an identification of a system vulnerability that forces the auditors to TEST MORE THINGS to feel confident they are attesting to accurate financial statements. How can anyone 13/

hear that a recount uncovered thousands of uncounted ballots and simply move on? The presence of a control weakness that produced an error is that one must now test more. The GA memory card thing should, and would in the audit world, spark a NATIONWIDE audit 14/

As it stands right this moment, no auditor in the world would certify the election (or the company's financial statements) because you identified a way in which the system can (and was) insufficient. Now you must find out the scope of that failure everywhere else. Fin. 15/15