U. S. ELECTION ASSISTANCE COMMISSION 

 OFFICE OF THE EXECUTIVE DIRECTOR

 1225 New York Avenue, NW, Suite 1100 

 Washington, DC. 20005

November 3, 2008 

Mr. Randolph C. Hite, Director 

Information Technology Architecture and Systems 

United States Government Accountability Office 

This letter is intended to serve as the required written response to the Government Accountability 

Office’s (GAO) Report 08-770 Federal Programs for Accrediting Laboratories That Test Voting 

Systems Need to Be Better Defined and Implemented. As required by 31 U.S.C. 720 I am 

submitting the attached document, on behalf of the Commission, as a written statement of the 

actions taken on GAO’s recommendations. The EAC appreciates GAO’s recommendations and 

takes very seriously its HAVA mandated responsibility for the accreditation of laboratories to be 

used for the testing of voting systems under the EAC’s Voting System Testing and Certification 

Program. 

If you should have any questions about the steps the EAC is taking to implement GAO’s 

recommendations or any aspect of the EAC’s Laboratory Accreditation Program, please do not 

hesitate to contact me at any time. We appreciate the chance to respond and look forward to 

talking further about the work of the EAC’s Laboratory Accreditation Program. Thank you. 

Sincerely, 

Thomas R. Wilkey 
EAC Response to Findings Reported in GAO-08-770 

Accreditation of Voting System Testing Laboratories 

Pursuant to 31 U.S.C. 720, the purpose of this letter is to provide an update on U.S. 

Election Assistance Commission (EAC) efforts to implement Government Accountability 

Office (GAO) recommendations in its report regarding Federal voting system laboratory 

accreditation programs (GAO-08-770). 

As the GAO report notes, EAC has properly “published procedures governing how the 

accreditation program is to be executed, such as procedures for granting, maintaining, 

modifying, suspending, and withdrawing accreditation.” (GAO-08-770, pg 27 – 28). 

Generally, EAC has provided clear procedures, in the form of its recently published 

Voting System Test Laboratory Manual (Manual), that outline the certification process 

and its requirements for participating manufacturers. The areas that GAO has identified 

for improvement generally focus upon the need to formally document EAC’s internal 

procedures. This requires creating written steps to guide EAC employees in performing 

their accreditation efforts. (GAO-08-770, pg 35). Having a formalized internal 

procedure will help ensure that EAC’s accreditation activities remain consistent, improve 

documentation and increase transparency. The EAC fully supports these goals and 

agrees with GAO’s recommendations. 

GAO generally recommended that EAC establish and implement internal procedures for 

the EAC’s Voting System Test Laboratory Program (VSTL Program) consistent with 

NIST and GAO guidance. In making this recommendation GAO notes four areas for 

improvement by the EAC; (1) Documentation of specific accreditation steps and criteria 

to guide assessors in conducting each laboratory review; (2) transparent requirements for 

the qualifications of accreditation reviewers; (3) requirements for the adequate 

maintenance of records related to the VSTL accreditation program; and (4) requirements 

for determining laboratory financial stability. 

Documentation of specific accreditation steps and criteria to guide assessors in 

conducting each laboratory review.

In its report GAO recognizes that for all voting system test laboratory reviews conducted 

thus far, the EAC utilized a checklist for the review of submitted documents for 

accreditation. However, the GAO report goes on to add that the EAC’s checklist for 

accreditation review lacks the requisite steps and criteria for a reviewer to consistently 

review each laboratory. In response to this recommendation the EAC has begun creating 

comprehensive and detailed review procedures for its VSTL program. This includes the 

development of more comprehensive and detailed check lists that contain improved 

objective review criteria. The EAC’s Testing and Certification Program staff will 

coordinate these efforts with EAC contractors, recently employed to improve EAC 

procedures agency wide. The EAC expects to have a draft completed by July 2009. 
Transparent requirements for the qualifications of accreditation reviewers. 

As noted in the GAO report (GAO-08-770, pg. 35) the EAC’s review of voting system 

laboratories is not technical in nature. Per the Help America Vote Act it is NIST who is 

primarily responsible for the technical assessment of laboratories. The GAO report notes, 

“NIST is to focus on assessing laboratory technical qualifications, while the EAC is to 

use those assessment results and recommendations, and augment them with its own 

review of related laboratory capabilities.” (GAO-08-770, pg 10). EAC conducts an 

administrative review of the applicant laboratory. 

EAC’s administrative review includes collecting: (1) laboratory information required by 

Section 3.4.1 of EAC Voting System Test Laboratory Program Manual (Accreditation 

Manual), (2) a signed agreement affirming that the laboratory will meet all elements of 

the EAC Accreditation Program (Chapter 2 of the Accreditation Manual), and (3) a 

Certification of Laboratory Conditions and Practices (Attachment A of the Accreditation 

Manual) documenting that the laboratory has certain conditions and required policies in 

place (specifically: a conflict of interest policy, a personnel policy, a recordkeeping 

policy and evidence of sufficient resources and financial stability). Thus, EAC review is 

limited to (1) determining whether required information and the signed agreement and 

certification were, in fact, provided and (2) determining whether the certifications of the 

laboratory (concerning its conflict of interest policy, personnel policy, recordkeeping 

policy and resources and financial stability) are acceptable by comparing the policies 

provided with the EAC program requirements. 

Given the administrative nature of the EAC’s accreditation review, any qualifications for 

EAC reviewers would be limited. The primary requirement necessary to conduct an EAC 

accreditation review is a full understanding of EAC program requirements. This 

understanding can be achieved through training on the EAC’s program manual and 

experience. This knowledge base in conjunction with a detailed checklist will serve to 

improve the review process. The issue of the qualification of these reviewers will be 

addressed in the internal procedures document mentioned above. 

Requirements for adequate maintenance of records related to the VSTL 

accreditation program

Consistent with this recommendation and GAO’s report the EAC added the following 

section to its VSTL program manual: 

The EAC shall retain all records associated with the accreditation of 

voting system test laboratories. The records shall otherwise be retained or 

disposed of consistent with Federal statutes and regulations (VSTL 

manual, sec. 1.11) 

GAO recommended the addition of this language which is consistent with the record 

retention requirements in the EAC’s Voting System Testing and Certification Program 

2
Manual. In addition, the EAC will provide detailed procedures and schedules for the 

maintenance, storage, and archiving of this information in its internal procedures as noted 

above. 

Requirements for determining laboratory financial stability

The GAO Report specifies five program features (or areas of required information) an 

accreditation program should include. As the GAO report notes, EAC’s Accreditation 

Program Manual contains requirements for each of these features, including: 

organizational information, records and record keeping, test methods and procedures, 

conflict of interest policy and assurance of financial stability. However, for the last 

requirement, GAO recommended that the EAC provide additional criteria for review and 

obtain additional laboratory information. 

 

Per GAO’s recommendation, EAC’s VSTL Program Manual now includes additional 

requirements/criteria for the documentation of financial stability and the collection of 

additional information. The section on financial stability requirements now states: 

2.14. Resources and Financial Stability. As a condition of accreditation, 

all VSTLs shall allocate sufficient resources to enable the laboratory to 

properly use and maintain its test equipment, personnel, and facility and 

to satisfactorily perform all required laboratory functions. The laboratory 

shall maintain insurance policies sufficient to indemnify itself against 

financial liabilities or penalties that may result from its operations. VSTLs 

shall: 

2.14.1. Maintain insurance policies (see Section 3.4.1.8.) that 

indemnify the laboratory against the potential losses identified in 

its liability assessment (see Section 3.4.1.9.); and 

2.14.2. Document solvency through demonstrating that the 

laboratory’s assets are greater than its liabilities in its audited 

financial statement (see Section 3.4.1.16.). 

The Manual’s new information collection requirements include: 

3.4.1.8. The identity of the laboratory’s insurer(s), name of insured, and 

coverage limits for any comprehensive general liability policies, errors 

and omissions policies, professional liability policies, and bailee policies. 

3.4.1.9. A written assessment of the laboratory’s commercial general 

liability. 

3.4.1.16. A copy of the most recent annual report, the names of the current 

board of directors and the previous year’s board of directors, the names 

of any majority shareholders, and audited financial statements of the 

3
companies or entities that own and operate the laboratory. Laboratories 

not incorporated should provide comparable information 

The addition of these new provisions provide clear criteria for the evaluation of financial 

stability and require VSTL’s to submit additional information for the assessment of their 

financial stability. The EAC will provide additional internal procedures for the 

implementation of these requirements in its internal procedures noted above. 

EAC has already begun implementing changes consistent with the recommendations of 

GAO. In fact, EAC amended its VSTL Program Manual to address two of the four 

recommendations prior to the release of the GAO report. The EAC is in the process of 

addressing the remaining issues through the creation of additional internal procedures. 

The EAC has found GAO’s report to be informative and helpful in the continued 

development of its Voting System Test Laboratory Program. The EAC is committed to 

continuous improvement in all of it programs. The EAC is focused on making its 

accreditation process part of a world class testing and certification program. 

4