Elections: Federal Programs for Accrediting Laboratories That Test Voting Systems Need to Be Better Defined and Implemented

NIST has established and implemented requirements for the technical qualifications and training of accreditation Lead and Technical Assessors. Standardized selection criteria for the positions of Lead Assessor and Technical Assessor are captured in worksheets for each of the two positions. Each worksheet identifies qualification factors (such as education, work experience, and past assessment criteria), minimum requirements for each factor, how each factor was evaluated (e.g. documentation, interview, peer reference, etc.), and whether the support provided for each factor was acceptable. Each type of worksheet also allows for program-specific criteria. For example, the VSTL Technical Assessor criteria requires 4 years of testing voting systems, including at least 2 years of testing to Election Assistance Commission-approved standards and guidelines. With respect to assessor training, NIST has established standardized training requirements and documented these in an Assessor Training Checklist. This checklist specifies training topics, associated training resources, which positions are required to receive the training, and the method of training delivery. The checklist also supports implementation of the training requirements by a mandatory record of the date training was completed, and certification by the program manager on completion of training. In September 2009, NIST held accreditation assessor training on VSTL-related materials and completed a documented checklist for each of the two individuals acting as assessors for the program.

NIST is now using a standardized checklist to ensure that its laboratory accreditation reviews are fully and consistently documented. The NIST Handbook 150-22 checklist for its VTSL accreditation review program is to be used in conjunction with any review of the general accreditation criteria prescribed in the NIST Handbook 150-22, NVLAP Voting System Testing. The checklist provides a structured method for evaluating criteria found in the pertinent sections of Handbook 150-22. The 2007 version of this checklist was used in the re-assessment of one previously accredited laboratory in 2007 and two previously accredited laboratories 2008. A 2008 version of the checklist was used in 2009 to re-assess a fourth laboratory, also previously accredited. The laboratory assessed in 2007 no longer participates in the VSTL program. According to the VSTL program manager, the two laboratories assessed in 2008 are to be assessed again by the end of 2010. The laboratory assessed in 2009 is due for re-assessment during fiscal year 2011.

EAC has taken several steps to implement practices consistent with accreditation program management guidance. First, EAC has developed a standardized checklist that is used in the biannual policy and procedures review of accredited laboratories. The checklist provides for detailed steps and criteria to be used in conducting an accreditation review, and it has thus far been used in the review of two laboratories, and according to the EAC Director of Voting System Testing and Certification, the checklist will be used in two other laboratory reviews that are scheduled for late 2011. Second, EAC has identified formal training requirements for its laboratory accreditation personnel, and it plans to send two key accreditation review personnel to this training in October 2010 and two other accreditation staff members to the same training in the spring of 2011. According to the testing and certification director, new accreditation staff will also be required to attend the training in an effort to ensure that the qualification of all accreditation reviewers. Third, the EAC Voting System Test Laboratory Accreditation Program Manual now specifies EAC laboratory retention requirements for records associated with the accreditation activities. According to the manual, the EAC is to retain all accreditation-related records and laboratories are to retain accreditation records related to the testing of a voting system for a minimum of five years. Laboratory compliance with these record-retention requirements is assessed through the EAC's assessment checklist. Finally, the EAC's accreditation program manual now includes requirements for a laboratory to demonstrate financial stability by producing an audited financial statement showing assets that are greater than liabilities.