I agree there should be zero duplicates in the main production database. That appears not to have been the case hence why KPMG even found them. When they are initially gathering the registration information, you can have scenarios where duplicates find their way in, some legitimately, others not so legitimately.
When these data are eventually loaded onto the main server, they should have, by now - almost half a decade later(this is something they have just found out about) - a separate table at a minimum that contains duplicated information. They would publicize this information and give the affected a window in which they can make corrections or clarifications after which the rest are thrown away. Obviously they don't have any of this in place.
The KMG report actually sheds some light on what happened, and it has nothing to do with millions of voters, tens of thousands of registration places, "synchronization" in Nairobi, etc. This says it all:
KPMG understands that the Commission has requested a change from the BVR vendor to introduce a feature to restrict a new registration having an ID or passport number that already exists in the RoV [Register of Voters]
Why it required KPMG to suggest something so obvious is not clear.
It also turns out that the duplicates that have excited so many are phantoms that exist only because of the IEBC's incompetence. After a full analysis of 197,677+ nominal duplicates---the county-figures being bandied about---KPMG found only 123 real duplicates. (At least that is my understanding of the report.)
What should worry those concerned about rigging and other fiddling: KMPG asked for permission to carry out "Penetration Testing and Vulnerability Assessment". IEBC refused, with bogus explanations on "acquiring new ICT for these elections" etc. Go read it and see how much a half-awake person would buy.
We wrote formally to the Commission on several occasions to explain the implications of this limitation of scope on the integrity of data in the system, and therefore the credibility of the register. The IEBC indicated that it would reconsider its decision and communicate to us accordingly. At the time of preparing the report, the authorisation for these tests has not been provided.
Further down, on a slightly different but related matter---hopeless control over BVRs--KPMG states that:
A risk persists that changes made to the Register of Voters at the database level could go undetected.
And so on, and so forth.
One implication of what the report has to say is this: If the register has been altered since KPMG got a copy to examine, nobody, except the perps, will know for sure. Indeed, as KPMG notes, the risks have to to do with both external and
internal mischief-makers.
Oh, the report also has all sorts of helpful recommendations:
[KMPG recommends that] the IEBC asserts its independence and discharges its mandate in accordance with the Constitution.
One wonders what the IEBC has been doing so far.
I'm still going through the report, but one thing seems clear so far (and Omollo could well be right on this one): IEBC is a bigger, incompetent (deliberately or otherwise) mess than most people seem to realize.
So, yes, it may be said that the accountants have done a good job in pointing out certain things.