Risk-limiting audit: statistical evidence that the winner is right

A risk-limiting audit (RLA) is a post-election check that examines randomly selected voter-verifiable paper records until there is strong statistical evidence that the reported winner is correct. Lindeman and Stark describe it as “a method to ensure that at the end of the canvass, the hardware, software, and procedures used to tally votes found the real winners.” If the evidence is not strong enough, the audit examines more ballots, up to a full hand count.

Definition

Lindeman and Stark’s 2012 introduction is the standard plain-language source. RLAs “do not guarantee that the electoral outcome is right, but they have a large chance of correcting the outcome if it is wrong”.⁠¹ They work by “manually examining portions of an audit trail of (generally paper) records that voters had the opportunity to verify”.⁠¹

The risk limit is “the largest chance that the audit will stop short of a full hand tally when the original outcome is in fact wrong, no matter why it is wrong,” including errors, bugs, equipment failures, or fraud.⁠¹ It is not the chance the outcome is wrong. If the risk limit is 10% and the outcome is wrong, “there is at most a 10% chance (and typically much less) that the audit will not correct the outcome”.⁠¹ A correct outcome is never changed, because an RLA changes an outcome only through a full hand count that disagrees with it.⁠¹

Origin and history

RLAs come from statistical research on post-election audits; Lindeman and Stark’s 2012 paper builds on Stark’s papers from 2008 onward. It notes that Stark “designed and conducted the first risk-limiting post election audits” and worked with the California and Colorado Secretaries of State on pilots.⁠¹ The National Academies recommended in 2018 that states require an RLA “prior to the certification of election results”.⁠² The National Conference of State Legislatures (NCSL) reports that 7 states require risk-limiting audits, compared with 36 plus the District of Columbia requiring traditional audits,⁠³ and lists Colorado’s first RLA as using a 9% risk limit.⁠⁴

How a risk-limiting audit works

An RLA needs three things before it starts:⁠¹

• A trustworthy audit trail. “The best audit trail is voter-marked paper ballots.” Paperless systems cannot be audited this way.
• A ballot manifest describing exactly how ballots are stored, so a random sample can be drawn and checked against the totals.
• Evidence the records are intact. Without a compliance check showing no ballots were altered, added, or lost, “a risk-limiting audit may be mere theater.”

There are two main kinds:⁠¹

• Ballot-polling audits “examine a random sample of ballots” and need only the reported winner and vote shares. They usually examine more ballots.
• Comparison audits “check outcomes by comparing hand counts to voting system counts for clusters of ballots,” down to single ballots. They examine fewer ballots but need the voting system’s interpretation of each ballot or batch.

Sample size depends on the margin and the risk limit. Smaller margins and smaller risk limits require more ballots.⁠¹ NCSL describes RLAs as “an incremental audit system”: a wide margin needs few ballots, a narrow one more, “up to a full recount”.⁠⁴

Common confusions and neighboring terms

• RLA vs. recount. A recount counts every ballot; an RLA stops when evidence is sufficient.
• RLA vs. fixed-percentage audit. A fixed-percentage audit checks a set share of precincts regardless of margin and gives no stated statistical confidence about the outcome.
• RLA vs. verification of individual ballots. An RLA tests the outcome, not each voter’s ballot.
• RLA vs. end-to-end verifiable voting. E2E systems use cryptography rather than paper sampling to provide public evidence. VVSG 2.0 accepts either path to software independence.

How My Vote Forward uses the term

My Vote Forward uses the RLA as the leading example of evidence that does not depend on trusting software or operators. Its Audits and verification chapter explains how voter-verified records, custody, and RLAs work together while keeping each ballot secret. The framework does not conduct RLAs and does not claim its demo is auditable in this sense.

Unresolved questions

• How should RLAs handle many small local contests on one ballot, where each may need its own sample?
• How should the public be told what an RLA showed, without implying a guarantee it does not give?
• What is the right risk limit, and who should set it?