Contents

Ballot Level AuditEdit

Ballot Level Audit is an auditing approach focused on tying the official election tally to the actual ballots cast, using the data attached to each ballot to verify that the reported outcome is correct. In practice, this method examines ballots at the most granular level possible (the ballot level) and compares the marks on each ballot to its corresponding electronic record. When done well, it provides strong, evidence-based assurances about the integrity of an election without requiring widespread hand recounts in every race. This fits a practical view of election administration that values verifiable results, transparent procedures, and the efficient use of taxpayer resources.

From a governance and policy perspective, Ballot Level Audit sits within a broader family of verifiable election processes that seek to bridge the gap between the paper trail voters see and the digital tallies that are often stored and transmitted during vote counting. Proponents argue that, where there is a robust paper ballot system and reliable data tied to those ballots, these audits deliver credible proof that the outcome reflects the will of the voters while preserving the secrecy and integrity of individual ballots. For jurisdictions that emphasize accountability and measurable standards, Ballot Level Audit offers a clear framework for validating results through math-backed procedures and documented steps. See risk-limiting audit and cast vote record for related concepts and terminology.

Ballot Level Audit

Overview

A Ballot Level Audit (BLA) is typically implemented as a form of a risk-limiting audit that focuses on individual ballots rather than aggregates. In a ballot-level comparison audit, a sample of ballots is selected and each sampled ballot is compared to its corresponding cast vote record to check for agreement. The idea is to bound the probability that an incorrect outcome would go undetected; if discrepancies rise beyond a pre-specified threshold, the audit requires additional ballots to be checked or, in the last resort, a full hand count. Another family, known as ballot-level audits that rely on ballot polling, uses random sampling of ballots without CVR comparison to estimate the margin, but is generally considered less precise than a formal ballot-level comparison audit when CVRs exist. In either case, maintaining a secure chain of custody, accurate CVRs, and clear privacy protections is essential.

Methods

Ballot-level comparison audits (BLCA) work by sampling ballots, matching them to their cast vote record entries, and evaluating the discrepancies. If the observed discrepancy rate is low enough, the risk that the outcome is wrong is reduced to an acceptable level. Results depend on the underlying voting system, the reliability of the CVRs, and the discipline of the sampling plan, which is designed to meet a predetermined risk limit.
Ballot-level audits that rely on ballot polling use random hand counts of ballots to estimate the margin, rather than checking each ballot against a CVR. This method can be appropriate where CVRs are incomplete or not available, but it does not produce the same direct, ballot-by-ballot verification.

Advantages

Strong, math-based confidence: BLAs provide explicit, quantified assurances that the reported results are correct, given the observed data.
Ballot-level granularity: Because the audit can target individual ballots, miscounts or misreads can be identified with precision, allowing authorities to correct errors without rechecking entire batches.
Transparency and accountability: The process is documented, auditable, and can be repeated or reviewed independently, which helps build public trust.
Efficiency in many cases: Compared to full hand recounts, BLAs can achieve a comparable level of confidence with far fewer ballots examined, depending on the margin and the risk limit.

Limitations

Dependence on reliable CVRs: The strength of a BLCA hinges on accurate, tamper-evident cast vote records and a robust linkage between ballots and their CVRs.
Privacy safeguards: While results must protect voter anonymity, the linkage between ballots and records must avoid exposing individual voters or enabling reconstruction of voting behavior.
Resource requirements: Implementing BLAs requires trained staff, secure data handling, and sometimes additional hardware or software, which can entail upfront costs.
Complexity and standardization: Different jurisdictions use different ballot formats, data standards, and audit procedures, which can complicate cross-jurisdiction comparisons.

Implementation and Policy Considerations

Legal and regulatory framework: For BLAs to function as intended, statutes or regulations should define the audit method, the risk limit, and the role of independent observers or auditors, along with requirements for CVR availability and integrity.
Paper trails and data integrity: A robust paper ballot system, paired with accurate CVRs and verifiable ballot manifests, is central to credibility. Clear procedures for how ballots are stored, tracked, and reconciled matter.
Privacy and ethics: Policies should ensure that ballot-level data are used in a way that preserves voter privacy while enabling accountability.
Training and independence: Auditors need appropriate training, and the process should be insulated from political pressure to preserve legitimacy.
Budget and timeline: Stakeholders weigh the cost of implementation against the benefits of stronger assurances, and schedules must align with certification deadlines and post-election timelines.

Controversies and Debates

Security and reliability concerns: Critics argue that any reliance on CVRs introduces risk if the data are inaccurate or manipulated, or if systems handling the CVRs are vulnerable to compromise. Proponents counter that well-designed BLAs include safeguards, independent verification steps, and a transparent process that makes tampering harder to conceal.
Trade-offs with other audit types: Some critics advocate for simpler ballot polling audits or traditional audits, arguing that BLAs add complexity and cost without always delivering proportionate benefits. Supporters contend that BLAs offer the strongest possible evidence of correctness when a paper trail exists, and they can be tailored to balance risk, cost, and speed.
Economic and administrative feasibility: The transition to BLAs can require investment in data infrastructure, training, and process changes. From a policy standpoint, advocates emphasize that upfront costs are offset by long-term gains in public confidence and reduced risk of disputed outcomes.
Privacy vs transparency tension: While BLAs can improve transparency, there are legitimate concerns about linking ballots to records in ways that could, in extreme cases, raise privacy issues. Proper design and safeguards are essential to address these concerns without compromising audit integrity.
Political framing and public perception: In heated political climates, discussions about audits can become polarized. A practical stance emphasizes measurable, outcome-driven standards and the objective, auditable nature of the methodology, while acknowledging legitimate questions about scope, cost, and implementation.

Historical Development

The concept of risk-limiting audits, which underpins Ballot Level Audit, was developed to provide a mathematically grounded way to bound the chances of certifying an incorrect outcome. Prominent work in this area was led by researchers such as Philip B. Stark, who helped formalize the approach and its practical implementations. Over time, many jurisdictions have explored or adopted ballot-level methods as part of efforts to improve election verifiability and public confidence. The dialogue around BLAs now sits alongside related ideas like end-to-end verifiable voting and broader debates about how best to ensure secure, reliable, and transparent elections.