Introduction to Risk-Limiting Audits

Overview

Post-election tabulation audits help confirm that the reported election outcome is accurate by checking that the ballots were interpreted correctly by the electronic voting system. As with any electronic equipment, voting technology can experience unseen and sensitive errors, so post-election audits are necessary to check that any output is true and all equipment functioned as intended. Additionally, audits help increase trustworthiness and voter confidence in the election results by providing a metric of correctness and reassurance that every ballot was counted as cast. An emerging type of post-election tabulation audits are risk-limiting audits.

A risk-limiting audit (RLA) is a statistical post-election audit that hand counts a random sample of paper ballots to verify the reported election results. Its goal is to determine if the machine outcome accurately reflects voters’ intent without checking every ballot cast in the election. RLAs are considered the golden standard in auditing because they are both accurate, efficient, and have outcomes that are reproducible. At the most basic level, they require the election results you are auditing, an accounting of all the ballots cast in the election—known as the ballot manifest, and the physical ballots cast in the election; meaning, they require minimal hardware extraneous to the election process. In a worst case scenario, the RLA calls for the auditors to hand recount all the ballots cast in the election; a procedure that would be necessary to obtain the true outcome of the election anyways. When the machine outcome is correct, the RLA will likely conclude so by examining only a small number of ballots. All aspects of the audit can be publicly observed to promote confidence in the audit outcome, and, accordingly, the election results. Ultimately, RLAs offer a straightforward, efficient way to confirm that reported election outcomes are correct that streamlines with existing election processes.

The Future of RLAs in Connecticut

Connecticut Public Act No. 26-42 calls for the implementation of RLAs as of January 1st, 2027, for the following elections:

presidential.
all state offices, which includes:
- governor.
- lieutenant governor.
- secretary.
- treasurer.
- comptroller.
- attorney general.
- senator.
at least one representative from Congress, which is randomly selected by the Secretary of the State.
at least 8 of 151 (5%) percent of offices in the Connecticut House of Representatives.
at least 2 of 36 (5%) percent of offices in the Connecticut Senate.

By this law, the risk limit must be 5% or lower. RLAs must produce a conclusion of either acceptable or inconclusive. Within the given risk limit, an acceptable conclusion indicates there is strong statistical evidence the reported outcome agrees with the true outcome. Any RLA that outputs inconclusive will be analyzed by the University of Connecticut. If this analysis finds a tabulator experienced an equipment failure, the Secretary of the State must have it examined and recertified. Additionally, any races where an RLA outputted inconclusive must undergo a full hand recount to determine the true outcome.

Ballot manifests for polling places and absentee ballot counters must be created within three days after polls close. Their creation should be publicly observable to promote transparency. The registrars of voters will submit all ballot manifests to the Secretary of the State. After ballot manifest creation is completed, the paper ballots are to be carefully preserved and sealed away until audit time. Any RLA-specific procedures will be developed and released by the Secretary of the State after a pilot implementation.

RLA Pilot in Connecticut

To boost public trust and confidence in American elections, the following states have moved to adopt RLAs in some form: California, Colorado, Georgia, Indiana, Maine, Maryland, Michigan, Nevada, New Hampshire, New Jersey, New York, North Carolina, Ohio, Oregon, Pennsylvania, Rhode Island, Texas, Virginia, and Washington.

Connecticut is launching its own RLA pilot in February 2027, auditing ballots from the November 2026 state elections. The Secretary of the State will randomly select three municipalities of varying population sizes:

less than 20,000,
greater than or equal 20,000 but less than 90,000, and
greater than or equal to 90,000.

This pilot will allow Connecticut to experiment with different RLA techniques and fine-tune their approach for future RLA implementation.

Important Parties

There are several important parties that will play different roles during the RLA:

The Secretary of the State (SotS): The Office of the Secretary of the State is responsible for selecting the risk limit and contests to audit. They will also function as a centralized “liaison” for the different towns in Connecticut as the RLA is conducted. The audit will ultimately function in a distributed manner, as depending on the margin and risk limit, there will be numerous towns in Connecticut where only a single ballot is requested from for the audit. These towns will need to communicate the contest data contained on this ballot back to an authoritative figure for the audit results; this figure will be the Secretary of the State.

Center for Voting Technology Research (VoTeR Center): The VoTeR Center will be responsible for investigating any discrepancies found during the RLA. They are also key in researching means to make RLAs more efficient for the state of Connecticut, given the intricacies of its election architecture.

Registrars of Voters: Each municipality’s registrars of voters run the audit locally. They create and submit their town’s ballot manifests, keep the paper ballots securely stored and in order until the audit, retrieve the ballots selected for audit, and record how auditors interpret each one. In the audit software, a registrar or other local election official serves as the town’s jurisdiction manager, uploading the town’s audit files and entering its audit results.

Election Systems & Software (ES&S): Election Systems & Software programs the elections and maintains the tabulators that output the election results. They play a key role because their equipment generates artifacts that are necessary to conduct an RLA, such as the cast vote record (CVR) and imprinted identifiers on ballots. Connecticut allows a candidate to be endorsed by more than one party, and ES&S’s current firmware cannot yet produce CVRs that account for these cross-endorsements, so ES&S is upgrading its tabulators’ firmware statewide ahead of the February 2027 pilot.

VotingWorks: VotingWorks is a nonprofit that develops Arlo, the open-source software that will be used to run the audit. Arlo takes in each town’s ballot manifest and reported results, uses the publicly generated random seed to select which ballots to audit, and calculates whether the audit has met the risk limit. The Secretary of the State acts as Arlo’s audit administrator, configuring, monitoring, and concluding each audit.

The Public: Members of the public can observe every step of the audit, from ballot manifest creation to generating the randomness that selects ballots to ballot retrieval and examination. Observers provide independent accountability that the audit was carried out as described.

Frequently Asked Questions

Will Connecticut only conduct RLAs?

No. Connecticut will continue its current post-election audits after municipal and primary elections. RLAs require a large ballot population to be efficient, so they will only be used in federal election years.

What is different about RLAs?

RLAs are designed to check the correctness of the reported election outcome, not just whether a tabulator is working correctly.

What do RLAs assume?

RLAs assume that the set of paper ballots stored after the election is a full record of voter intent in the election.

Which RLAs will be used in Connecticut?

This has not been decided yet. The VoTeR Center is helping to conduct the pilot in February 2027, which will audit ballots from the 2026 state elections, with the goal of creating the most efficient, easy, and secure audits for Connecticut.

How much work are RLAs?

It depends on the margins of the contests being audited. RLAs require little work for contests with a margin of 30%, but a lot of work for contests with a margin under 1%.

What is the risk limit, and what will Connecticut use?

The risk limit is the largest chance that an audit stops without catching a wrong reported outcome. Connecticut law requires a risk limit of 5% or lower, and the Secretary of the State selects the exact value. A smaller risk limit gives stronger assurance but requires examining more ballots. For comparison, Colorado began with a 9% risk limit and lowered it to 3% as counties became comfortable conducting audits.

What happens if the audit finds a discrepancy?

A discrepancy is a difference between how auditors read a sampled ballot and how the voting system recorded it. Discrepancies that shrink the reported margin can require the audit to examine more ballots. If the audit cannot confirm the outcome, it ends as inconclusive: the contest gets a full hand recount to determine the true outcome, and the VoTeR Center analyzes what went wrong. If that analysis finds a tabulator experienced an equipment failure, the Secretary of the State must have it examined and recertified. In practice, most discrepancies come from human error, such as retrieving the wrong ballot or recording a vote incorrectly.

Why is my town auditing so few (or so many) ballots?

Many audited contests, such as presidential and statewide offices, span the entire state. Ballots for these contests are sampled at random from across all towns, so a town’s share of the sample depends roughly on how many ballots it cast and how many of the contests selected for audit appear on its ballots, and some towns may be asked for only a single ballot or none at all. If discrepancies in a statewide contest require more ballots to be examined, every town with that contest may be asked to retrieve additional ballots, even if its own ballots matched. Contests that are contained within a smaller area, such as a state legislative district, draw ballots only from the towns in that district.

Which contests will be audited?

Public Act 26-42 requires RLAs for presidential contests, all state offices, at least one randomly selected U.S. House contest, and at least 5% of Connecticut House and Senate contests. See The Future of RLAs in Connecticut for the full list. The Secretary of the State randomly selects the congressional and state legislative contests to audit.

Can the public observe the audit?

Yes. Every step of the RLA is designed to be publicly observable, including creating ballot manifests, setting the randomness used to select ballots in a public ceremony, retrieving the selected ballots, and examining and recording them. Observability lets anyone confirm that the audit was conducted correctly, which is a key source of the confidence RLAs provide. Contact your town’s registrars of voters or the Office of the Secretary of the State for details on observing an upcoming audit.

An In-Depth Look

Technical Properties

RLAs strictly involve auditing a random sample of paper ballots. Paper ballots are inherently trustworthy representations of voter intent because they are software independent: free from being altered by the hardware and software issues that may impact voting technology. The sample size, or number of ballots audited, depends on the margin, risk limit, and audit type. Closely tabulated margins demand more ballots since the results can be changed with fewer machine errors. Smaller risk limits call for higher confidence in the reported results and thereby require more ballots. Audit type relies differentially on both margin and risk limit to determine sample size; discussions on both risk limit and audit type proceed below. RLAs hand count ballots until they satisfy the risk limit: the largest probability an audit stops without challenging an incorrect machine count. The risk limit of the audit is determined before the audit starts and affects the number of ballots sampled; a smaller risk limit—meaning a smaller probability that an incorrect reported result is missed by the RLA—requires more ballots to be examined during the audit. If enough ballots match the machine results, the audit can be reasonably confident (within the risk limit) that the election outcome is correct. For example, with a risk limit of 5%, if the reported outcome is wrong, the audit will catch it and lead to a full hand recount at least 95% of the time. The risk limit describes how reliably the audit procedure catches wrong outcomes; it is not a 95% confidence level that a particular reported outcome is correct. On the other hand, if the audit results are inconclusive, more ballots are inspected until either the audit is confident in the results or a full hand recount is required to reveal the true election results. The RLA calls for a full hand recount of the ballots when the discrepancy between the reported results and physical ballots is so large that it cannot reach the statistical confidence in the results expected by the risk limit. Put another way, if the reported outcome is wrong, a risk limit of 5% means there is at most a 5% chance the audit stops without returning inconclusive and calling for a full hand recount.

Each audit type has a unique approach to analysis that provide varying levels of electoral discrepancy with varying levels of complexity. There is no one audit method that is superior to the others; each method has its strengths and weaknesses depending on available technology, manpower, required sample size, and overall number of ballots cast in the election. In brief, the three main audit types are:

Ballot polling, which tallies a subset of the ballots and checks the tally against the total reported margin;
Ballot comparison, which examines individual ballots against their machine interpretations;
and Batch comparison, which inspects groups of ballots at a time against their reported subtotals.

True and Reported Election Outcomes

The true, undisputed outcome of an election is found by doing a full manual count of all ballots cast in the election. The physical ballots are considered the ground truth of the election, as they are voter-verified and unmodified after casting. Manually tallying them is an accurate accounting of the election results but demands a lot of time and labor. The reported election outcome is the result generated by tabulators or other counting equipment. Tabulators have been adopted widely across the United States to expedite the process of generating election results and reducing manual counting errors in the face of robust election architectures. Despite its efficiency, voting technology must undergo additional security checks, such as auditing, to guarantee accuracy and maintain confidence in the reported results.

Risk-limiting audits (RLAs) are post-election audits designed to confirm the reported outcome by examining a random sample of ballots. They provide strong statistical evidence a reported outcome is correct while inspecting only a small subset of the ballots cast in an election, making them both an efficient and accurate style of tabulation audits. As an RLA examines a random sample of ballots, there is a risk associated with the audit. The risk is the chance that the audit successfully concludes when there is actually an issue; the audit is risk-limiting because it places a maximum chance that an incorrect reported outcome is not challenged by the audit. Usually the risk-limit is between 1% to 10%, meaning there is a maximum 1% to 10% chance that the audit does not identify an incorrect reported outcome.

An RLA relies on a small set of records, or artifacts, produced during and after the election:

Paper ballots: The voter-marked ballots themselves, which serve as the ground truth the audit checks against.
Reported results: The vote totals produced by the tabulators for each audited contest. Batch comparison also needs the reported subtotals for each batch, such as the results tape from a single tabulator.
Ballot manifest: A record of how many ballots are in each batch and where each batch is stored. The manifest is what lets auditors turn a randomly selected number into a specific physical ballot to retrieve; it is discussed further in Ballot Manifests.
Cast vote records (CVRs): Ballot comparison additionally requires the tabulator’s record of how it interpreted each individual ballot, along with a unique identifier imprinted on each ballot so that every paper ballot can be matched to its CVR.
Random seed: A random number, generated in a publicly observable way, that determines which ballots are selected for audit. See Ballot Sampling.

Each artifact must be created and secured before the random seed is generated, so that no one can tailor the records to the ballots that will be selected.

During an RLA, auditors examine a random selection of paper ballots—an immutable representation of a voter’s choices. The auditors compare their manual interpretations of these ballots against the machine interpretations of the sample. This is done either at an individual ballot or batch level, called comparison audits, or by tallying a sample and comparing it to the total reported margin, called polling audits. Although minor human error may influence manual interpretation and tallying, auditors are trusted because RLAs are meant to be transparent and observable. Observers are common at these types of audits and create an inherent form of accountability.

Sample Sizes

RLAs usually have small sample sizes to maximize efficiency. Note that these audits utilize sampling with replacement: on occasion, the same ballot can be sampled and checked multiple times. RLAs also have the benefit of being able to conduct opportunistic audits; while auditing a statewide race, smaller, local races can be examined at the same time (in some terminologies, this is called nested auditing).

The number of ballots required to conduct an RLA varies widely depending on the contest and audit parameters, namely: the contest margin, risk limit, and audit type.

Margin: A narrower margin demands a larger number of sampled ballots, because the number of ballots between the reported winner and other candidates is more sensitive to potential discrepancies. At a very small margin, a few ballots can make the difference in the reported election outcome. At especially small margins, usually around 0.5%, many states have laws requiring a full hand recount for this reason. A larger margin relaxes the number of ballots required for the same reason; the number of ballots required to influence the reported result is more lax, and therefore less sensitive to errors.

Risk Limit: Because the risk limit is the chance that an incorrect outcome will go undetected by the audit, more ballots are required when attempting to reduce this chance; in other words, a smaller risk limits requires a larger audited sample in exchange for higher accuracy. At the extreme, a risk limit of 0% ensures there is a 100% the reported outcome is correct, specifically by examining every ballot cast in the election.

Audit Type: As will be discussed in a later section, audit type also influences sample size. Ballot comparison requires less ballots than batch comparison or ballot polling, with the trade-off of ballot-level tabulation information. It conducts a tighter audit analysis by interpreting individual ballots, thus making it much more sensitive to discrepancies and allowing it to provide statistical guarantees with only a small number of ballots. Batch comparison and ballot polling require much less information than ballot comparison but require a much larger sample size for analysis. Regardless, all RLAs are more efficient than a full hand recount and have the benefit of being able to easily transition from auditing to a full hand recount if necessary.

RLA Outcomes

There are two possible results to an RLA:

Acceptable means that there is strong statistical evidence the risk limit is met. More specifically, there are high odds that the reported and true outcomes are the same. This means that the audit can end, as the audit is confident (within the risk limit) of its current output.
Inconclusive indicates more data is needed since the risk limit has not yet been met. In this case, auditors can choose to either draw another sample or conduct a full hand recount to calculate the true election result. Generally speaking, another RLA sample is still more efficient than conducting a full hand recount. As more discrepancies (errors) are detected, the RLA is more likely to be inconclusive, even with more ballots being audited. Note that an inconclusive result on its own is not enough to change a reported outcome; the RLA only indicates whether the reported result is acceptable or more auditing is needed.

In the case of an inconclusive result, the RLA cannot always pinpoint the direct source of error. However, it can provide clues to possible sources of discrepancies, depending on the audit type (as different audit types require differing levels of analysis). Since the auditors are looking at the physical paper ballots, the RLA itself is not influenced by the same error as the counting equipment used in the election; therefore, the RLA is software independent and considered to be an unbiased evaluation of the election results.

There are two types of mistakes an RLA can make:

Suppose the reported (electronic) and true (paper) election results do not match, but the RLA outputs acceptable. Due to the random sampling of an RLA, it is possible for the audit to only select ballots that were correctly interpreted by the tabulator, thus creating the illusion that all electronic equipment functioned properly during the election. The risk limit is meant to control this possibility: a smaller risk limit increases the number of ballots sampled but reduces the chance of this failure.
Suppose the reported (electronic) and true (paper) election results do match, but the RLA outputs inconclusive. This can potentially occur when the audit samples ballots that had some systemic error—perhaps with a specific, single tabulator—that causes them to routinely misinterpreted (in the case of comparison audits), or the sampling is unlucky and pulls ballots that skew the sample’s margin (in the case of polling audits). For inconclusive results, the RLA will call to audit more ballots, which may eventually turn the output to acceptable. In the worst case scenario, the RLA may call for an unnecessary full hand recount; unnecessary only because the recount would verify the reported election outcome. While resources are misspent in this scenario, ultimately the correct election outcome is still determined at the outset of the audit.

Types of Audits

There are three main RLA methods in current literature: ballot polling, ballot comparison, and batch comparison audits. There is no singular “best” RLA method, as each one has its strengths and weaknesses grounded in various equipment deployments, election architectures, and workload availability. The implementation that is best for a high turnout, small margin, mail-in ballot state may not be an ideal implementation for a low turnout, large margin, and precinct-based tabulation state. Mathematicians and computer scientists are constantly looking for means to optimize current RLA methods to suit more specific state needs and reduce sample size complexity.

Procedure Outline

The basic procedure of each method is as follows:

Ballot polling:
1. Retrieve the sampled ballots.
2. Keep a manual tally of the audited contest from all observed ballots.
3. Compare the audited tally against the reported total.
Ballot comparison:

Note: Ballot comparison audits require the tabulation equipment to be equipped with a means to imprint unique identifiers onto ballots as they are tabulated. This is so auditors will have a means to relate the individual tabulator interpretations of ballots (known as cast vote records, or CVRs) to the physical paper ballot.
1. Select a random sample of CVRs to audit.
2. Retrieve the corresponding physical paper ballots based off the ID shown in the corresponding CVRs.
3. Compare each physical paper ballot to its CVR and note any discrepancies.
Batch comparison:
1. Retrieve a randomly selected group of ballots, known as a batch. (A natural batch, for example, could be all the ballots from a single tabulator.)
2. Hand count the audited contest from every ballot within the batch.
3. Compare the audited total against the reported total for that specific batch.

Strengths and Weaknesses

Audit Type	Strengths	Weaknesses
Ballot Polling	This method is straightforward to conduct and does not require additional bookkeeping. It also allows for an easy transition to a full hand recount, as auditors are already tallying. It requires the least amount of extraneous election artifacts or setup.	The number of ballots to audit increases quickly as the margin becomes smaller in order to satisfy the risk limit. There is no available information about why any discrepancies may have occurred.
Ballot Comparison	This method requires the fewest ballots to audit to meet the risk limit. The ballot-level interpretations allows auditors to identify singular sources of discrepancy.	This method requires tabulators to produce cast vote records, or CVRs, in order to show ballot-level machine tabulations. New equipment is emerging that can produce this, but this equipment is not yet widespread. Every ballot needs an identifier so it can be linked to its corresponding CVR. Many districts lack this kind of technology. The process of imprinting identifiers is difficult due to trade-offs between efficiency and privacy. Consider the difficulty in location a specific identifier within a grouping of ballots (known as a batch): If identifiers are printed sequentially, this makes searching easy, as the auditor will know roughly where a specific identifier is within a batch. However, this reveals the order in which ballots were cast on the tabulator—the lowest identifier in the batch is the first ballot in that batch to be cast. In the setting of centralized counting, this is not a concern, as voters are not the ones inserting their ballots and therefore there is no chance to reveal which ballot belongs to which individual. This does become a concern with voter-facing tabulators though, as the order in which ballots are cast is now revealed through the order of identifiers. Randomness of identifiers is necessary to protect voter privacy. But now, at a worst case scenario, auditors are conducting a search of every identifier within a batch to find a specific ID. Reconciling this issue of efficiency and privacy is not an easy task. Proposed solutions include transitive tabulation—re-tabulation and imprinting on a secondary tabulator and using the CVR from that machine—and creating electronic equipment to scan every identifier in a batch of ballots to locate the ones necessary for the audit.
Batch Comparison	There are no strict rules on how to create a batch, as long as the auditors have the batch’s subtotal. Batches that are grouped in meaningful ways can offer useful information about potential election issues. For example, if a batch with many discrepancies had all of its ballots scanned by one tabulator, that specific machine may have malfunctioned. The workload for smaller margins does not increase as dramatically as ballot polling. This audit is straightforward to conduct and only requires arranging ballots into batches of some kind. It also allows for an easy transition to a full hand recount, with a measurable amount of the workload already done.	This method typically counts the largest number of ballots. Batch comparison is not practical for small local elections with few batches, as it would be close to simply doing a full hand count. If natural batches are large, auditors will need to either create smaller batches and somehow obtain their subtotals, or very likely count a large number of ballots at a time; as the probability of a batch being selected for audit is proportional to its size.

Ballot Processing, Storage, and Retrieval

At some point during the electoral or auditing process, ballots are organized into batches. Batches are an arbitrary grouping of ballots used to identify the physical relative “location” of a ballot. A natural batch is all the ballots processed by a single tabulator in the election; there are tabulation results for this batch, and they are normally stored together after the election. Election officials also have the opportunity to create batches during ballot manifest creation (done between the close of polls and before the audit).

Ballot Manifests

As there are no strict rules on to the sizes of batches, ballot manifest creation is an opportune time to establish new batch sizes. During manifest creation, election officials hand count every ballot cast during the election and create a record of how the ballots are batched, where these batches are located, and how these batches are identified. Say that the current grouping includes all the ballots from a tabulator: election officials may label this batch 001, located in bin with seal 11111 and count 1,000 ballots. All of that information would be contained in a ballot manifest. Alternatively, officials could decide to split this batch into two batches, label them batch 001 and 002, both in bin 11111, and split them into sizes 500 each (as they are already hand counting the batch). It is important for election officials to account for the physicality of handling the batch sizes when deciding how large to make the batch, as during audit time, auditors must be able to efficiently handle the stack of ballots. However, too many batches can make it difficult to locate specific ballots or find a proper storage solution.

Approximate manifests: Recent research has examined the influence of approximate ballot manifests on the effect of the risk limit and found numerous mathematical solutions to account for such a manifest. In order for an RLA to be completely software independent, a ballot manifest must be hand counted. However, hand counting millions of ballots (specifically in the case of Connecticut, almost 2 million) is extremely time-consuming. Especially at large margins—where the sample size is small—manifest creation turns out to be the dominant cost of the RLA. Many states have already turned to other means of creating their manifest, which are called approximate manifests. These could be an electronic count of sorts, such as from a counting scale or transitive tabulator, or an upper bound provided from an election process, like the voters checked off in a pollbook or the number of received absentee ballot envelopes. As long as the ballots are placed within a grouping that corresponds to their electronic number, approximate batch numbers are acceptable for the manifest.

Ballot Storage

It is essential that ballots physically remain in the batches created for the ballot manifest. This can be done via ballot storage solutions, such as placing all the ballots within a batch in one folder, then placing that folder within a container for post-election storage. Other solutions to maintain batches include envelopes, rubber bands, foam, binder clips, and dividers.

There is no one-size-fits-all solution for ballot storage, especially when considering the varying ballot lengths used across different elections. It is obviously important that ballots are not rolled, folded, ripped, written on, or otherwise modified after being cast to preserve voter intent. In the case of ballot comparison, where auditors need to find a specific ballot via its identifier to audit, it is important that ballots are kept in sequential order within their batch. This makes ballots retrieval easier, as the order of the CVR will correspond to the order of the ballots within the batch.

Ballot Sampling

RLAs rely on random selection to choose which ballots to audit. Having proper randomness is necessary to ensure that the sampled ballots reflect the population of all voters, rather than a concentrated distribution of ballots that may present incorrect conclusions about the election. In the worst case, this means certifying a tabulated outcome that does not match the true outcome of the election. It is convenient to have this randomness generated in advance, rather than stopping to generate new randomness every time the auditors have to sample a ballot.

RLAs can generate long and random sequences via a pseudo-random number generator (PRNG): a deterministic function that, given an random input, generates a long pseudo-random, or “random-looking,” sequence of numbers. PRNGs are widely used across computer science, statistics, and other mathematical fields. To promote transparency, the PRNG algorithm should be declared in advance, and the random input for the PRNG should be generated in a publicly observable way.

The PRNG output is used to generate which random ballots or batches to retrieve to audit. This information is included on a document called a pull sheet. Note that ballots are sampled with replacement, so the same ballot may be sampled multiple times.

In ballot comparison, auditors are required to retrieve a specific ballot to audit. They will be provided with a ballot identifier and batch number to find said ballot. Ideally, the ballot manifest will tell the auditors which container the batch is located within.

In ballot polling, auditors will be given either a batch to sample from or a ballot location from within a batch (e.g., in a batch of 500, retrieve ballot 146). The goal with ballot polling is randomness; errors of a few ballots off are considered “innocent” errors and do not influence the outcome of the audit. For ballot polling, there are several ballot retrieval techniques:

Counting method: Auditors manually count the ballots starting from either the top or bottom of the stack. This is method is precise yet inefficient if the stack is large and the ballot is not close to either end.
Scale method: A high precision counting scale is calibrated against a stack of ballots with a known count. After calibration, the scale will display the number of ballots within a batch whenever one is placed upon it. Given a batch and a ballot location to find within, auditors can estimate the number of ballots to add or remove from the batch until the scale displays the desired ballot number. Any retrieved ballots may be off by a few positions due to minor calibration errors, but this method is generally faster than counting.
Ruler method: A combination square, is used to measure where the desired ballot location should be within the stacked batch of ballots. Like the scale method, this is faster than counting but less precise. So long as auditors can estimate ballot location via distance, other measurement devices such as rulers and digital calipers can also be used.
k-cut method: Given a number k, cut the batch k times and take the top ballot; the standard is 6 cuts. This process involves generating a random integer between 1 and 99 and splitting the stacked batch at that approximate percentage from the top. These split ballots are placed at the bottom of the stack, and the process is repeated. One split is one k-cut. The previous three methods require auditors to find a ballot location from within the batch, as listed on the pull sheet. With k-cut, auditors are given a random batch and a specified number of ballots to collect from that batch. The end result is still a random ballot, but the methodology to get there is different.

The counting method is the most accurate for finding a specific ballot location, though it can be tedious depending on batch size. Larger batch sizes cause the counting method to take longer. While the scale, ruler, and k-cut methods are not as accurate, the common consensus it that so long as the protocols are followed in good faith, they adequately select random ballots. More research may be needed to determine their true impact on random sampling.

If a ballot to be sampled cannot be found, auditors can pretend it disagreed with the reported outcome. This interpretation increases discrepancy the most; in practical terms, this means the RLA is more likely to return inconclusive and request a full hand count. If strong evidence is still found to confirm the election results, then the RLA will still return acceptable despite this assumed interpretation. This approach is simply the safest statistical means to handle missing ballots.

Retrieving a singular paper ballot is time-consuming: auditors consult the manifest, sift through the batch, manually interpret the ballot, and then return it to its batch. As such, it is typically more efficient to fetch many ballots at once and repeat this process in rounds. Depending on the risk limit and margin, auditors can inflate the sample size such that the audit is likely to stop within a single round.

These approaches, with the exception of ballot retrieval methods, also apply to batch comparison. Entire batches are hand counted during batch comparison, so ballot retrieval is not a concern. Auditors can locate the physical location of the batch via the ballot manifest. However, there are two studied approaches for tallying the ballots that are useful to note:

Sort-and-stack method: Ballots are sorted in stacks for each contest by vote. Then, each stack is counted to determine the results. Multiple auditors should independently count and check their results to ensure accuracy. If the counts disagree, then stacks should be recounted until they agree.
Hashmarking method: Each ballot is reviewed one at time and all of its votes are counted. The final count is reached once the batch is fully processed. It may be more manageable to separate the batch into smaller stacks that are processed one by one. With a team of four, the first person reads the votes aloud, the second person spot checks the first person, and the third and fouth people independently hashmark separate sheets. At the end of the stack, the sheets are compared. The team either moves on or recounts the stack depending on whether a discrepancy was detected. Both methods are designed as such to be self-correcting; if auditors disagree, they redo the process and compare results until they do agree. In the case of the Rhode Island pilot, they found that the auditing teams each had either a procedural or tallying discrepancy that was caught during the process, proving these methods’ self-correction efficacy.