How Paper and Statistics Underpin U.S. Election Verification
The United States does not secure its elections through elaborate software or continuous electronic surveillance of voting equipment. The real technical backbone is far more mundane: voter-verified paper ballots paired with a statistical method called a risk-limiting audit, or RLA.
An RLA is a post-election procedure intended to cap the probability that a reported contest outcome is wrong. Voter-verified paper ballots are kept under secure conditions until they can be reviewed, at which point a statistical sample is examined by hand until the evidence satisfies a pre-set risk limit.
The mechanics are uncomplicated. Officials manually count a statistically determined share of the paper ballots. If that sample backs up the reported result, the audit concludes. If it raises doubt, the audit expands — in the extreme, to a hand count of every ballot.
What drives the process is the link between sample size and margin of victory. A lopsided win calls for a smaller sample; a very narrow contest requires more ballots to be counted by hand. That relationship is what allows an RLA to deliver robust statistical confidence while manually reviewing far fewer ballots than a full recount would require. The approach is broadly regarded as the gold standard among post-election audits, and it illustrates why paper ballots carry so much weight for public confidence in elections.
Paper Records and Backing From Across the Spectrum
Because RLAs require voter-verified paper records, the security community treats the two as inseparable. Absent a paper ballot the voter has confirmed, there is no independent record against which a machine tally can be checked.
Support for the method crosses ideological lines. Endorsers include the American Statistical Association, the Brennan Center for Justice, Common Cause, the League of Women Voters and Verified Voting — a range stretching from the left-leaning Brennan Center to the nonpartisan good-government League of Women Voters.
As is typical in U.S. election administration, adoption differs from state to state. Some states mandate risk-limiting audits; others operate pilot programs. Pennsylvania, for instance, ran statewide RLAs, among them for its April 2024 presidential primary. Certain states are introducing progressively stricter risk limits across successive elections, tightening the confidence threshold as they accumulate experience.
Benefits include small, low-cost samples when the margin is wide; opportunities for the public to observe and verify each stage; and corrective steps when errors surface at any point, including larger samples and, if necessary, a 100% hand count. Drawbacks include the need for a sample covering a large share of all ballots to reduce the chance of missing mistakes in a close contest, and the difficulty of publicly checking computer totals other than by releasing computer records to the public.
What the Audits Detect
In practice, paper ballots plus risk-limiting audits enable officials to find and fix tabulation errors or tampering. Like other election audits, the aim covers not just deliberate alteration of ballots and tallies but also machine defects — software bugs, scanners with blocked sensors, or scanners that skip ballots.
The method does not presume that every ballot, contest or machine was handled identically, a scenario in which spot checks might be enough. Sample sizes are set so there is a high probability of catching even a brief moment when a scratch or fleck of paper blocks one sensor on one scanner, or a bug or hack flips votes in a single precinct or contest, provided those problems affect enough ballots to alter the result.
An RLA is not a recount. It is a statistical check meant to catch a wrong outcome before it is certified. If the audit escalates to a full hand count, that signals the system functioning as intended, spending more manual effort to settle the uncertainty the sample revealed.
Should review of sampled ballots expose flaws in ballot storage, the standard approach cannot restore correct results, and researchers advise a re-vote when the number of ballots in flawed storage could change winners. An alternative to re-votes is creating and verifying backups of paper ballots shortly after voting, providing a fallback to flawed storage of the originals.
There are three general types of risk-limiting audits, and the number of ballots needing hand checks varies with the election’s circumstances and the auditing method. In one example — a jurisdiction with 64,000 ballots tabulated in batches of 500, an 8% margin of victory, and a cap of 10% on undetected mistaken outcomes — method 1, ballot comparison, on average requires hand-checking a certain number of ballots. Comparisons may be done ballot-by-ballot or precinct-by-precinct, with the latter costing more.
Because adoption varies, a Pennsylvania voter has stronger post-election statistical assurance than a voter in a state that has not yet piloted an RLA. The question ahead is whether more states shift from pilots to mandates, and whether the phasing-in of stricter risk limits continues. Technically, RLAs function only where paper ballots exist, so advocacy for paper trails and for risk-limiting audits amount to the same cause. The gold standard is not abstract — it is a hand count of a statistically determined sample, escalating when needed, already underway in statewide elections.
