← All posts

In some places no law requires an audit at all

In some U.S. states, no law requires anyone to check whether the machines counted your vote correctly — and a federal audit found that gap in 2005.

Somewhere in a Wisconsin county clerk's office in October 2021, a team from the state's Legislative Audit Bureau was trying to reconstruct an election that had happened nearly a year earlier. They had not been approved to start until three months after Election Day. They could not directly observe the count. They surveyed clerks, pulled absentee-ballot certificates, reviewed equipment-test records — and found that only 50.3 percent of the statutorily required equipment tests had been completed within the ten days before the election that state law required.

The finding was not evidence of fraud. But it raised an uncomfortable question: if more than half the required pre-election equipment checks weren't done on time, what exactly would have caught a problem if one had occurred?

The answer, in Wisconsin and in many other places, is: nothing mandatory.

The gap nobody put on the front page

Here is the sentence that tends to get buried in policy documents: in some U.S. jurisdictions, no law requires a post-election audit at all.

Not a weak audit. Not a slow audit. No audit. The machines count. The numbers are certified. No one is legally required to check whether the machines counted correctly.

This is not a conspiracy theory. It is a gap in the administrative law — one that federal auditors named in writing, in a 107-page report, in 2005.

The U.S. Government Accountability Office's GAO-05-956, issued September 21, 2005, found that federal efforts to improve electronic voting system security and reliability were under way but that "key activities remained incomplete." The GAO recommended the Election Assistance Commission establish certification procedures, create repositories for certified software, share information about system vulnerabilities, and disseminate recommended security practices. It reported that documented problems with electronic voting systems had raised "questions about their security and reliability."

Federal auditors — career professionals whose job is to find gaps, not to protect officials — were saying plainly: the safeguards are not finished yet.

That was 2005. The Wisconsin Legislative Audit Bureau's Report 21-19, released in October 2021, found that because the audit was not approved until three months after the November 2020 General Election, auditors "did not directly observe Election Day and relied on available evidence." Among the records they examined: 175 statutorily required equipment tests, of which only 50.3 percent were completed within the statutory window.

One in four of the certificates they reviewed — 1,022 of 14,710 absentee-ballot certificates — had partial witness addresses. And 59 of 60 test results examined in greater detail "indicated the equipment accurately counted the presidential votes."

That last sentence is frequently cited as reassurance. But read it again. Fifty-nine of sixty. Done late, by auditors who arrived after the fact, reviewing a subset of records. Reassurance is not the same as an independent, real-time, publicly checkable check.

What 'no mandatory audit' actually means in practice

An audit sounds bureaucratic. What it actually is: the only mechanism that can confirm whether the number the machine reported is the number the voters cast.

Without one, the count is what the machine says it is. Full stop. You are trusting the hardware, the software, and the people who configured both — and you have no independent way to test whether that trust is warranted.

This is not a hypothetical problem. In Windham, New Hampshire, an optical scanner quietly misread hundreds of absentee ballots because a folding machine had creased them through the vote-target ovals. The forensic audit ordered by the New Hampshire legislature — led by researchers Harri Hursti, Mark Lindeman, and Philip Stark — traced the problem to fold lines that the AccuVote scanners interpreted as marked ovals, compounded by a build-up of white powder on the scanner lenses. No malware. No fraud. A mechanical quirk and accumulated dust.

The error was only findable because durable paper ballots existed and a hand count could recover voter intent. Had there been no paper and no audit, the wrong totals would have stood.

Now remove the mandate. Without a legal requirement to audit, the people who would order that forensic review might never order it. The numbers stand. The miscount is never found.

The absence of a mandatory audit does not mean everything was counted correctly. It means you cannot know.

The 2005 warning that didn't trigger a federal fix

The GAO's 2005 report is worth pausing on, because it was not a partisan document. The Government Accountability Office is Congress's independent watchdog — it is specifically designed to tell legislators things they would rather not hear, without caring which party is in power.

What it said was clear: electronic voting systems had documented security and reliability problems, and the federal machinery for addressing them was incomplete. The Election Assistance Commission needed to finish building its certification procedures and start sharing information about vulnerabilities.

The EAC exists because the Help America Vote Act of 2002 — passed after the hanging-chad crisis — created it. HAVA directed the establishment of minimum election-administration standards and created a program to help states replace outdated voting equipment. But replacing hardware does not automatically create a process to verify that the new hardware is counting correctly. Standards and certification take time to build. The GAO said, in 2005, that they weren't finished yet.

What HAVA did not do — because Congress rarely does this — is mandate that every jurisdiction run a post-election audit sufficient to statistically confirm the reported outcome. That was left to states. And states, as it turned out, left it to themselves.

The result is a patchwork. Some states, like Colorado, have led the way. Colorado became the first U.S. state to complete a statewide risk-limiting audit in 2017 — a method that ties the size of the sample to the closeness of the race, delivering a defined statistical confidence that a fixed-percentage spot check simply cannot. In a lopsided race, you check fewer ballots. In a close race, you check more — potentially all of them.

Georgia's 2020 full hand count of roughly 5 million presidential ballots — triggered because the margin was narrow enough to require it under a risk-limiting framework — confirmed the machine-tabulated outcome to within about a tenth of a percent. That is what a real audit looks like: a procedure capable of catching a wrong result, run by a jurisdiction that had a legal framework requiring it.

Other states have nothing equivalent. No requirement. No sample size. No statistical threshold. No public report.

Why 'the audit confirmed it' is not the end of the story

There is a phrase you will hear after almost every election controversy: "The audit confirmed the result." It is meant to be the period at the end of the sentence. Often, it is not.

The Antrim County, Michigan episode is the clearest illustration. On November 4, 2020, the county published unofficial results showing an implausible outcome — wrong because of a human configuration error, caught because the numbers were absurdly out of step with the county's political history. The county corrected its totals the next day. A December hand audit of all presidential ballots tallied 9,759 for Trump and 5,959 for Biden. The Michigan Department of State confirmed the certified outcome was unaffected.

But the hand count differed from the machine tabulation by about a dozen votes out of roughly 15,700 cast.

Twelve votes. In a jurisdiction of that size, in a race that wasn't particularly close, twelve votes is not a crisis. But ask a harder question: in a race decided by twelve votes, what does a hand-count method that is itself off by twelve votes actually tell you? The honest answer is: not enough to settle it. Human miscounts happen. Ambiguous marks happen. Adjudication judgment calls happen. The hand count is not an error-free oracle; it is a different fallible method, and in a photo-finish race, a check that carries its own irreducible error cannot serve as the definitive proof.

This is not an argument against hand counts. It is an argument for stronger, cryptographically-grounded verifiability that does not rely on any single human or machine process being error-free. The case for verifiability that the public can check independently — not through faith in officials who caught their own mistake — is exactly what the dozen-vote gap in Antrim points toward.

The Wisconsin report makes the same point from a different angle. When the Bureau arrived three months after the election, it could reconstruct some things and not others. It made 30 recommendations and raised 18 issues for legislative consideration. That is a useful document. It is not a live check running alongside the count.

What a mandatory audit would actually require

A post-election audit worth the name has three properties. It has a defined statistical threshold — not "we checked some ballots" but "we checked enough that we would have a 95-percent chance of catching a wrong outcome if one existed." It audits against independent, durable, voter-created records — paper that the voter marked or confirmed, not a barcode the machine generated and the voter cannot read. And it is publicly observable — parties, observers, and journalists can watch, the ballots are handled according to a written chain-of-custody protocol, and the results are published at a level of detail anyone can verify.

Remove any of those three and the audit degrades. A statistical sample audited against machine-generated barcodes is auditing the machine against itself. A hand count done in private, with no observers and no published protocol, is a ceremony. A fixed five-percent spot check in a race decided by 0.01 percent proves almost nothing.

The German Federal Constitutional Court put the underlying principle most sharply, in its March 2009 ruling invalidating electronic voting machines: an election is only democratic when "the essential steps of the voting and of the determination of the result can be examined by the citizen reliably and without any specialist knowledge." Citizens, not experts. Reliably, not occasionally. Without specialist knowledge — meaning the check cannot depend on decoding proprietary software or reading a barcode.

That standard does not require paper by name. It requires that the artifact which is counted is the same artifact the voter can inspect. A QR code the voter cannot decode fails it. A proprietary tabulation system whose audit logs the same insiders can erase fails it. The federal court in Curling v. Raffensperger found, in 2020, that Georgia's ballot-marking system "does not provide a verifiable and auditable ballot record because it relies on the QR code for vote tabulation and that code itself cannot be read and verified by the voter." A paper printout the voter cannot check is not a voter-verified record. It is a machine-generated record printed on paper.

The real gap is structural, not partisan

It is worth being precise about what kind of problem the no-mandatory-audit gap is. It is not a Republican problem or a Democratic problem. It is not primarily a fraud problem. It is a design problem — a system built without an independent check, the way a financial institution might operate without an external auditor.

No bank regulator would accept "we checked our own books and everything looked fine" as the basis for public confidence in a financial institution. The check has to be independent, the method has to be publicly known, and the results have to be published in a form that any qualified party can inspect.

Elections deserve the same standard. The villain here is not a party or a candidate. It is opacity — the gap between "we announced a result" and "anyone can verify how we got it."

The fix is not complicated in principle. It requires:

  • A legal mandate that every jurisdiction conduct a post-election audit with a defined, published statistical threshold
  • Voter-verified paper records — marked or confirmed by the voter — against which the audit is conducted
  • Public observability — open to parties, observers, and press, with published results in machine-readable form
  • Independent reporting — an audit run or overseen by someone other than the people who ran the election

Wisconsin's recommendations run to 30 items. Colorado's risk-limiting audit framework gives a working model. The GAO said in 2005 that the federal machinery needed to finish being built. Twenty years later, the question is still being decided jurisdiction by jurisdiction, election by election.

What is still not verifiable — and what would change that

After the next election in your jurisdiction, here are the questions worth asking before you accept a "the audit confirmed it" headline:

Was an audit legally required? Not just encouraged, not just possible — required by statute, with a defined method and a published threshold.

What was the sample audited against? If the answer is "the machine's own output," it is not an independent check. If the answer is "voter-marked paper ballots," ask whether the ballots were marked by the voter or printed by the machine.

Who observed the audit? Was the protocol published in advance? Were the results posted in machine-readable form at the precinct level, so that any journalist or researcher could reconcile them against election-night totals?

What happened to discrepancies? A twelve-vote gap between a machine count and a hand count is not a rounding error to wave away. It is data. What it means depends on the margin of the race — and in a close race, it is exactly the kind of data that should trigger a deeper look, not a press release.

If none of those questions have public answers, the audit has not happened yet. What has happened is an announcement.

An announced result is not a verified result. The difference is a system anyone can check — and right now, in too many places, that system does not legally have to exist.

See how common this gap is across the world →

Read the two-minute version of this gap →

All the gaps we track →

Sources

See all postsExplore the gaps