1

E-Voter Education Project 

Random Auditing of E-Voting Systems: 

How Much is Enough? 

by Howard Stanislevic 

Research Consultant 

VoteTrustUSA E-Voter Education Project 

August 9, 2006 

(Revised August 16, 2006)

www.VoteTrustUSA.org
2

Random Auditing of E-Voting Systems: 

How Much is Enough? 

by Howard Stanislevic 

Research Consultant 

VoteTrustUSA E-Voter Education Project 

This is the second in a series of presentations which will explain the risks and benefits of 

electronic voting (e-voting) systems to candidates, elected officials and the public at large. 

Abstract – E-voting systems with a means of independent verification, such as a 

voter-verified paper record or ballot, can be audited to ensure that all votes on 

the audited systems were counted as cast. While a random sample comprising a 

small percentage of thousands of voting systems may be adequate to confirm the 

outcome of all but the closest statewide races, we will show herein using the 

example of a Congressional District (CD), that small-percentage audits are 

inadequate to verify the outcome of all but the most decisive races (landslides). 

To be assured of finding a discrepancy in the vote tallies that would trigger 

additional auditing or a full hand recount of a race for the US House of 

Representatives or smaller local races, a much larger percentage of systems 

must be audited than commonly suggested. Each race must be considered a 

separate auditing process taking into account the vote margin, the number of 

precincts in which the race appeared on the ballot and the possibility of 

miscounts concentrated in a relatively small number of large precincts. To reduce 

the potential for miscounts, additional checks and balances such as pre-election 

auditing of ballot definition programming are necessary and will be the subject of 

a future report. 

Acknowledgement – Dr. Mark Lindeman and Ellen Theisen generously 

provided numerous valuable insights and suggestions for improvement (many of 

which were actually implemented).

Background 

Concerns about proprietary software, frequent hardware failures1

, configuration 

errors2

 and the potential for deliberate exploitation of e-voting systems, which 

include both Direct Recording Electronic (DRE, e.g., touch screen, pushbutton) 

and optically scanned paper ballot (OSPB) systems, have led computer 

scientists, legislators and election integrity activists to advocate mandatory 

manual random auditing (MMRA) of a small percentage of voting system tallies 

as a means of checking end-to-end vote counting integrity. Such audits can be 

conducted by selecting a random sample of precincts and comparing the system 

tallies to hand-to-eye counts of the voter-verified paper ballots or records in the 

same precincts. (Presently, DRE voting systems that do not produce such paper 

 

1

 Howard Stanislevic, VoteTrustUSA E-Voter Education Project, DRE Reliability: Failure by Design?, 

http://www.votetrustusa.org/pdfs/DRE_Reliability.pdf 

2

 Ellen Theisen, Ballot Definition Files, No Review Is Provided for a Key Component of Voting System 

Software, http://www.votersunite.org/info/BallotProgramming.pdf 
3

records cannot be independently audited.) If a discrepancy is found in the initial 

audit, additional auditing can be conducted to determine if other precincts have 

been corrupted, which could change the outcome of a race. But if an initial audit 

were found to be “clean”, i.e., without discrepancies, there may be no obvious 

basis for additional investigation, thereby allowing miscounts that could change 

an electoral outcome to go undiscovered. Determining the probability of such an 

occurrence and adjusting the auditing percentage accordingly for each race 

should therefore be a high priority. 

N.B. – While some laws or regulations may require the random selection of 

voting machines or systems rather than precincts, to simplify the following 

discussion we will use the terms “precinct” and “within-precinct miscount” (WPM) 

until later on in this work. We will also limit our discussion to 2-candidate races. 

Random Sampling Without Replacement 

One method of auditing the vote count is to select precincts randomly using a 

uniform distribution in which all precincts have an equal chance of being selected 

for auditing. Once a precinct has been selected, it cannot be selected again for a 

given race, so the pool of remaining precincts to be sampled is reduced by one. 

The initial number of precincts to be sampled can be stated as a percentage of 

the total number of precincts within a state or other jurisdiction by law or 

regulation. Typically, the initial sample size is from 1% to 5% of the total precincts 

in the pool. 

The method of auditing described above may be referred to as random sampling 

without replacement. It relies on a statistical technique known as the 

hypergeometric distribution, nicely illustrated by Dr. Charles Stanton3

 with an 

accompanying Java applet at the following URL: 

http://www.math.csusb.edu/faculty/stanton/probstat/lotto.html 

Stanton describes the hypergeometric distribution as follows: 

There are three parameters: N, the total number of objects (precincts); R, 

the number of objects of the first type (in our case, corrupt precincts); and 

k, the number of objects to be chosen (the precincts to be audited). The 

probability function f(x) is: 

f(x) = C(R,x)*C(N-R, k-x) / C(N,k) for x=max(0,k+R-N)..min(R,k) 

where C(n,k) is the binomial coefficient.

This is analogous to picking lottery numbers, but the “winners” in this case are 

the corrupt precincts detected by the audit. 

 

3

 http://www.math.csusb.edu/faculty/stanton/ 
4

Ellen Theisen has written a paper4

 with an accompanying Excel spreadsheet5 to 

calculate the odds of finding one or two of a potential series of corrupt precincts 

using the hypergeometric distribution. Dopp, et al, have done similar work, also 

taking within-precinct vote shift percentage into account.6

 Also see Neff’s work 

comparing Congressional to statewide races in California.7

 We are not aware of 

any published work that takes precinct size into account so we will do so herein. 

For a given auditing percentage (e.g., 2%), a larger total number of precincts will 

result in a larger set of precincts to be audited. This means that for a given 

percentage of sampling, there will be more chances to find a corrupt precinct 

within a large set of precincts than within a small one. 

For any given race, the greater the total number of precincts: 

- the more corrupt precincts will be required to change the outcome; 

- the more attempts to find the corrupt precincts will be allowed; 

- and the greater the chances of finding a corrupt precinct will be. 

All this makes it more likely to find a corrupt precinct in a large race than a small 

race. Therefore, in most states, the outcome of a statewide race (e.g., Governor 

or US Senator) is actually easier to confirm with a small-percentage audit than a 

race for the US House of Representatives. (The exceptions are the states with 

only one Congressional District.) 

Practical Auditing Considerations 

The precise method of conducting audits unannounced (or maintaining the chain 

of custody to prevent tampering if they are announced) is beyond the scope of 

this work. Also, it is assumed that reconciling the number of poll book signatures 

with the number of ballots cast at each precinct is already standard procedure to 

rule out ballot stuffing, loss or destruction. The Brennan Center’s report, “The 

Machinery of Democracy”, suggests some ways of ensuring transparent random 

selection, which we would encourage.8

 A transparent method of comparing 

precinct totals to central tabulator totals for the same precincts should also be 

 

4

 Theisen, Auditing Election Equipment — The Real Scoop!, 

 http://www.votersunite.org/info/auditingissues.pdf

5

 Theisen, http://www.votersunite.org/info/AuditEffectivenessCalculator.xls 

6

 Kathy Dopp, et al, How Can Independent Paper Audits Detect and Correct Vote Miscounts?, 

 http://electionarchive.org/ucvAnalysis/US/paper-audits/Paper_Audits.pdf 

7

 C. Andrew Neff, Election Confidence, A Comparison of Methodologies and Their Relative Effectiveness 

at Achieving It, http://www.votehere.net/papers/ElectionConfidence.pdf 

8

 The Brennan Center for Justice, The Machinery of Democracy, Appendix F, 

http://brennancenter.org/programs/downloads/SecurityFull7-3Reduced.pdf 
5

implemented as proposed by Jover.9

 The random audits discussed in this work 

are therefore designed to detect within-precinct miscounts of legally cast ballots.

When conducting an actual audit, the first thing we must consider is that due to 

the way districts are drawn, each race on the ballot may appear in some 

precincts in a jurisdiction but not in others or may extend to one or more adjacent 

jurisdictions. Any audit that selects precincts in which the race is not on the ballot 

is irrelevant to the race in question, so we must consider each race as a separate 

auditing process, regardless of jurisdictional boundaries. 

An audit is only effective if it can rule out miscounts large enough to affect the 

outcome of the race in question. Once the relevant precincts have been 

identified, some of which may actually be in neighboring jurisdictions, we must 

decide what percentage of the precincts needs to be audited to confirm the 

outcome of the race. This is not trivial. If we don’t audit enough precincts, a 

significant miscount may elude detection; if we wish to audit more precincts than 

necessary to confirm the outcome, we may incur unnecessary expense or may 

not even be permitted to conduct the audit. If a race is close enough (typically a 

margin of 0.25% to 0.5%), a full hand count might be obtainable without an audit. 

So we are primarily interested in auditing those races that are close enough to be 

reversed by undetected miscounts, but not necessarily close enough to trigger a 

full manual recount. 

We won’t know in advance how any potential miscount will be distributed among 

the corrupt precincts. There may be a lot of precincts with a few miscounted 

votes, a small number of precincts with many miscounted votes, or something in 

between. We should have no preconceptions. This is why the initial audit must be 

conducted randomly with each precinct having an equal chance of being selected 

for auditing. Other methods, such as proportional sampling, are possible but are 

more difficult to implement in practice. 

Since only races with no opposing candidates are decided by 100% of the vote, 

we will also need to specify the maximum percentage of total votes that could be 

switched from one candidate to another within a single precinct without arousing 

suspicion. We will call this parameter the within-precinct miscount (WPM). 

To determine how much auditing is enough to find a miscount, it’s necessary to 

do some reverse engineering. The greater the difference between the vote 

shares of the winning and losing candidates (the margin), the more corrupt 

precincts it would take to reverse the reported outcome. The minimum number of 

votes to reverse the outcome is half the margin plus one vote (switched from the 

actual winning candidate to the actual loser). This is the size of the discrepancy 

we must ultimately find or rule out. 

 

9

 Juan M. Jover, Ph.D., Democracy At Risk: The 2004 Election in Ohio, Section VIII: Transparent 

Aggregation of Voting Results Using the Internet, 

http://a9.g.akamai.net/7/9/8082/v001/www.democrats.org/pdfs/ohvrireport/section08.pdf 
6

With a WPM of 20%, on average it would take 1 / WPM, or five precincts to swing 

the vote by the equivalent of a whole precinct. We can multiply this value by half 

the margin to obtain the percentage of precincts that could change the outcome: 

5 x 0.5 = 2.5 times the margin. E.g., a race with a margin of 5% can be reversed 

by 2.5 x 5% or 12.5% of its precincts, each precinct having a 20% vote shift. 

However, this assumes that every precinct has the same number of votes, which 

is highly unlikely in practice. 

If the miscounts are concentrated in larger precincts but we implicitly assume that 

each precinct has only the average number of votes (i.e., the total votes in the 

race divided by the total number of precincts) there is a risk that we may sample 

too few precincts. For the audit to be effective, we must address this problem by 

taking precinct size into account. 

For the initial audit, we will need to calculate the probability that the first in a 

series of corrupt precincts will be found, thereby triggering additional auditing. 

Using random sampling without replacement, the odds of finding a corrupt 

precinct can be calculated by taking into account: 

- the total number of precincts in which the race appeared on the ballot; 

- the percentage of the above precincts to be audited; 

- the hypothetical number of corrupt precincts we are trying to detect, 

which we will refer to as PC. 

The last parameter above (PC) deserves special attention. We will never know 

the actual percentage of corrupt precincts in advance, but fortunately we won't 

have to. We will only need to select the minimum value of PC that could be large 

enough to reverse the reported outcome of the race in question. If there are 

fewer than PC corrupt precincts, we may not find a single one of them with our 

audit, but we will have audited enough such that any undiscovered miscounts 

would not be enough to change the outcome. 

To be certain that the value of PC is small enough, we can assume that the total 

number of switched votes in each corrupt precinct is equal to the highest number 

possible, resulting in the smallest percentage of corrupt precincts that could 

change the outcome. We can do so by assuming that all the miscounted votes in 

the race will be cast in the precincts with the highest vote counts, while actually 

auditing precincts randomly in case the miscounts are elsewhere. 

In other words, we will keep the distribution of the sampling uniform and 

completely random because we won't know a priori what the distribution of the 

miscounts will be, but in determining the size of the audit, we will use the worstcase scenario in which all the miscounts occur in the largest precincts. To do 
7

this, we can sort the precincts by their reported vote counts, add these up to 

obtain the smallest number of precincts that could reverse the outcome of the 

race (i.e., 2.5 times the margin), and determine the size of the random audit 

based on this worst-case scenario. 

Thus, by setting the following parameters, we can now design an effective audit 

for each race: 

- the acceptable degree of certainty that the race was decided correctly 

(100% certainty would require a full recount; 99% is feasible with an 

audit and we can make some other conservative assumptions, such as 

minimizing the value of PC, to get closer to absolute certainty); 

- the margin (difference in vote share between the two leading 

candidates); 

- WPM: A WPM of >20% would completely reverse a 60%-40% precinct 

or change the winner in a 70%-30% precinct, arousing suspicion even 

without an audit. So a 20% WPM seems an acceptable limit. (We 

provide further support for this argument below using the EdisonMitofsky 2004 National Exit Poll precincts.); 

- PC: The minimum number of corrupt precincts that could reverse the 

outcome of the race (the smallest number of whole precincts with an 

aggregate vote count equal to at least 2.5 x the margin). 

Graphical Analysis 

To better visualize the small-percentage auditing problem, it is helpful to consider 

a few graphical examples. 

1. Number of precincts 

For a hypothetical set of corrupt precincts ranging in size from 0.5% to 50%, the 

following graph illustrates the odds of detecting the first in the set of such 

precincts in: 

- a US Senate race with 5,800 precincts and a 2% random audit (116 

precincts); 

- a US House race with 400 precincts and a 2% random audit (8 

precincts); 

- a US House race with 400 precincts and a 25% random audit (100 

precincts); 
8

- a local or state legislative race with 100 precincts and a 2% random 

audit (2 precincts). 

0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

0%

0.5%

1%

1.5%

2%3%

5%7%9%

12%15%

18%

22%26%

30%34%

38%42%

46%50%

US House

US Senate

US House

Local Race

% Corrupt Precincts

400 Prcts. w/25% Audit

5,800 Prcts. w/2% Audit 400 Prcts. w/2% Audit

Odds of Finding One Corrupt Precinct With Random Audits

100 Prcts. w/2% Audit

Clearly, with only a 2% audit, Congressional and local candidates are at a 

disadvantage when it comes to detection of miscounts. To achieve the same 

level of confidence enjoyed by their Senatorial counterparts, US House 

candidates would need 25% audits (100 precincts per race) as shown. A state or 

local legislative race would require a whopping 68% audit (68 precincts, not 

shown). Outcomes of close local races are therefore nearly impossible to verify 

without a full recount. Looking at it another way, with a 2% audit it’s possible for 

the outcome of a local race with as much as a 20% margin to be reversed (with 

50% of the precincts corrupted) without detection.

2. Within-Precinct Miscount 

We have defined the term within-precinct miscount (WPM) as the maximum 

possible vote shift from one candidate to another as the result of error or fraud. In 

their recent report, “The Machinery of Democracy”, the Brennan Center for 

Justice assumed a maximum vote shift of 5% per county, 7.5% per polling place 
9

and 15% per voting machine. 10 Since a precinct can comprise one or more 

machines and a polling place can comprise one or more precincts, we decided to 

use vote shift per-precinct as the basic unit for this metric. 

The higher the WPM, the fewer corrupt precincts it would take to change an 

outcome and the larger the audit would have to be to detect them. By examining 

the shift in George W. Bush’s vote share between the 2000 and 2004 presidential 

elections in the 1,250 Edison-Mitofsky National Exit Poll precincts,11 we have 

found that only nine of those precincts (0.72%) exhibited more than a 20% vote 

shift (24% mean absolute value) which would result in at most a 0.35% change in 

the overall vote margin. A race close enough to be affected by such a small 

undetected change in the margin should probably be subject to a full hand count 

regardless of the outcome of an audit, but it is encouraging that the assumption 

of a 20% WPM can result in an audit with the potential to detect such a small 

discrepancy. A 10% audit of a statewide race with 5,800 precincts and a 0.35% 

margin, assuming a 20% WPM, would have >99% probability of finding a corrupt 

precinct. 

This indicates that the 20% limit may be a realistic assumption for the WPM. 

Reducing this value to 15% would reduce the audit’s sample size but would also 

allow a larger undetected shift in the margin. Increasing the WPM beyond 20% 

would be unnecessary since a full hand count should be obtainable for a race 

close enough to be affected by so few undetected corrupt precincts. 

To obtain the percentage of race-wide vote shift possible from the above graph, 

the “% Corrupt Precincts” values can be multiplied by the WPM of 20%, resulting 

in a range of 0.1% to 10% shifts of the race-wide tally from one candidate to the 

other. Such shifts could reverse the outcome of races with margins of 0.2% to 

20% according to the following conditional: 

if (A% - B%) / 2 < (PC% x W%) then FALSE 

where A% is the “winning” candidate’s initial reported vote share; B% is 

the “losing” candidate’s initial reported vote share; PC% is the percentage 

of corrupt precincts; W% is the WPM which we assume to be 20%; FALSE 

is a reversed outcome of the race due to error or fraud. 

 

10 The Brennan Center for Justice, Op. Cit., Pg.22, 

http://brennancenter.org/programs/downloads/SecurityFull7-3Reduced.pdf 

11 Data presented at the American Statistical Association, Philadelphia Fall Meeting, Oct. 14, 2005, 

http://inside.bard.edu/~lindeman/slide2-large.jpg 
10

Using the 20% WPM, the following graph shows the number of precincts that 

would have to be audited to be 99% certain of finding one corrupt precinct, given 

that there were enough corrupt precincts to change the outcome of the race in 

question with margins of 0.25% to 5%: 

10

100

1000

0% 0.5% 1% 1.5% 2% 2.5% 3% 3.5% 4% 4.5% 5%

US House Race -- 400 Precincts

Local Race -- 100 Precincts

US Senate Race -- 5,800 Precincts

Reported Margin

Minimum Number of Precincts to Audit for 99% 

Certainty Based on 20% Within-Precinct Miscount

 

A log scale is used on the y-axis to show a greater range of precincts. When the 

margin reaches 5%, each race requires approximately the same sample size to 

achieve 99% certainty: 33 +/- 2 precincts. The required sample size differs more 

for races with narrower margins. For instance, with a 1-point margin, the local 

race requires a sample of 90 precincts (almost every precinct!), while the Senate 

race requires 182 precincts (only 3.1% of precincts). Also note that a random 

statewide sample would not contain the same precincts as a sample of 

comparable size drawn from a single Congressional or local district. So while 

precincts randomly selected for the statewide audit may be included in audits of 

smaller races, there would most likely have to be additional precinct samples for 

each Congressional and local race, depending on their individual precinct counts 

and margins. 

Using the above methodology (which does not even take precinct size into 

account), in the 2004 general election for the US House of Representatives there 

were 57 races with margins of less than 17.4% requiring more than a 2% audit, 

14 races (with margins of < 8.1%) requiring more than a 5% audit and 7 races 

(with margins of < 4.2%) requiring more than a 10% audit. 
11

3. Concentration of Miscounts in Larger Precincts 

The above analyses assume that all precincts in the jurisdiction have the same 

number of votes, which would not be the case in practice. For example, the 

following graph of precinct vote proportions from Lake County, Ohio from the 

2004 general election shows a typical distribution of vote percentage by precinct 

within a jurisdiction: 

Percentage of Total Vote by Precinct

0.0%

0.1%

0.2%

0.3%

0.4%

0.5%

0.6%

0.7%

0.8%

0.9%

1.0%

1 25 50 75 100 125 150 175 200 217

Lake County, Ohio Precincts (2004)

Actual < Mean

Actual > Mean

Mean

Miscounts concentrated in precincts with greater- thanaverage vote counts may not be detected with 

random sampling percentages that do not take 

precinct size into account.

We can see from the above graph that miscounts concentrated in precincts with 

above average vote counts would be less likely to be detected by a random audit 

with a sample size based on the implicit assumption that all precincts have the 

same (mean) number of votes. One way to address this problem is to oversample so as to be certain that enough large precincts are examined, while still 

maintaining uniform random selection. Precincts can be sorted by their reported 

vote counts, and sample sizes can be selected by determining the absolute 

minimum number of precincts needed to reverse the outcome. This gives us the 

most conservative value of PC possible by assuming that all miscounts occur in 

the largest precincts, while sampling all precincts randomly in case the miscounts 

are elsewhere. This methodology will be included in our auditing protocol 

presented later herein. 
12

4. Precincts vs. Voting Systems 

In some states such as New York, laws or regulations are written to audit 

individual voting systems rather than precincts. While a precinct may comprise 

more than one voting system or a fraction of a voting system, the voting system 

sampling method actually selects a percentage of individual DREs or optical 

scanners, regardless of their precinct locations. The voting system method also 

removes the ambiguity associated with auditing of absentee or early voting 

systems, which may not be precinct-based. 

It is worth noting that because precinct-based optical scanners can handle many 

more ballots than DREs can, a population of optical scanners would generally be 

smaller than a population of DREs serving a comparable jurisdiction. This has an 

effect on the confidence level of audits because, all things being equal, the ability 

to audit a larger number of voting systems results in increased odds of finding a 

corrupt system. 

While DREs have numerous disadvantages when compared to optical scanners, 

such as the potential for poor reliability to disenfranchise voters, higher costs, 

higher complexity, difficulty of testing via the user interface, etc., based purely on 

the ability to detect fraud through random auditing, DREs may actually be 

advantageous. This is especially true if auditing rules are written to take 

advantage of the greater sampling potential inherent in a larger number of 

smaller e-voting systems, i.e., the system method as opposed to the precinct 

method. The system method avoids the clustering effect of auditing by precinct 

and may also result in auditing a greater number of ballot styles with a given 

sampling percentage. 

Consider the effect that having five times as many DREs as scanners from which 

to choose randomly would have on the statistical power of an audit of a US 

House race. Instead of 400 precincts per Congressional district with one optical 

scanner each, such a race might be run on 2,000 DREs. While it’s hard to 

imagine how this could compensate for the fact that DREs are almost impossible 

to test thoroughly on Election Day, some mitigation of this risk could theoretically 

be achieved through the statistical power of post-election auditing. 
13

The following graph compares a 3% audit of a US House race run on 400 optical 

scanners vs. 2,000 DREs: 

0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

0%

0.5%

1%

1.5%

2%3%5%7%9%

12%15%

18%22%26%30%34%38%42%46%

50%

US House

US House

% Corrupt Systems

2,000 DREs

w/3% Audit

400 Scanners

w/3% Audit

Odds of Finding One Corrupt System With Random Audits

Running the race on thousands of smaller systems results in a greater probability 

for the audit to detect fraud. With 5% corrupt systems, the odds of finding one 

with the scanner audit are 46.4%; with the DRE audit, 95.6%. However, if DRE 

VVPATs are harder to count by hand than paper ballots, this advantage may not 

be realized. 

Whichever method is used, there need to be provisions in the law or regulations 

for auditing beyond the initial random sample percentage whenever the outcome 

cannot be confirmed by the initial audit or there are any unexplained 

discrepancies. Anything less is simply trusting the voting system. 

It is worth noting that the Help America Vote Act mandates a maximum error rate 

for both DREs and optical scanners of no more than one in 500,000 votes, so 

there should be virtually no unexplainable discrepancies. 

Given the above considerations, we can develop a few hypothetical examples. 
14

A Bicameral Audit 

Example 1 -- Michigan US Senate Race: The state of Michigan has about 

5,800 precincts. Two candidates for US Senate split the vote 51% to 49%. If we 

multiply the 2% margin by 2.5, we see that on average, 5% or 290 of the 5,800 

precincts would be required to reverse the outcome. An audit of 1.6% (93 

precincts) would have a 99.19% chance of finding a corrupt precinct. 

However, by sorting all the precincts in the state by their reported vote counts, 

we find that 5% of the votes in this race were actually cast in only 3.6% of the 

precincts -- the 209 largest ones. This represents the highest concentration of 

miscounts for which we must search – the smallest number of precincts that 

could change the outcome of the race – the parameter we call PC. Using the 

hypergeometric distribution, we find that if there are 209 corrupt precincts, a 

2.2% audit will have a 99.14% chance of finding one. To confirm the outcome of 

this race, we will therefore audit 2.2% of the precincts in each county or a total of 

at least 128 precincts statewide instead of just the 93 precincts indicated above 

when precinct size was not taken into account. 

Example 2 -- US House Race: Now let’s compare the above to a race for US 

House of Representatives with the same 2% margin: Instead of 5,800 precincts, 

in the average Congressional District we would have only about 400 precincts 

serving about 400,000 registered voters. If we multiply the 2% margin by 2.5, we 

see that on average, 5%, or 20 of the 400 precincts would be required to reverse 

the outcome. By sorting all the precincts in the district, we find that 5% of the 

votes in this race were actually cast in only 3.75% of the precincts -- the 15 

largest ones. This represents the highest concentration of miscounts for which 

we must search – the smallest number of precincts that could change the 

outcome of the race or, PC. Using the hypergeometric distribution, we find that if 

there are 15 corrupt precincts, a 26% audit (104 precincts) will have a 99.01% 

chance of finding one. To confirm the outcome of this race, we will therefore audit 

104 precincts in this Congressional district. Had we not taken precinct size into 

account, we would have only audited 21% or 84 precincts, potentially allowing 

miscounts concentrated in larger precincts to go undetected. 

A random audit of 2.2% of these precincts, which was sufficient for the statewide 

race, would examine only 9 precincts in this Congressional district. If 3.75% of 

these precincts were corrupt, there would only be a 29.36% chance of finding 

one, which is not likely to trigger an additional audit. To reach the 99% level of 

certainty in this race required a random audit of 26%, or 104 precincts. 

Note that the only significant difference between the two races in the above 

examples was the number of precincts in each; the smaller number of precincts 

in the House race made the 2.2% audit almost useless. 
15

Our Random Auditing Protocol 

Taking all of the above parameters, analyses and examples into account, we 

have developed the following random auditing protocol. 

If there are enough corrupt precincts (or machines) to change the 

outcome of the race in question, the following auditing protocol will 

find at least one: 

1) Randomly audit an initial percentage of precincts (or voting systems) in 

each county (or equivalent jurisdiction) if required by law or regulation. If 

DREs are in use, pick individual machines rather than whole precincts as 

this will result in a better chance of finding miscounts than picking whole 

precincts. Compare hand-to-eye counts of all paper ballots or records to 

the corresponding electronic machine or scanner totals for each race. 

These totals should be exactly the same (within one in 500,000 votes per 

HAVA standards) after any explainable discrepancies are taken into 

account. (Some examples of explainable discrepancies are: stray marks 

on optical scan ballots; DRE VVPAT printers jamming or running out of 

paper.) The following additional steps should be taken for each race to be 

audited. 

2) Calculate the margin (reported vote difference between the two leading 

candidates). 

3) Multiply the margin from Step 2 by 2.5. We will use this number of votes 

to calculate the minimum number of corrupt precincts (or machines) that 

could alter the outcome of the race -- assuming that in each precinct (or 

machine), 20% of the votes have been switched from the reported loser to 

the reported winner, which could erase as much as a 40% margin. 

4) Sort all precincts (or machines) in the race by the total votes cast in the 

race in each precinct (or machine). Count the number of precincts (or 

machines) needed (starting with the one with the largest vote count) to 

equal or exceed the number of votes from Step 3 above (i.e., 2.5 times the 

margin). This gives us the minimum number of corrupt precincts (or 

machines) that could reverse the outcome of the race. 

5) Use the hypergeometric distribution to find the sample size needed to 

have 99% confidence of sampling at least one corrupt precinct (or 

machine), given the number of precincts (or machines) from Step 4 above 

and the total number of precincts (or machines) in the race (use this 

spreadsheet to find the appropriate sample size: 

http://www.votersunite.org/info/AuditEffectivenessCalculator.xls). 

6) Calculate the percentage of total precincts (or machines) applicable to 
16

this race represented by the result from Step 5. 

7) If the percentage from Step 1 equals or exceeds the percentage from 

Step 6, go to Step 8. If the percentage from Sept 1 is less than the 

percentage from Step 6, add precincts (or machines) randomly to at least 

equal the percentage from Step 6 for each race (always round up to obtain 

a whole number of precincts (or machines) in each jurisdiction). Audit the 

percentage of precincts (or machines) from Step 6 randomly in each 

county (or equivalent jurisdiction). 

8) In addition, candidates should be allowed to audit a few precincts (or 

machines) of their choice, which they may consider to be suspect based 

on historical election data, pre-election polls, reports of malfunctions, etc., 

particularly if there are enough of these to affect the outcome of the race. 

9) Any unexplained discrepancies between manual and electronic tallies 

must trigger additional auditing or full recounts. A reiteration of the auditing 

process starting with Step 4 above using the remaining unaudited 

precincts (or machines) should be used to determine if there are additional 

corrupt precincts (or machines). Any time a corrupt precinct or machine is 

found, this step should be repeated until the outcome is certain, up to and 

including a full manual recount. 

Conclusion 

Auditing protocols proposed and implemented at the federal and state levels that 

rely on small-percentage random sampling without replacement are unlikely to 

detect miscounts sufficient to change the outcome of Congressional or smaller 

local races, even if such races initially appear to be decided by relatively wide 

margins. In states with small populations that do not have thousands of precincts 

or voting systems, this problem exists even for statewide races. 

This does not mean that such legislation or auditing should be discouraged, but 

rather, that the limitations of such audits must be acknowledged by those who 

promote them so as not to engender a false sense of security. 

Routine methods of error and fraud detection must be developed and employed 

to supplement small-percentage audits, particularly when there is no obvious 

trigger for additional auditing or full recounts. We think the above protocol is a 

good example. 

We will discuss other comprehensive methods in a future report, but the protocol 

proposed herein will detect miscounts sufficient to change the outcome of almost 

any race and is generally much more efficient than a full recount, which may be 

difficult and/or expensive to obtain. Full recounts should of course be conducted 

to verify the outcome of any race too close to be confirmed by an audit.