Izivote CMS

Vote Audit Trail: What to Record and How to Use It

Organizers checking voting records and totals

Written by

Joshua

in

A vote audit trail is the chain of evidence that lets anyone with the right access show how an online vote was run: who was allowed to vote, what the system did, how the votes were counted and whether the final totals match. Illinois election law defines it as a continuous trail of evidence linking the individual transactions involved in casting a vote, the vote count and the summary totals, without identifying the voter. This guide explains what a good trail contains, what to capture at each stage, where it can fail, and how to check a platform before you trust it with your awards, board election or student ballot.

Izivote
Run Awards With Clearer Voting
For fan and people’s choice awards, Izivote offers identity-based voting, real-time analytics, and a dashboard to monitor votes.

Get started

Key Takeaways

  • An audit trail links casting, counting and final totals, and it must do so without revealing how any individual voted.
  • Having records is not enough. A trustworthy result needs both the evidence trail and someone who actually checks it.
  • Capture records in three phases: setup before voting opens, activity while it is open, and certification after it closes.
  • Logs from outside systems, such as login or identity providers, can leak voter behavior even when the ballot itself is secret.
  • Before choosing a platform, ask whether logs are automatic, exportable in an open format, and reviewable by someone other than the vendor.

Table of Contents

What a voting audit trail actually is

People use “audit trail” for several different things, so it helps to separate them.

The audit trail. The definition above is the core idea. It connects three layers: the individual vote-casting transactions, the count and the summary totals. If you can walk from the totals down to the underlying events, and back up again, you have a trail.

The audit log. A voting system audit log is an electronic record of events relevant to assessing how the system and the election process performed. A study prepared for the California Secretary of State describes these logs as used to track operator actions and reconstruct election events for accountability. The log is one ingredient of the trail.

The voter-verified paper audit trail (VVPAT). This is the term that dominates search results, and it is narrower. A VVPAT is a physical record that voters can inspect before casting their ballot, so they can confirm their intent matches the electronic record, as described in a NIST addendum to the voting system standards. It was designed for polling-place machines. A fully online vote has no paper, so its trail has to be built from digital records instead.

Auditability versus auditing. Researchers writing in the Journal of Cybersecurity make a useful distinction: an evidence-based election needs auditability, meaning the creation of an evidence trail, and auditing, meaning the actual checking of that trail. A log nobody reads proves nothing. Plan who will review the records, and when, before voting opens.

Why it matters even for a fan award or school election

Statutes and standards on this topic are written for government elections, but the reasoning carries over. When a people’s choice award goes to the runner-up in the eyes of fans, or a student council result is disputed, the organizer needs to answer three questions quickly:

  1. Were only eligible people able to vote, and only as often as the rules allowed?
  2. Did anything unusual happen during the voting window?
  3. Do the published totals match what the system recorded?

The U.S. Election Assistance Commission has stressed that automated, system-generated audit records reduce the chance of errors from manually generated logs and make it easier to reconstruct election events. That matters for public confidence, and it matters when someone challenges a result. An organizer with a clean record can settle a complaint in an afternoon. An organizer without one is left defending a screenshot.

The stakes rise when money is involved. If votes are paid, the trail must also tie each counted vote to a processed payment, so that refunds, chargebacks and fees are explainable. We cover how paid and open voting differ in our guide to open versus paid voting.

What to record: before, during and after voting

The law’s wording gives a good checklist. Illinois requires the trail to include a log of machine activities and system status, covering both routine and unusual interventions by authorized or unauthorized individuals, and a record of each step from defining ballots through software installation, testing and tabulation. The California study adds that logs should capture the timing, sequence and system status of election phases, including ballot definition, readiness tests and voting operations.

Voting audit records across election phases

Translated to an online award, board election or school vote, that looks like this.

Before voting opens

This is the phase most organizers skip, and it is where disputes are won or lost. Keep:

  • The ballot definition. The final list of categories, nominees, descriptions and photos, with the date each was approved. If a nominee is added or removed later, that change should be recorded too.
  • The rules. Voting type (open, login, identity-based or paid), votes allowed per person per category, start and end times, and the eligibility list if there is one.
  • Configuration changes. Who changed what, and when. Any edit to settings after the page is published is exactly what a skeptic will ask about.
  • A test record. Evidence that you ran test votes, then cleared them, before going live. All test plans and results used to verify a voting system should be part of the public record under the Illinois statute, and a smaller organizer can borrow the habit by keeping a short written note of the test.

On our platform, the step that moves a page from draft to live is covered in the publishing and opening help page. Treat that moment as a checkpoint: screenshot or export your configuration before you click.

While voting is open

This is the live evidence stream. A useful trail captures:

  • Each accepted vote as a timestamped event tied to a category and nominee, without exposing the voter’s identity to the public.
  • Each rejected or flagged attempt, such as a duplicate vote, a failed login or a blocked repeat from the same source.
  • Payment events for paid voting: amount, status and the number of votes purchased.
  • System and administrator actions, including pausing voting, extending the deadline or editing a nominee profile.
  • Anomalies. A sudden spike of votes in a few minutes is not proof of fraud, but it is a reason to look. Live analytics help here because you can see the spike while it is happening rather than after the winners are announced.

Organizers using Izivote get real-time analytics and a dashboard to monitor votes as they arrive, so unusual patterns can be spotted during the voting window and investigated while the evidence is fresh.

After voting closes

Certification is the step that turns raw records into a result people accept. Keep:

  • The closing time, and proof that voting stopped when the rules said it would. Automatic vote closing removes the risk of a human forgetting, or being accused of leaving the door open for a favorite.
  • The final tally per category, exported before any adjustments.
  • A record of every adjustment, such as removing invalid votes, with the reason and who approved it.
  • The published result and the date it went public, so you can show the announcement matched the export.

For the public-facing side of this, see our piece on running transparent voting results.

How to use the trail: eligibility, irregularities and confirming results

Collecting records is half the job. Here is how organizers put them to work. These steps are practical routines drawn from the principles above rather than legal requirements, so a regulated body election should follow its own bylaws and counsel’s advice.

Verifying eligibility

Start from the rule, then test the log against it. If your vote is limited to members, students or ticket holders, compare the number of distinct verified voters against the size of the eligible list. A total that exceeds the eligible population is a red flag. If you used login or identity-based voting, the trail should show that each counted vote came through that gate. Our help page on voting types and voter identity explains the available modes, and our post on the enhanced voter identity experience shows how identity features change what you can see.

A stricter voting mode gives you a stronger eligibility record, at the cost of a little friction for voters. An open public vote gives you reach, and the trail then proves volume and timing rather than identity. Pick the mode that matches what you need to be able to prove.

Investigating irregularities

When someone alleges something went wrong, work in this order:

  1. Pin down the claim. Which category, which time window, what exactly is alleged?
  2. Pull the events for that window. Look at vote timing, rejected attempts and any administrator actions.
  3. Compare against the baseline. What did a normal hour look like earlier in the campaign?
  4. Check the configuration record. Did the rules change mid-vote?
  5. Write down what you found and what you did, even if the answer is “nothing unusual.” That note becomes part of the trail.

This is where automated records beat memory. Because system-generated records reduce the errors of hand-kept logs, as the EAC notes, you can rebuild events from the system rather than from recollections.

Confirming results

Reconcile three numbers: the sum of accepted vote events, the dashboard total, and the published figure. They should match. For paid voting, add a fourth: votes purchased against payments received, minus the platform fee. If you ever publish results to a skeptical audience, offer to show the reconciliation to an independent person, such as a board member, a teacher advisor or a sponsor’s representative. A result confirmed by someone outside the organizing team carries more weight than one confirmed by the people who ran it.

The broader principle, put by the Journal of Cybersecurity authors, is that officials must not only find the true winner but also give voters convincing, verifiable evidence that the outcome is correct.

Transparency without exposing how people voted

A good trail proves the process without unmasking voters. The Illinois definition builds this in: the trail links vote-casting transactions and documents ballot definition and system steps without allowing identification of the voter.

In practice, split your records into two tiers:

Record Who sees it Why
Final totals per category Public Lets everyone check the announced winner
Rules, dates and ballot definition Public or on request Shows the contest was run as described
Vote counts over time Organizer, optionally public Shows the race developing and exposes spikes
Payment and identity data Organizer only, minimal retention Needed for disputes, risky if widely shared
Administrator action log Organizer and reviewer Shows who changed what

Keep the personal data tier small, and delete it on a schedule you can state in advance. If you collect fewer personal details, you have fewer to leak.

If the form of your vote involves public leaderboards, remember that live public results are a transparency feature, and our platform shows them as a deliberate choice you can turn to your advantage. Visible, real-time counts discourage quiet manipulation because everyone can watch the same numbers.

Where audit trails break down

Trails fail in predictable ways, and knowing them helps you set realistic expectations.

Outside logs can reveal voter behavior. Researchers studying Estonian online voting showed that composition attacks can turn logs from external systems, such as national eID services, into metadata side channels that reveal voter behavior even when the voting system itself is secure. The same research notes that retained metadata, like timestamps of interactions, can undermine anonymity and coercion resistance even if the vote content stays secret. For you, the lesson is simple: every login provider, payment processor and analytics tool you connect keeps its own logs. Decide what each one records and for how long.

Digital records are not independent evidence. The IFES guide to risk-limiting audits says that if an online voting system does not produce an independent, voter-verifiable record of intent, risk-limiting audits are effectively impossible by definition. That is a high bar written for government elections, and an online award is a different kind of contest. But it is an honest reminder that an electronic log shows what the system says happened, not what each voter intended. Match your level of assurance to the stakes: a fan award can reasonably rely on strong logs and open totals, while a binding board election with legal consequences may need extra safeguards set out in its bylaws.

Closed log formats. The California study identifies as a significant weakness the lack of open, non-proprietary formats for audit logs, which hinders third-party analysis and public transparency. It found that most systems provide poor support for public analysis, often storing logs in undocumented, proprietary formats that raise barriers for observers. If you cannot export your records in a format a reviewer can open, your trail is only as strong as your trust in the vendor.

Records that exist but are never checked. The most common failure is the dullest one. Schedule the review, name the reviewer and put both in your rules before launch.

Where audit trails break down — overview diagram

Questions to ask before you choose a voting platform

Use this checklist with any provider, including us.

  1. Are records generated automatically? Manual logs invite gaps and disputes.
  2. Can you export them? Look for open formats such as CSV that an outside reviewer can open without special software.
  3. Does the system record configuration changes and administrator actions, not only votes?
  4. What voting modes are available? You want the option to match eligibility rules, whether open, login-based, identity-based or paid.
  5. How are duplicates and suspicious activity handled, and can you see the attempts that were blocked?
  6. What happens at closing? Automatic closing and a locked final tally beat manual shutdown.
  7. What does the payment flow record, and what is the fee? Paid voting should be reconcilable line by line.
  8. What personal data is stored, where, and for how long?
  9. Who else can review it? A platform that lets you share results and logs with an outside reviewer is easier to defend.

For a deeper look at what a document-level audit trail should contain, this overview of audit trail duties and contents is a helpful companion when you design your own record-keeping.

How Izivote supports a defensible vote

Izivote is built for public audience awards, people’s choice contests, student elections and community votes. For audit purposes, the features that matter are the ones that make a vote easy to run cleanly and easy to explain afterward:

  • Multiple voting modes: open, paid, login and identity-based, so the gate matches your eligibility rules.
  • Real-time analytics and a live dashboard, so you can watch counts and catch unusual patterns during voting.
  • Live public results, which let supporters see the same numbers you see.
  • Automatic vote closing, so the end time in your rules is the end time in practice.
  • Paid voting with payment handling, with a platform fee of 10% per vote, which makes the money side easy to reconcile.

You can start free. The Free plan has no published price, Pro is $6 per month or $60 per year, and Premium is $14 per month or $140 per year, all listed on the pricing page. If you run an awards program, the awards and competitions page shows how a setup looks, and you can create a vote for free to test the flow before your real campaign.

Izivote

For school settings, our student elections page and the school election setup guide cover the practical steps, and the people’s choice setup guide does the same for fan awards.

A simple audit-trail routine you can adopt this week

You do not need a compliance department. A one-page routine is enough for most community, school and fan contests:

  1. Before launch: write down the rules, dates and eligibility, run a test vote and note the result.
  2. At launch: export or screenshot the configuration.
  3. Daily during voting: glance at the dashboard and note any spike with a short comment.
  4. At close: confirm voting stopped at the stated time and export the final tally.
  5. Before announcing: reconcile totals, and for paid votes reconcile payments, then have a second person confirm.
  6. After announcing: store the records for a period you have decided in advance, then delete personal data.

That routine takes under an hour in total for most contests, and it turns “trust us” into “here is the evidence.”

FAQ

What is the difference between an audit trail and a VVPAT?

An audit trail is the whole chain of evidence linking vote-casting events, the count and the totals. A VVPAT is one specific component: a paper record a voter can check before their ballot is cast. Online-only votes have no paper, so they rely on digital logs and reconciliation instead.

Does an audit trail reveal who I voted for?

It should not. The standard definition links the transactions and system steps without identifying the voter. Be careful with connected services, though, because login, identity and payment tools keep their own logs that can expose metadata such as timing.

How long should I keep voting records?

Choose a retention period before voting starts, and write it in your rules. Keep the ballot definition, rules, final tally and a record of adjustments for as long as a dispute could reasonably arise, and delete personal data sooner. If your organization is governed by bylaws or a regulator, follow their retention requirements.

Do small events and school elections need an audit trail?

Yes, a light version. Any contest can be disputed, and a short record of the rules, the closing time and the final reconciliation settles most complaints. Scale the effort to the stakes.

Can a platform’s audit trail prove that every vote reflects what the voter intended?

Not by itself. A digital log shows what the system recorded, and without an independent record of voter intent that cannot be verified to the standard used in government audits. For fan awards and community votes, strong logs, live totals and an independent reviewer are a reasonable level of assurance.

Sources

Comments

Leave a Reply

Your email address will not be published. Required fields are marked *

More posts