(1) If the county auditor chooses to conduct a post-election risk-limiting audit under RCW 29A.60.185, the auditor must use one of the types of audits listed in RCW 29A.60.185.

(2) At least 45 days prior to a primary or election, a county intending to conduct a risk-limiting audit must notify the secretary of state.

(3) After receiving notice from a county of the intent to conduct a risk-limiting audit and no later than 30 days prior to the primary or election, the secretary of state will establish and publish the risk limit(s) that will apply in risk-limiting audits for that election. The secretary of state may establish different risk limits for ballot comparison audits and ballot polling audits, and for audits of federal, state, and county contests. In ballot comparison audits, the risk limit will not exceed five percent for federal and state contests, and 10 percent for county contests.

(4) The county must maintain an accurate ballot manifest in a form approved by the secretary of state and independent of the voting system.

(5) Counties conducting a ballot comparison audit must verify that the number of individual cast vote records in its cast vote record export equals the aggregate number of ballot cards reflected in the county's ballot manifest at the time the unofficial results are produced.

(6) The county must maintain and document uninterrupted chain-of-custody for each ballot storage container.

(7) If no risk-limiting audit is called for by the secretary of state, the county auditor may choose the date and time of the risk-limiting audit, in coordination with the secretary of state, to begin no later than two days prior to county certification.

Each county conducting a county-level risk-limiting audit must submit as directed by the secretary of state:

(a) The verified ballot manifest; and

(b) Either:

(i) The verified cast vote record export, if conducting a ballot comparison audit; or

(ii) The unofficial results report, showing overvotes, undervotes and the number of valid write-in votes, if conducting a ballot polling audit.

The secretary of state may direct counties to submit additional materials as required to conduct the risk-limiting audit.

(8) If no statewide office appears on the ballot, no later than 5:00 p.m. on the Friday after election day, the county auditor will create a list of potential contests wholly contained within that county using the criteria in (a) through (e) of this subsection, and then randomly select a contest from that list. This will be considered the target contest for the risk-limiting audit. The county auditor will inform the secretary of state which contest has been chosen, and the secretary of state will publish online a complete list of all target contests.

The county auditor will consider at least the following factors in selecting the potential target contests: 

(a) Contests that contain two or more positions/candidates;

(b) The geographical scope of the contests;

(c) The number of ballots counted in the contests;

(d) The closeness of the reported tabulation outcome of the contests; and

(e) The ability of the county staff to complete the audit before the canvass deadline.

(9) In addition to the randomly selected contest(s) and in coordination with the secretary of state's office, counties may choose to conduct a risk-limiting audit of a shared district if all counties represented by the district agree to participate.

(10) No later than 5:00 p.m. on the Friday after election day, the secretary of state will hold a public event to establish a random seed for use with the risk-limiting audit tool. The secretary of state will publish online the random seed after it is established.

(11) Copies of cast vote records used during the risk-limiting audit will be destroyed no later than 10 days following county certification.