WSR 23-20-040
PERMANENT RULES
SECRETARY OF STATE
[Filed September 27, 2023, 11:24 a.m., effective October 28, 2023]
Effective Date of Rule: Thirty-one days after filing.
Purpose: Risk-limiting audit rule updates.
Citation of Rules Affected by this Order: Amending WAC 434-261-114, 434-261-115, and 434-261-116.
Statutory Authority for Adoption: RCW 29A.04.611.
Adopted under notice filed as WSR 23-17-126 on August 21, 2023.
Number of Sections Adopted in Order to Comply with Federal Statute: New 0, Amended 0, Repealed 0; Federal Rules or Standards: New 0, Amended 0, Repealed 0; or Recently Enacted State Statutes: New 0, Amended 0, Repealed 0.
Number of Sections Adopted at the Request of a Nongovernmental Entity: New 0, Amended 0, Repealed 0.
Number of Sections Adopted on the Agency's own Initiative: New 0, Amended 3, Repealed 0.
Number of Sections Adopted in Order to Clarify, Streamline, or Reform Agency Procedures: New 0, Amended 3, Repealed 0.
Number of Sections Adopted using Negotiated Rule Making: New 0, Amended 3, Repealed 0; Pilot Rule Making: New 0, Amended 0, Repealed 0; or Other Alternative Rule Making: New 0, Amended 0, Repealed 0.
Date Adopted: September 27, 2023.
Randy Bolerjack
Deputy Secretary of State
OTS-4838.1
AMENDATORY SECTION(Amending WSR 22-12-035, filed 5/25/22, effective 6/25/22)
WAC 434-261-114Definitions.
As used in this rule, unless stated otherwise:
(1) "Audit board" means a team of two people assigned to review voter choices on ballots selected for audit.
(2) "Ballot comparison audit" means a type of risk-limiting audit in which the audit board examines and reports voter markings for a designated contest (or contests) on randomly selected ballots, then compares them to the corresponding cast vote records until the audit results reflect with a strong amount of certainty that the reported tabulation outcome is correct.
(3) "Ballot manifest" means a document that indicates how the ballots are organized and stored, including identification of each batch of ballots by the voting system batch number, as well as the number of ballots in each batch.
(4) "Ballot polling audit" means a type of risk-limiting audit in which the audit board examines and reports voter markings for a designated contest on ballots selected randomly until the audit results reflect with a strong amount of certainty that the reported tabulation outcome is correct.
(5) "Cast vote record" or "CVR" means a record of all voter markings produced by a single voter on a ballot card, presented in electronic form, and is defined as a ballot in accordance with RCW 29A.04.008.
(6) "Random seed" means a number string consisting of at least 20 digits, with each digit selected in order by sequential rolls of a 10-sided die.
(7) "Reported tabulation outcome" means the presumed winning and losing candidates or voting choices of a ballot contest as reflected in preliminary results.
(((7)))(8) "Unofficial results" means the tabulation results produced by the voting system at a specific point in time that will be used for comparison during the audit process.
(((8)))(9) "Risk limit" means the largest statistical probability that an incorrect reported tabulation outcome is not detected in a risk-limiting audit.
(((9)))(10) "Risk-limiting audit" or "RLA" means a post-election audit of votes on paper ballots and voter-verifiable paper audit trail (VVPAT) records that makes use of statistical principles and methods, is designed to limit the risk of certifying an incorrect election outcome, and is conducted in accordance with RCW 29A.60.185.
(((10)))(11) "Risk-limiting audit tool" or "RLA tool" means the software and user interfaces provided by the secretary of state in order to conduct the risk-limiting audit.
(((11)))(12) "Target contest" means a contest selected by the secretary of state or county auditor for a risk-limiting audit that will determine whether the risk limit has been met.
OTS-4839.3
AMENDATORY SECTION(Amending WSR 22-12-035, filed 5/25/22, effective 6/25/22)
WAC 434-261-115((Post-election audits.))Risk-limiting audits for county races and measures.
(1) If the county auditor chooses to conduct a post-election risk-limiting audit under RCW 29A.60.185, the auditor must use one of the types of audits listed in RCW 29A.60.185.
(2) At least 45 days prior to a primary or election, a county intending to conduct a risk-limiting audit must notify the secretary of state.
(3) After receiving notice from a county of the intent to conduct a risk-limiting audit and no later than 30 days prior to the primary or election, the secretary of state will establish and publish the risk limit(s) that will apply in risk-limiting audits for that election. The secretary of state may establish different risk limits for ballot comparison audits and ballot polling audits, and for audits of federal, state, and county contests. In ballot comparison audits, the risk limit will not exceed five percent for federal and state contests, and 10 percent for county contests.
(4) The county must maintain an accurate ballot manifest in a form approved by the secretary of state and independent of the voting system.
(5) Counties conducting a ballot comparison audit must verify that the number of individual cast vote records in its cast vote record export equals the aggregate number of ballot cards reflected in the county's ballot manifest at the time the unofficial results are produced.
(6) The county must maintain and document uninterrupted chain-of-custody for each ballot storage container.
(7) If no risk-limiting audit is called for by the secretary of state, the county auditor may choose the date and time of the risk-limiting audit, in coordination with the secretary of state, to begin no later than two days prior to county certification.
Each county conducting a county-level risk-limiting audit must submit as directed by the secretary of state:
(a) The verified ballot manifest; and
(b) Either:
(i) The verified cast vote record export, if conducting a ballot comparison audit; or
(ii) The unofficial results report, showing overvotes, undervotes and the number of valid write-in votes, if conducting a ballot polling audit.
The secretary of state may direct counties to submit additional materials as required to conduct the risk-limiting audit.
(8) If no statewide office appears on the ballot, no later than 5:00 p.m. on the Friday after election day, the county auditor will create a list of potential contests wholly contained within that county using the criteria in (a) through (e) of this subsection, and then randomly select a contest from that list. This will be considered the target contest for the risk-limiting audit. The county auditor will inform the secretary of state which contest has been chosen, and the secretary of state will publish online a complete list of all target contests.
The county auditor will consider at least the following factors in selecting the potential target contests: 
(a) Contests that contain two or more positions/candidates;
(b) The geographical scope of the contests;
(c) The number of ballots counted in the contests;
(d) The closeness of the reported tabulation outcome of the contests; and
(e) The ability of the county staff to complete the audit before the canvass deadline.
(9) In addition to the randomly selected contest(s) and in coordination with the secretary of state's office, counties may choose to conduct a risk-limiting audit of a shared district if all counties represented by the district agree to participate.
(10) No later than 5:00 p.m. on the Friday after election day, the secretary of state will hold a public event to establish a random seed for use with the risk-limiting audit tool. The secretary of state will publish online the random seed after it is established.
(11) Copies of cast vote records used during the risk-limiting audit will be destroyed no later than 10 days following county certification.
OTS-4840.2
AMENDATORY SECTION(Amending WSR 22-12-035, filed 5/25/22, effective 6/25/22)
WAC 434-261-116((Preparing for a risk-limiting audit.))Risk-limiting audits for state races and measures.
(1) At least 45 days ((before))prior to a primary or election, ((a county intending to conduct a risk-limiting audit must notify the secretary of state. This notification must include information about the districts and offices to be included in)) the secretary of state may call for a risk-limiting audit of an office that files with the secretary of state and/or a state measure. The secretary of state shall determine the date and time of the risk-limiting audit.
(2) ((After receiving notice from a county of the intent to conduct a risk-limiting audit and))No later than 30 days ((before))prior to the primary or election, the secretary of state will establish and publish the risk limit(s) that will apply in risk-limiting audits for that election. The secretary of state may establish different risk limits for ballot comparison audits and ballot polling audits, and for audits of ((statewide))federal, state, and county contests. In ballot comparison audits, the risk limit will not exceed five percent for ((statewide))federal and state contests, and 10 percent for county contests.
(3) ((Observers are allowed in the same manner as RCW 29A.60.170 and WAC 434-261-020.
(4) The county))Counties involved in the audit must maintain an accurate ballot manifest in a form approved by the secretary of state and independent of the voting system.
(4) For a ballot comparison audit, counties must verify that the number of individual cast vote records in its cast vote record export equals the aggregate number of ballot cards reflected in the county's ballot manifest at the time the unofficial results are produced.
(5) ((The county must secure and maintain in sealed ballot containers all tabulated ballots in the batches and order they are scanned. The county))Counties must maintain and document uninterrupted chain-of-custody for each ballot storage container.
(6) No later than ((the sixth day after election day, the))5:00 p.m. on the day prior to the risk-limiting audit, each county must pause or finish tabulating all ballots cast by voters registered in the county received and ready for counting((. The results produced at this time constitute the unofficial results to be used in the risk-limiting audit. The county may, but is not required to, include in the unofficial results any provisional ballots that have been verified and accepted on or before the sixth day after election day. Immediately after producing the unofficial results, and to the extent permitted by its voting system, the county must also generate and preserve:
(a) An unofficial results report, showing overvotes, undervotes, and the number of valid write-in votes, if conducting a ballot polling audit; or
(b) A cast vote record export, if conducting a ballot comparison audit.
(7) Counties conducting a ballot comparison audit must verify that the number of individual cast vote records in its cast vote record export equals the aggregate number of ballot cards reflected in the county's ballot manifest at the time the unofficial results are produced.
(8) Copies of cast vote records used during the risk-limiting audit will be destroyed no later than 10 days following county certification.
(9) No later than 5:00 p.m. on the sixth day after election day, each county conducting a ballot comparison audit must submit as directed by the secretary of state:
(a) Its verified ballot manifest; and
(b) Its verified cast vote record export.
The secretary of state may direct counties to submit additional materials as required to conduct the risk-limiting audit.
(10) No later than 5:00 p.m. on the sixth day after election day, each county conducting a ballot polling audit must submit as directed by the secretary of state:
(a) Its verified ballot manifest; and
(b) Its unofficial results report, showing overvotes, undervotes, and the number of valid write-in votes.
The secretary of state may direct counties to submit additional materials as required to conduct the risk-limiting audit.
(11) The secretary of state will convene a public meeting on the seventh day after election day to establish a random seed for use with the risk-limiting audit tool's pseudorandom number generator.
The seed is a number consisting of at least 20 digits, and each digit will be selected in order by sequential rolls of a 10-sided die. The secretary of state will designate individuals to take turns rolling the die. The secretary of state will publish online the random seed after it is established.
(12))), and submit as directed by the secretary of state:
(a) The verified ballot manifest; and
(b) Either:
(i) The verified cast vote record export, if conducting a ballot comparison audit; or
(ii) The unofficial results report, showing overvotes, undervotes, and the number of valid write-in votes, if conducting a ballot polling audit.
The secretary of state may direct counties to submit additional materials as required to conduct the risk-limiting audit.
(7) No later than 5:00 p.m. on the Friday after election day, the secretary of state will create a list of potential statewide contests using the criteria in (a) through (e) of this subsection, and then select by lot a statewide contest from that list. The secretary of state will also create for each county a list of potential contests wholly contained within that county using the criteria in (a) through (e) of this subsection((,)) and select a contest by lot for each county from that list. These will be considered the target contests for the risk-limiting audit. The secretary of state will publish online a complete list of all target contests.
The secretary of state will consider at least the following factors in selecting the potential target contests:
(a) Contests that contain two or more positions/candidates;
(b) The geographical scope of the contests;
(c) The number of ballots counted in the contests;
(d) The closeness of the reported tabulation outcome of the contests; and
(e) The ability of the county staff to complete the audit before the canvass deadline.
(((13) In addition to the randomly selected contest(s) and in coordination with the secretary of state's office, counties may choose to conduct a risk-limiting audit of a congressional or legislative district if all counties represented by the district agree to participate.
(14) The risk-limiting audit tool will randomly select the individual ballots to audit. The risk-limiting audit tool will use a pseudorandom number generator with the seed established under this section to identify individual ballots as reflected in the county ballot manifests. No later than the seventh day after election day, the secretary of state will notify each county of the randomly selected ballots that each county must audit.))(8) The county auditor may choose to conduct a risk-limiting audit of the county contest selected in subsection (7) of this section or use another audit method listed in RCW 29A.60.185 to satisfy the audit requirement for their county.
(9) No later than 5:00 p.m. on the Friday after election day, the secretary of state will hold a public event to establish a random seed for use with the risk-limiting audit tool. The secretary of state will publish online the random seed after it is established.
(10) Copies of cast vote records used during the risk-limiting audit will be destroyed no later than 10 days following county certification.