(1) At least 45 days prior to a primary or election, the secretary of state may call for a risk-limiting audit of an office that files with the secretary of state and/or a state measure. The secretary of state shall determine the date and time of the risk-limiting audit.

(2) No later than 30 days prior to the primary or election, the secretary of state will establish and publish the risk limit(s) that will apply in risk-limiting audits for that election. The secretary of state may establish different risk limits for ballot comparison audits and ballot polling audits, and for audits of federal, state, and county contests. In ballot comparison audits, the risk limit will not exceed five percent for federal and state contests, and 10 percent for county contests.

(3) Counties involved in the audit must maintain an accurate ballot manifest in a form approved by the secretary of state and independent of the voting system.

(4) For a ballot comparison audit, counties must verify that the number of individual cast vote records in its cast vote record export equals the aggregate number of ballot cards reflected in the county's ballot manifest at the time the unofficial results are produced.

(5) Counties must maintain and document uninterrupted chain-of-custody for each ballot storage container.

(6) No later than 5:00 p.m. on the day prior to the risk-limiting audit, each county must pause or finish tabulating all ballots cast by voters registered in the county received and ready for counting, and submit as directed by the secretary of state:

(a) The verified ballot manifest; and

(b) Either:

(i) The verified cast vote record export, if conducting a ballot comparison audit; or

(ii) The unofficial results report, showing overvotes, undervotes, and the number of valid write-in votes, if conducting a ballot polling audit.

The secretary of state may direct counties to submit additional materials as required to conduct the risk-limiting audit.

(7) No later than 5:00 p.m. on the Friday after election day, the secretary of state will create a list of potential statewide contests using the criteria in (a) through (e) of this subsection, and then select by lot a statewide contest from that list. The secretary of state will also create for each county a list of potential contests wholly contained within that county using the criteria in (a) through (e) of this subsection and select a contest by lot for each county from that list. These will be considered the target contests for the risk-limiting audit. The secretary of state will publish online a complete list of all target contests.

The secretary of state will consider at least the following factors in selecting the potential target contests:

(a) Contests that contain two or more positions/candidates;

(b) The geographical scope of the contests;

(c) The number of ballots counted in the contests;

(d) The closeness of the reported tabulation outcome of the contests; and

(e) The ability of the county staff to complete the audit before the canvass deadline.

(8) The county auditor may choose to conduct a risk-limiting audit of the county contest selected in subsection (7) of this section or use another audit method listed in RCW 29A.60.185 to satisfy the audit requirement for their county.

(9) No later than 5:00 p.m. on the Friday after election day, the secretary of state will hold a public event to establish a random seed for use with the risk-limiting audit tool. The secretary of state will publish online the random seed after it is established.

(10) Copies of cast vote records used during the risk-limiting audit will be destroyed no later than 10 days following county certification.