How to Audit a Vote After the Fact

Auditing a vote after the fact means one specific thing: reproducing the result from an immutable record, independently, without trusting the people who ran the vote. If you cannot recount the ballots yourself and arrive at the same total, you are not auditing. You are reviewing the operator's paperwork and hoping it is honest. That distinction is the whole game. Most "audits" of online votes are the second thing wearing the name of the first, which is why they convince nobody who was not already convinced.

I have sat through reviews that were really just the operator narrating their own logs. Everyone nods, nothing was actually verified, and the first serious challenge blows it apart. Here is what a real audit requires.

What does a real audit actually require

Three things: an immutable record of the ballots, an open method to count them, and independence between the auditor and the operator.

Immutable means the recorded ballots cannot have been changed after the fact, and you can prove it. If the operator could have edited the record between the vote and the audit, auditing the record tells you nothing. Open method means the counting logic is public, so the auditor runs the same count the operator did and can confirm it, rather than trusting a black box. Independence means the person checking does not have to believe the person being checked. An operator auditing themselves is the referee grading their own game, and it carries zero weight in a dispute.

Miss any one of these and the audit is theater. An immutable record you cannot recount is a locked box. An open count on an editable record is a clean count of whatever the operator last decided to store. Independence without a real record is just a second person trusting the operator.

Why can't you audit a black box

Because a black box only outputs a result, and a result is exactly the thing under dispute.

When the internal records are private and the counting code is secret, the only thing you can inspect is the number the system chose to emit. Auditing that is circular: you are checking the claim by consulting the entity that made the claim. There is no independent fact to compare against. No matter how thorough your review looks, you have verified nothing, because everything you examined came from the party you were supposed to be checking.

This is why "our internal audit confirmed the result" is not reassurance. Of course it did. The system was built by the same people, inspected by the same people, and reported by the same people. A real audit needs a fact that exists outside the operator's control, which is what an immutable public record provides and a black box specifically does not.

How do you recount from an immutable record

You take the published set of recorded ballots, apply the open counting method yourself, and check that your total matches the announced one.

In an end-to-end verifiable system, the ballots sit on a public bulletin board and the tally comes with a cryptographic proof. You verify the proof, which confirms the total follows from the board without needing to decrypt individual votes. Then you can go further: voters check that their own receipts appear on the board, confirming the board itself is complete and unaltered. When the board is complete and the count verifies, the result is proven, not asserted.

The power of this is that it is reproducible by anyone. Ten independent people run the recount, ten people get the same number, and the result stops being contestable on the count. Any tampering shows up as a receipt that is missing or a proof that fails to verify. Platforms like MintVote build the board and the verifiable tally into the system so this recount is possible by default, rather than something you have to beg the operator to allow.

What to do when there is no audit trail

If the vote already happened and there is no immutable record, the honest answer is that you cannot audit it. You can only review what the operator shows you, and that is worth what their word is worth. Do not dress that review up as an audit. Calling it one is exactly the claims discipline failure I warn against: saying "audited" when you mean "reviewed."

The real fix is upstream. Auditability is not something you add after a contested result. It is something you build into the vote before it opens, by recording ballots immutably and publishing the count method. Design the vote so the recount is possible from day one, and the audit takes care of itself the moment anyone asks. Skip that, and no amount of after-the-fact review will produce a result the losing side has to accept.