What a Risk-Limiting Audit Actually Limits—and Why It Can End in a Full Hand Count

A public-interest guide to the statistical question, the paper evidence and the stopping rule. Sources checked October 29, 2026. All invented elections, tallies and audit observations below are explicitly hypothetical; none describes an actual discrepancy or allegation.

1. The dice roll is the beginning, not the conclusion

On May 29, 2026, Pennsylvania's Department of State began its risk-limiting audit of the May 19 primary. Its official announcement described a public dice roll to generate a twenty-digit number, followed by selection of ballot batches for hand tallying. The Republican lieutenant-governor contest was selected because it was the only contested statewide race. The department described the method as batch comparison: compare hand-counted votes in sampled batches with the voting system's reported counts. Pennsylvania's May 29 announcement.

That description contains several distinct claims. The selection process is public. The sampled objects are batches of paper ballots. People interpret the votes. Those counts are compared with previously reported numbers. None of those facts, taken alone, explains what makes the procedure risk-limiting. The missing ingredient is the rule connecting the evidence to a decision: stop with sufficient evidence, or keep examining ballots, potentially until every ballot in the contest has been counted by hand.

This distinction matters whenever a headline says an election was audited. Readers need to know which contest was examined, what evidence was inspected, and what the procedure was designed to establish. An audit can address a carefully defined question without addressing every other question people have about an election. Treating the word as an all-purpose guarantee weakens accountability; treating every limitation as proof of wrongdoing does the same thing in reverse.

The public does not need to reproduce every theorem to ask useful questions. It does need to distinguish the reported winner from the exact reported total, a random sample from a convenient selection, and a completed audit from the first round of one. It also needs to understand that the phrase “five percent risk limit” does not mean that five percent of ballots may be wrong or that there is a five percent probability the winner lost.

This article explains those distinctions through primary official documents and original, clearly fictional examples. It is not an audit of Pennsylvania's numerical results, an assessment of any candidate, or instructions for conducting an official election audit without appropriate expertise and authority. Its purpose is to make the evidence behind an assurance legible—and to show why a legitimate demand for more evidence need not be an accusation.

2. Audit and recount are not interchangeable—or opposites

The US Election Assistance Commission's practical guide describes a risk-limiting audit as a procedure that manually checks sampled ballots or voter-verifiable paper records until the evidence supports the reported outcome. Insufficient evidence can lead to a full manual count. The guide is dated June 25, 2018; its technical explanation remains useful, but its old implementation examples should not be mistaken for a current nationwide map of election law. EAC practical guide.

Legal terminology can add another distinction. Virginia's current published code defines an RLA before certification, with escalation to a full hand count when necessary. If that happens, the hand-count result is used for certification. The same section specifically distinguishes this full hand count from a recount under Virginia's separate recount chapter. This is a Virginia statutory distinction, not a universal definition imposed on every state. Virginia Code § 24.2-671.2.

For readers, a better starting question is therefore: what work was actually done? A count that examines every ballot answers a different evidentiary question from a small sample with no prescribed escalation rule. A machine retabulation differs from manual interpretation of paper records. An inspection of whether officials followed procedures differs from a statistical test of the reported outcome. The familiar labels cannot substitute for that operational description.

Imagine two fictional announcements. County North says it checked a fixed handful of precincts and found no discrepancy. County South says it used a specified statistical procedure that required either sufficient evidence for the outcome or an expanded hand examination. Both announcements describe checking. They do not describe the same assurance. The difference cannot be resolved by counting which announcement uses the word “audit” more often.

Nor does a full count mean the preceding statistical work failed. If the procedure reaches its prescribed full-count endpoint, it has taken the route available when a smaller examination does not establish enough. Whether that occurred because the margin was narrow, the evidence was discrepant, or some other specified condition arose requires examination of the record. The endpoint itself does not identify a cause or an intent.

The public should also resist a false choice between respecting election officials and examining their work. A well-defined procedure exists partly so that confidence does not depend solely on anyone's reputation. Asking for its scope, records and decision rule is consistent with institutional trust because it asks the institution to demonstrate the process it said it would use.

3. The risk limit is about a procedure's chance of missing a wrong outcome

In their primary statistical treatment, Amanda Glazer, Jacob Spertus and Philip Stark define risk conditionally: given trustworthy cast ballots and an incorrect reported outcome, it is the probability that the auditing procedure will fail to correct that outcome. An RLA bounds that risk by a chosen limit. The votes are treated as fixed but unknown; randomness comes from the audit's sampling. This is not a posterior probability assigned to the winner after seeing the audit. Glazer, Spertus and Stark.

A hypothetical five-percent limit therefore makes a statement about how the procedure behaves when the reported outcome is wrong, under the method's assumptions. It does not estimate how often election outcomes are wrong in the first place. It also does not say that any particular completed audit has a five-percent probability of being mistaken. Those are different probability questions, and answering one does not automatically answer the others.

A simple thought experiment helps. Imagine two collections of fictional contests. In one collection, almost every reported outcome agrees with a complete hand count. In the other, many do not. Apply the same properly implemented risk-limiting procedure to each. The guarantee controlling its chance of failing to correct a wrong outcome can be the same in both collections, even though the frequency of wrong outcomes in the collections is different. The risk limit alone does not reveal that frequency.

This is why translating the number into “ninety-five percent sure this winner won” is not a harmless simplification. It switches the question from the behavior of a procedure under a wrong-outcome condition to a probability about this particular outcome. A publication making the latter statement would need additional assumptions and analysis, not merely a subtraction from one hundred.

The limit also is not an error allowance. A five-percent risk limit does not permit five percent of ballots to be misinterpreted, and it does not mean officials stop investigating discrepancies below that percentage. The significance of a discrepancy depends on the audit method and the contest being tested. A disagreement that changes the margin deserves a different mathematical treatment from one that does not change it.

A responsible public explanation should state the limit and then translate it without changing its meaning. It should identify the procedure, the contest and the required evidence. The number is useful because it constrains a specified method; detached from that method, it becomes an impressive-looking percentage that readers can easily misunderstand.

4. Why the margin matters: a fictional hundred-thousand-ballot contest

Philip Stark's research on conservative audit p-values examines discrepancies in relation to the margins between apparent winners and losers. The framework also states an essential assumption: the audit trail must be an adequate record of the election. Confirming agreement with an incomplete or inaccurate record would not establish what readers expect. The paper's mathematical guarantees are not a way to dispense with that prerequisite. Stark's 2009 primary research.

Now consider an invented two-candidate contest with exactly one valid vote on each of 100,000 ballots. The reported totals are 51,000 for Candidate A and 49,000 for Candidate B, a margin of 2,000. These numbers are a teaching example, not data from a real election.

Suppose a single paper ballot marked for B was reported as a vote for A. Correcting that ballot subtracts one from A and adds one to B. The margin shrinks by two, not one. If exactly one hundred ballots had that same discrepancy and every other reported vote was correct, the corrected totals would be 50,900 and 49,100. A would still lead by 1,800.

Change the invented condition to 1,001 such ballots, with no other discrepancies. The corrected totals would be 49,999 for A and 50,001 for B. The winner would change. These calculations do not estimate a real discrepancy rate or explain an actual incident; they show why a tally disagreement and an outcome-changing disagreement are not interchangeable concepts.

The reverse direction matters too. If a ballot marked for A was reported for B, correcting it would increase A's margin by two. Other kinds of differences can affect the margin differently. Counting all discrepancies as identical misses the relationship between the evidence and the outcome being examined.

An audit sample does not tell the observer, by simple multiplication, that exactly the same pattern exists across the remaining ballots. The statistical method must address what conclusions can be drawn from its sampling design and observations. If an observer sees two discrepancies in a small sample, neither “therefore the winner is wrong” nor “therefore there are only two errors” follows.

This worked example also explains why percentages of ballots examined cannot be compared in isolation. The question is not whether one jurisdiction looked at a larger fraction than another. It is whether the applicable procedure obtained the evidence required for the contest, with its margin, sampling method and observed discrepancies. A large-looking sample without a valid inference rule can be less informative than its size suggests.

5. Three methods inspect different evidence

The original BRAVO research distinguishes comparison audits from ballot-polling audits. A comparison audit checks reported subtotals against hand interpretation of the corresponding paper ballots. A ballot-polling audit samples and interprets ballots to assess the outcome directly, rather than testing the accuracy of the reported subtotals. The paper describes a specific ballot-polling protocol, not a single formula that can be applied indiscriminately to every election. BRAVO primary paper and conference record.

The MINERVA research distinguishes three familiar categories: ballot polling, batch comparison and ballot-level comparison. Its discussion also makes clear that an audit method's implementation assumptions matter; its efficiency results are tied to its stated treatment of rounds. A favorable performance result cannot be detached from the procedure that produced it. MINERVA primary research.

For a fictional example, put 600 ballots in each of three labeled containers. A ballot-polling procedure could select particular ballots for manual interpretation and use those interpretations according to its outcome test. A ballot-level comparison could match a selected physical ballot to the voting system's corresponding interpretation. A batch comparison could select a container and compare the manual tally of the entire batch with its reported tally. These descriptions illustrate the unit being examined, not an instruction to use those container sizes or a claim that this tiny example satisfies a risk limit.

The distinction changes the records an observer should expect. A comparison requires something specific to compare: a reported interpretation or subtotal corresponding to the selected paper evidence. A polling procedure's central observation is instead the sampled ballot's interpretation within its statistical test. Asking for the wrong kind of record can lead an observer to imagine that an essential step is missing when the method simply works differently.

Here is an original reading aid for the example:

The table is deliberately not a ranking. A method must fit the available evidence, the voting rule and the operational setting. Choosing the smallest-looking sample from a research paper without its prerequisites would not establish an efficient audit; it would establish that the reader omitted part of the method.

6. A random seed does not repair an incomplete manifest

Pennsylvania's official 2026 primary process page identifies two inputs: a ballot manifest describing numbers and storage organization, and candidate totals by batch. It records the public seed-generation step and lists the counties selected for retrieval and hand tallying. These are visible pieces of the process record. The page does not make the dice roll a substitute for the underlying inventory of ballots. Pennsylvania's 2026 primary audit process record.

Imagine a fictional manifest with Box 1 containing 600 ballots, Box 2 containing 600, and Box 3 containing 600. If the software selects a location described as Box 2, ballot 247, the authorized team needs a reproducible way to retrieve that physical record. If the manifest actually lists the wrong number or the label points to the wrong container, generating a highly visible random number does not resolve the discrepancy.

This is a distinction between randomness and coverage. A selection can be random with respect to the supplied list while the supplied list is incomplete. The guarantee of an audit therefore cannot be understood solely by watching the randomization ceremony. The relevant procedure must connect the population it claims to examine with the paper evidence from which the sample is drawn.

The SHANGRLA research illustrates how seriously this connection is treated. It describes ballot-level comparison in terms of corresponding cast-vote records and retrievable physical ballots, and provides formal approaches to missing records within its framework. Missing evidence is not simply waved away because the rest of the sample looked satisfactory. Any treatment has to preserve the statistical guarantee under its stated assumptions. SHANGRLA primary research.

For a public observer, the useful response to a missing selected item is a question about the prescribed procedure: how was the item recorded, what treatment does the method require, and where is that treatment reflected in the result? The observer should not invent a cause. An unexplained discrepancy needs explanation; it is not, by itself, proof of substitution, fraud or a changed winner.

This article stops short of a full chain-of-custody tutorial. The narrower point is mathematical: a sampling claim depends on what can be sampled and how missing or mismatched evidence is handled. A public seed, a manifest and a retrieval record play different roles. An intelligible audit report should let a reader follow those roles without pretending that one attractive part of the process establishes all the others.

7. A worked stopping calculation—not a real election result

BRAVO's simple two-candidate formulation uses a sequential test statistic. A sampled vote for the reported winner multiplies it by the reported winner's share divided by one-half; a vote for the other candidate uses the complementary share divided by one-half. Sampling is with replacement. The stopping threshold is the reciprocal of the risk limit, with a full-count endpoint also specified. BRAVO, section 6.

The following calculation is an original hypothetical application of that formulation, not a reconstruction of Pennsylvania's different, batch-comparison procedure. Take a separate fictional two-candidate contest with a reported 60–40 split, one valid vote per ballot, and a five-percent risk limit. Assume all prerequisites of the illustrated method hold and a full-count cap is set beyond the small sequence below. This is a teaching calculation, not a complete implementation suitable for official use.

Start the statistic at one. The multipliers are 0.60 divided by 0.50, or 1.2, for A, and 0.40 divided by 0.50, or 0.8, for B. The stopping threshold is one divided by 0.05, or twenty. After observing a sampled votes for A and b for B, the statistic in this example is 1.2^a × 0.8^b.

Choose an invented sequence of sixteen A observations, eleven B observations, then fourteen A observations. This deliberately constructed sequence is not presented as a typical sample. At observation twenty, sixteen A and four B observations give approximately 7.573, below twenty. The statistic has not crossed the threshold earlier. At observation forty-one, thirty A and eleven B observations give approximately 20.390, crossing it for the first time. These arithmetic values and the first-crossing position were calculated and checked in a small script for this article's example.

For comparison, a different invented twenty-draw sample containing ten observations for each candidate would produce 1.2^10 × 0.8^10, approximately 0.665. Equal numbers do not return the statistic to one because multiplying by 1.2 and then by 0.8 produces 0.96, not one. This calculation explains why the multipliers cannot be interpreted as simple plus-one and minus-one scores. The sample is providing evidence about the stated comparison, not awarding points to candidates. The smaller value still is not a probability that A won, a percentage of inaccurate ballots, or proof that anyone changed a vote. It tells the procedure that this particular stopping threshold has not been reached.

Two lessons are visible. First, the same reported winner can lead the sample while the specified evidence threshold has not yet been met. Second, the statistic can fall as contrary observations arrive and rise as supporting observations arrive. It is not a progress bar that advances automatically whenever another ballot is examined.

Because this formulation samples with replacement, an observation is a draw, not necessarily a previously unseen physical ballot. A repeated selection contributes to the sample according to the method; it does not add another vote to the election's actual tally. Confusing those two counts would turn a normal feature of the statistical design into a false allegation about double-counting votes.

Nothing here says that forty-one draws are sufficient for another contest. The reported share, actual observations, sampling method, invalid-vote treatment and voting rule matter. The example is valuable precisely because its assumptions and arithmetic are visible. Remove those assumptions and the number forty-one loses its claimed meaning.

8. The rule must survive the way the work is organized

Real audit work can be organized into rounds rather than one continuously updated calculation. MINERVA's authors explicitly discuss the difference between ballot-by-ballot and end-of-round treatment and state assumptions for their proposed procedure, including predetermined round sizes for the proof they present. That is a methodological condition, not a detail to omit when borrowing a favorable efficiency claim. MINERVA's assumptions and stopping-rule analysis.

Consider two fictional teams using identical paper observations. One follows a specified sequential rule. The other looks repeatedly at whichever summary is most favorable, changes its criterion after seeing the data and stops when the presentation looks reassuring. Identical observations do not make those procedures statistically equivalent. A guarantee belongs to the complete procedure, including how it decides to stop, not merely to a collection of numbers that appeared along the way.

This is not an argument against organizing staff efficiently. It is an argument for choosing an appropriate method before treating its output as an assurance. A team can prefer larger rounds to reduce retrieval overhead, but the resulting procedure must still be one for which the claimed risk limit is established. The administrative convenience and the mathematical claim need to refer to the same process.

A public report can make that relationship visible without printing every intermediate calculation. It can identify the method and version, the planned treatment of rounds, the observations supplied to it, and the condition that ended the audit. If there was a change, the record can explain whether the change was permitted by the method or required a different analysis. “The software said complete” is not a substitute for those facts.

In the worked example above, the first crossing was calculated under the stated ballot-by-ballot rule. Someone applying an end-of-round method should not copy that stopping position without checking the method's requirements. Similarly, a software implementation should not be judged solely by whether it reproduces one favorable demonstration. Edge conditions, input interpretation and the chosen procedure all matter.

The practical public-interest question is therefore specific: was the announced decision rule the rule actually followed? That question can be answered with records. A vague argument over whether a sample “feels large enough” cannot establish the same thing, however sincerely the participants hold their opinions.

9. Independent evidence is not the same as a second machine

Ronald Rivest and John Wack's foundational paper defines software independence in terms of an undetected software error or change being unable to cause an undetectable change in the election outcome. Its discussion distinguishes detecting a problem from having records that permit recovery. This is a design concept about evidence, not a declaration that any device labeled independent automatically establishes a correct result. Rivest and Wack's primary paper.

An intuitive but incomplete response to uncertainty is to run the records through another machine. Agreement may be useful, but the reader still needs to know what was independently checked. If two outputs rest on the same unexamined interpretation, their agreement does not itself explain whether that interpretation corresponds to the paper evidence.

Philip Stark's analysis of machine-assisted audits describes a more specific approach: verify that the secondary system's cast-vote records reproduce its totals, and then manually check correspondence between those records and the physical ballots. In that account, the secondary tabulation is not simply trusted; its relationship to the evidence is tested. Retabulations, Machine-Assisted Audits, and Election Verification.

Imagine a fictional record labeled R-247. The secondary system says it represents a ballot for A. A human reviewer retrieves the corresponding paper ballot and interprets it as B. That observation is meaningful because the procedure identifies the record, the physical object and the comparison. A second spreadsheet merely repeating A would not resolve the disagreement. Nor would the disagreement by itself reveal whether its cause was a matching error, an interpretation issue or some other problem.

The example also shows why an image and a paper ballot should not be casually treated as the same evidentiary object. The audit description should say what was inspected and how it relates to the record whose accuracy is being tested. If the method relies on a particular correspondence, the report should document that correspondence rather than leave the reader to assume it.

None of this requires the public to distrust every machine. Machines can organize records, select samples and assist verification. The question is which claims depend on trusting which outputs, and where independent examination supplies the promised check. That dependency analysis is more informative than a contest between blanket faith in automation and blanket rejection of it.

For the same reason, an equipment certification and an election audit should not be merged into one claim. This article is not evaluating any voting system's certification. It is explaining why a statement about an election outcome needs evidence connected to that election's records, whatever assurances exist about the equipment used.

10. Read the Pennsylvania example as a bounded process record

Pennsylvania's official overview describes two separate post-election checks: its statistical recount and its statewide RLA. The agency says both occur before certification. The numerical sampling rule for the former should not be mistaken for the risk limit of the latter. They are separately described procedures with different roles. This account is Pennsylvania-specific, not a claim that every jurisdiction uses the same combination. Pennsylvania's audit overview.

The 2026 primary process page provides a useful reading exercise because it separates inputs, selection, retrieval, hand tallying and reporting. It also links detailed final data. For this article, the process page and announcement were read, but the linked CSV was not independently parsed or its numerical calculations reproduced. Consequently, no aggregate sample size, discrepancy rate or achieved-risk figure is asserted here. A link to data is not the same thing as checking the data.

What can a reader responsibly extract from the process page? The identity of the selected contest, the described batch-comparison workflow, the listed selection event and the agency's presentation of completed steps. What remains a separate task? Reconciling the detailed data to the stated method and reproducing the calculations where appropriate. Keeping those tasks separate prevents an accessible summary page from being credited with work the reader has not performed.

Imagine an independent reviewer assembling a worksheet from that public record. Its first column records the claim: a particular contest was selected. Its second gives the supporting official page. Its third records the scope: one selected contest, not every race on every ballot. Another row records that a seed was generated publicly, while its scope column explains that public generation is one part of the sampling process, not proof of the completeness of all inputs.

A final row can record that detailed results are linked, while marking arithmetic reproduction as unfinished. That is a legitimate partial review. It is more useful than either presenting the official announcement as independently verified mathematics or refusing to acknowledge the documented process because every calculation has not yet been checked.

The same discipline should apply to criticism. A person who identifies a specific mismatch between a published input and an output has supplied something that can be investigated. A person who sees an unfamiliar statistical term and concludes that the process is deceptive has not yet supplied evidence of that conclusion. Scrutiny becomes stronger when it names the record and the exact inference being questioned.

The Pennsylvania example is therefore not used here to award a universal accuracy score. It demonstrates how a reader can distinguish documented procedure, official completion statements and independent numerical verification. Those are related forms of evidence, but they are not interchangeable.

11. Escalation needs a real endpoint

Virginia's 2024 manual describes additional rounds when the risk limit has not been met and explains escalation to a full hand count. It is a dated operational document, useful for seeing how a stopping rule connects to instructions for people retrieving and interpreting ballots. It should not be treated as proof that every detail of a state's practice remains unchanged indefinitely. Virginia's 2024 RLA manual.

The current published Virginia statute supplies a separate, important piece of evidence: if the RLA escalates to a full hand count, that count's result is used for certification instead of the earlier unofficial tabulation. The statistical procedure is connected to an outcome-changing consequence, not merely a report that could be ignored while the earlier result remained untouched. Again, this is the text of Virginia's provision, not legal advice about another jurisdiction. Virginia's escalation provision.

Consider a fictional audit plan that promises to inspect more ballots if needed but allocates neither time nor authority for any expansion. Its initial sample might be perfectly drawn. Nevertheless, the plan has left a crucial practical question unanswered: what happens if the initial evidence does not meet the rule? A risk limit is not fulfilled by promising a next step that the process cannot actually take.

An observer can ask about this without predicting failure. Which authority orders the next round? How does the schedule accommodate it? What record tells participants that the evidence threshold has or has not been met? If the procedure reaches a full count, how is that count incorporated into the legally relevant result? These questions connect the mathematics to the institutional decision it is supposed to support.

The relationship also works in the other direction. A deadline is not a statistical result. A report should not say the evidence threshold was reached simply because the scheduled session ended. If work pauses for operational reasons, the status should identify what remains to be done. Whether a jurisdiction has a lawful means of extending or adjusting its schedule must be established from its own current rules.

This is an area where a national explainer must resist overreach. States can use different legal terms, selection rules and administrative arrangements. The appropriate general principle is to inspect the connection between the audit's promised guarantee and the authorized consequence of its findings. The specific legal route belongs to the jurisdiction and should be checked against its current primary documents.

12. Spot a contradiction in a fictional audit packet

Suppose a fictional public packet contains the following entries. They are invented solely to illustrate document review, not taken from any actual election:

Assume for the example that the listed value is the method's valid stopping p-value and that its rule requires a value no greater than the risk limit. The first contradiction is arithmetic: 0.073 exceeds 0.05. The packet has not shown that this stopping condition was satisfied. The second is scope: the identified contest is one municipal contest, while the summary makes a claim about all results. Neither contradiction requires guessing anyone's motive.

A useful correction would not simply change the summary to another reassuring phrase. It would identify the actual status and supply any missing evidence. Perhaps an additional round occurred but its record was omitted. Perhaps the summary was premature. Perhaps the value was transcribed incorrectly. Those possibilities require different corrections, and the example does not select one without evidence.

If a later fictional record supplies a valid final stopping p-value of 0.031 under the same properly followed procedure, that would satisfy the stated numerical threshold. It would not mean the reported winner had a 3.1-percent probability of losing. Nor would it extend the audit to contests outside its scope. The logical work is to reconcile the specific records, not convert every new number into a new headline about confidence.

The example deliberately assumes the p-value is valid. A real reviewer would also need to know that the input records, sampling and calculation complied with the specified method. Finding that 0.031 is less than 0.05 checks a comparison; it does not independently verify all the mathematics or all the underlying evidence. This separation prevents a modest arithmetic check from being advertised as a complete audit reproduction.

The most constructive public question is therefore concrete: which document supports the completion claim, and does its scope and result match the summary? A precise inconsistency can be corrected or investigated. An insinuation built around an unexplained number cannot do the same evidentiary work.

13. What this audit cannot settle

The EAC's practical guide expressly notes that an RLA does not audit every part of election administration, giving voter registration and ballot programming as examples. Its target is the outcome supported by the relevant paper evidence, not a universal judgment about every institution, policy or event surrounding an election. These limits should accompany the assurance rather than appear only after someone challenges it. EAC guide, scope limitations.

A person might have a legitimate question about access to voting, a registration decision, a campaign claim or an administrative procedure. A completed RLA does not automatically answer it. Conversely, a dispute about one of those subjects does not automatically overturn the audit's bounded finding about the contest it examined. The claims must be evaluated with evidence appropriate to their different questions.

Source dates matter here too. The EAC's broad audit overview appears on a page dated December 2025, but its linked report discusses 2021 legislation and uses older state information. The document is useful for understanding audit categories; it is not a shortcut to a verified October 2026 count of states using a particular method. A recently presented page can carry older substantive material. EAC overview and linked report.

That is one reason this article avoids a league table of jurisdictions. Such a table would require checking current laws, rules and implementation records state by state. It would also need to distinguish legal authorization, pilot activity and actual use. Collapsing those into one count would create a false impression of precision rather than help readers understand the procedure.

The same care applies to motives. A discrepancy can warrant investigation without proving fraud. An expanded sample can be the expected response to insufficient evidence rather than evidence of a cover-up. A completed audit can support a narrow outcome claim without declaring that no error of any kind occurred. These distinctions leave room for scrutiny while preventing uncertainty from being turned into an unsupported allegation.

The strongest public explanation of an RLA ultimately answers four questions. What outcome was tested? What paper evidence and sampling method supported the test? What rule determined whether to stop or continue? What happened when that rule was applied? The answer should identify the records, the conditions and any remaining limitations—not merely repeat that experts are confident or that skeptics are unconvinced.

A risk-limiting audit is useful because it makes a particular assurance testable. Its credibility does not come from the size of a ceremony, the familiarity of a machine or the force of a slogan. It comes from connecting trustworthy evidence to a defined procedure and following that procedure through to its justified endpoint. Understanding that connection is a practical way to demand more evidence without claiming more than the evidence can show.