An audit file is what you hand over when a member says the election was not run properly. Its job is to answer the question without anyone having to rely on memory or goodwill. Assembled as you go, it costs nothing. Assembled after a challenge, it is usually incomplete, and the gaps are what the argument settles on.
There are five things a challenge asks about, in this order.
1Who was entitled to vote, and as of when
Keep the voter list exactly as it stood when voting opened, with the record date that produced it and the rule you applied, such as members in good standing on that date. If the list changed after it was first approved, keep the change with the reason and who approved it.
The common failure is an association that can produce today's membership list but not the one the election actually ran on. A list that has been edited since is not evidence of anything.
2How the candidates got onto the ballot
For each candidate: who nominated them and when, the seconder if your bylaws require one, the decision that they met the qualifications for that seat with the reason, and their recorded consent to stand. Keep the nominations you did not accept as well, with the reason each failed.
Nominations and candidate consent covers how to produce these as you go rather than reconstructing them.
3What members were told, and when
Keep the notice as sent, the date it went out, the method, and the list it went to. Add anything else members were told during the election: a reminder, a correction, an extension, a withdrawal announcement.
Where your documents set a notice period, this is what proves you met it. Where a member says they never heard about the election, this is the answer.
4What happened during voting
Two records, kept apart. Participation shows which members voted, which is what quorum and turnout are counted from. Ballots show the choices with no identity attached.
Also keep the operational facts: when voting opened and closed, any extension with the reason and the approval behind it, how voters were authenticated, and how the system prevented a second ballot from the same member. If voters got receipts, note what a receipt proves, which is that a ballot was accepted, not what was on it.
5How the result was produced and approved
Keep the tally for each seat, the method used, and for ranked contests the round-by-round figures. Add the totals that make the result checkable: ballots cast, quorum required, quorum reached. Then keep the approvals: who certified the result, who else approved it if your rules require two people, and when.
A result that nobody signed is a number in a spreadsheet. A result with two names and a timestamp is a decision the association made.
The audit file checklist
- The voter list as it stood when voting opened, with the record date and the eligibility rule.
- Every change to that list, with the reason and who approved it.
- For each candidate: nominator, seconder, qualification decision with reason, and recorded consent.
- Nominations that were not accepted, with the reason.
- The notice as sent, with date, method, and recipients.
- Every other communication to members during the election.
- Who participated, kept separate from the ballots themselves.
- Ballots stored without identity.
- Opening and closing times, and any extension with its approval.
- The tally for each seat, with rounds for ranked contests.
- Ballots cast, quorum required, quorum reached.
- Who certified the result, who approved it, and when.
- The retention date, so the file is not thrown away early or kept forever by accident.
In Ballot this file is a by-product rather than a project. Eligibility and the configuration are frozen when the election is scheduled, every approval takes two named people and is written to an append-only trail, and the certification report comes out as a PDF with the tallies and the record behind them. What the system does and does not protect is set out on the security page.
General guidance, not legal advice. Record-keeping and member inspection rights vary by state and by your governing documents, and some organizations have additional statutory obligations.