Share this guide
Link copiedA voter-verified paper audit trail, or VVPAT, is a paper record of a voter's selections that is produced by a voting system and shown to the voter for review before the vote is finally cast. The paper record can later provide evidence for an audit or recount that does not depend only on the system's electronic records.
VVPAT is most closely associated with direct-recording electronic voting systems, or DREs. It should not be confused with every type of paper ballot or with any paper printout produced by election equipment.
Why was VVPAT developed?
A direct-recording electronic (DRE) voting machine records a voter's selections electronically.
A paperless DRE can leave no independent physical record to compare with its electronic total if a software or configuration problem occurs. VVPAT adds a human-readable paper record that the voter can inspect and election officials can preserve.
The central idea is simple: the electronic record and the independently preserved paper record can be compared rather than trusting one electronic record alone.
How does a VVPAT work?
1. The voter makes selections electronically
The voter uses a DRE or another compatible vote-capture interface to select candidates or answer ballot questions.
The system records those selections electronically.
2. The system produces a paper record
Before the vote is finally cast, the system prints a human-readable record showing the voter's selections.
3. The voter reviews the paper
The voter is given an opportunity to check whether the printed selections match what they intended to vote.
That review makes the record voter-verifiable. NIST guidance distinguishes this human-readable content from barcodes or other codes the voter cannot interpret.
4. The voter accepts or corrects the record
If the printed record is correct, the voter completes the casting process.
If it is incorrect, the applicable system and procedures provide a way to void or correct the affected voting session.
5. The paper record is preserved
In conventional VVPAT designs, the paper record remains secured with the voting system or election materials rather than becoming a take-home receipt.
Is a VVPAT the same as a paper ballot?
Not necessarily.
A paper ballot may itself be the primary record of the vote. A voter can mark it by hand or, in some systems, use a ballot-marking device to produce a paper ballot that is then scanned.
A classic VVPAT was developed largely as an independent paper record accompanying electronic vote capture, especially with DRE systems. A hand-marked paper ballot is not normally called a VVPAT, while modern paper-based systems can provide voter-verifiable records without using the term.
NIST explored broader VVPAT-capable architectures as early as 2006, but current federal standards increasingly use the wider concept of voter-verifiable paper records.
Is a VVPAT a receipt that the voter takes home?
No.
A VVPAT is an election record, not a voting receipt for the voter to keep.
The paper record is preserved with election materials for possible audit, recount or other authorised review; the voter verifies it but does not normally retain it.
How does a VVPAT help with election audits?
Election officials can manually examine VVPAT records and compare them with electronic totals or corresponding cast vote records.
A tabulation audit, for example, can compare votes found on voter-verifiable paper records with the totals originally reported by the electronic system.
A risk-limiting audit can also use trustworthy voter-verifiable paper records as the evidence for statistically checking whether the reported outcome is correct.
The paper record therefore does not automatically “audit” an election simply by existing. It has to be preserved, accounted for and examined through an appropriate post-election procedure.
Why is VVPAT connected to software independence?
Modern voting-system standards use the concept of software independence.
A voting system is software independent when an undetected software error or change cannot cause an undetectable change in the election outcome.
The Election Assistance Commission's Voluntary Voting System Guidelines Version 2.0, or VVSG 2.0, require systems certified to that standard to be software independent. The guidelines identify two architectural approaches: independent voter-verifiable paper records and approved cryptographic end-to-end verifiable systems.
Paper records allow an audit to examine evidence that does not depend entirely on the software producing the tally. VVPAT is one historical way of creating that evidence; software independence is the larger security objective.
Does VVSG 2.0 still require traditional VVPAT printers?
No.
VVSG 2.0 does not require the classic DRE-plus-VVPAT-printer arrangement. It permits paper-based and approved cryptographic end-to-end verifiable approaches to software independence.
The standard also requires accessible verification where a paper record is used. For example, when a voter uses audio access features to mark a ballot, the system must support verification of the actual voter-verifiable paper record rather than merely reading back an electronic copy of the selections.
A paperless DRE architecture that depends entirely on its software would not conform to VVSG 2.0's software-independence requirements. However, adoption of VVSG 2.0 does not automatically mean that every voting system previously certified under an earlier federal standard immediately loses its certification; federal and state transition rules apply.
What are the limits of a VVPAT?
A paper trail is not sufficient by itself. Its value depends on several things working correctly.
1. Voters need a meaningful opportunity to verify it
The record must clearly show the voter's selections, and the voting process should make it possible to identify and correct a problem before casting.
2. The record must be accessible
Paper can present challenges for voters who cannot visually inspect standard printed text. Current VVSG 2.0 requirements address this by requiring voting systems to support accessible verification of voter-verifiable paper records, including appropriate audio or other access features.
3. The records must be preserved securely
Storage, seals, access controls and chain of custody help ensure election officials can account for the records before an audit or recount.
4. An audit must use the voter-verifiable information
Machine-readable codes may help election systems process records, but a code the voter cannot interpret is not itself voter-verifiable. Independent checking should rely on the human-readable selections or another record the voter could actually verify.
5. Paper does not eliminate every election risk
A paper record provides independent evidence, but it does not replace voting-system testing, physical security, access controls, reconciliation or properly designed post-election audits.
How does VVPAT fit into the modern voting-system picture?
Paperless electronic voting relies heavily on electronic records.
DRE + VVPAT adds a voter-verified paper record that can be checked independently of the electronic tally.
Modern paper-based systems may instead use hand-marked paper ballots or machine-marked paper ballots that serve directly as voter-verifiable records.
VVSG 2.0 places the broader emphasis on evidence, auditability and software independence rather than requiring one particular VVPAT design.
Related ESG terms
- Voter-Verified Paper Audit Trail
- Voter-Verified Paper Trail
- Direct Recording Electronic (DRE) Voting Machine
- Paper Ballot
- Cast Vote Record
- Audit Trail
- Software Independence
- Tabulation Audit
- Risk-Limiting Audit
- Chain of Custody
Frequently asked questions
1. Does a VVPAT mean the voter receives a paper receipt?
No. The voter is given an opportunity to inspect the paper record, but in conventional VVPAT systems it remains part of the secured election records. It is not intended to be taken away as proof of how a person voted.
2. Is every voting system with a paper ballot a VVPAT system?
No. Hand-marked paper ballots and ballots produced by modern ballot-marking devices can provide voter-verifiable paper records without being described as traditional VVPAT systems. VVPAT is especially associated with paper records produced alongside electronic vote capture.
3. Does having a VVPAT automatically prove the electronic count is correct?
No. The paper record creates independent evidence, but election officials still need an audit or other authorised review to compare that evidence with reported electronic results. A paper trail that is never securely preserved or examined does not provide the same assurance as one used in a well-designed audit.
4. Can VVPAT records be used in a risk-limiting audit?
Potentially, yes, if the records are trustworthy, voter-verifiable and suitable under the jurisdiction's audit procedures. Risk-limiting audits rely on independently checkable paper records, but the exact records and methods permitted are determined by state law and the voting system in use.
Sources and further reading
- U.S. Election Assistance Commission — Voluntary Voting System Guidelines Version 2.0
- U.S. Election Assistance Commission — Voluntary Voting System Guidelines
- U.S. Election Assistance Commission — VVSG Migration
- U.S. Election Assistance Commission — End-to-End Protocol Evaluation Process
- National Institute of Standards and Technology — VVPAT Update for the VVSG 2005
- National Institute of Standards and Technology — Voting System Security Objectives
ESG editorial note: Election Security Glossary is an educational and reference resource. It is not an election authority and does not provide legal advice or official voting instructions. Voting-system requirements, audit rules and the legal status of paper records vary by jurisdiction; consult the relevant election authority for rules that apply to a specific election.