  Card-level comparison risk-limiting audits (CLCAs) heretofore required a CVR
for each cast card and a "link" identifying which CVR is for which card --
which many voting systems cannot provide. Every set of CVRs that produces the
same aggregate results overstates contest margins by the same amount: they are
overstatement-net-equivalent (ONE). CLCAs can therefore use CVRs from the
voting system for any number of cards and ONE CVRs for the rest. Ballot-polling
RLAs are equivalent to CLCAs using ONE CVRs. CLCAs can be based on batch-level
results (e.g., precinct subtotals) by constructing ONE CVRs for each batch. In
contrast to batch-level comparison audits (BLCAs), this avoids tabulating
batches manually and works even when reporting batches do not correspond to
physically identifiable batches of cards. If the voting system can export
linked CVRs for only some ballot cards, auditors can still use CLCA by
constructing ONE CVRs for the rest of the cards from contest results or batch
subtotals. This obviates the need for "hybrid" audits. This works for every
social choice function for which there is a known RLA method, including IRV.
Sample sizes for BPA and ONEAudit using contest totals are comparable. ONEAudit
using batch subtotals has smaller sample sizes than ballot-polling when batches
are much more homogeneous than the election overall. Sample sizes can be much
smaller than for BLCA: A CLCA of the 2022 presidential election in California
at risk limit 5% using ONE CVRs for precinct-level results would sample ~70
ballots statewide, if the reported results are accurate, compared to about
26,700 for BLCA. The 2022 Georgia audit tabulated >231,000 cards versus ~1300
for ONEAudit. For data from a pilot hybrid RLA in Kalamazoo, MI, in 2018,
ONEAudit gives a risk of ~2%, substantially lower than the 3.7% measured risk
for SUITE, the method the pilot used.
