Online Election Change Control: A Practical Checklist

An online election change-control process is the written method for deciding who may alter a voter file, ballot, deadline, or system setting, and how that alteration is tested and recorded. It protects the election from a problem: a well-intended last-minute fix that changes more than anyone expected. This guide gives member-election administrators a workflow for making necessary changes without losing their evidence trail.

Why a small election change can create a large problem

Election teams rarely intend to make a risky change. A candidate's surname is misspelled, a member's email bounces, or a regional contest is missing from one ballot path. Each request may be reasonable. The risk lies in making it quickly, without defining the effect on voters, ballot secrecy, timing, and the record you may need later.

Consider a member association that discovers, two days before voting opens, that 37 eligible members were assigned to the wrong district. The fix is not simply an import. Someone must confirm ballot assignments, decide whether credentials change, and preserve the before-and-after files. When the vote is challenged, “we fixed it” is not an explanation. A dated request, approval, test result, and release record are.

Public-election systems use a more formal version of the same principle. The EAC engineering-change process requires review of even minor changes to certified systems. Member elections are not bound by that process, but the lesson travels well: classify the change before making it, then apply proportional controls.

Define what counts as a change before the calendar tightens

A useful policy covers more than the ballot screen. Include eligibility and voter-file changes; candidate and contest data; ballot wording; district logic; authentication; notices; voting times; integrations; reports; and accessibility-related content. A team that treats a new candidate PDF or revised login instruction as “just communications” can overlook a barrier in the voter journey.

Separate changes into three lanes. Routine corrections, such as a support-email update, may need one requester and one reviewer. Material pre-open changes, such as adding a candidate or revising selection logic, need an election officer’s approval and a targeted test. Live-election or outcome-sensitive changes, including a deadline extension or a ballot correction after voting starts, should go to the authority named in your rules and be communicated consistently to affected voters.

Do not confuse a platform's ability to make a change with permission to make it. Your bylaws, election rules, plan documents, and notices determine the decision authority. A managed online voting platform can carry out approved instructions, but it cannot replace the organization’s governance decision.

A seven-step election change-control workflow

Use the workflow below from configuration through certification. It is designed for unions, credit unions, pension funds, cooperatives, and associations. If you administer a public election, add the jurisdiction’s certification, procurement, and statutory requirements rather than treating this as a substitute for them.

1. Log the request. Record the requestor, time, component, outcome, and supporting source. Attach the roster, filing, resolution, or voter report.


2. Classify the impact. Ask whether it affects eligibility, ballot content, access, secrecy, accessibility, timing, or the count. Assign the decision-maker before anyone edits production data.


3. Freeze the baseline. Save the approved ballot, voter file, configuration, notices, and schedule. That baseline shows what changed and supports a rollback if testing finds a problem.


4. Obtain written approval. Show the approver the change, voter impact, test plan, and communication plan. For a material change, use two-person approval.


5. Test the affected path. Test more than the changed field. A district correction needs every affected test voter; a login change needs the full path from notice to confirmation, including keyboard and screen-reader use.


6. Release and communicate. Record the release time and version. Notify affected voters clearly and consistently, without disclosing ballot selections, credentials, or unnecessary personal information.


7. Preserve the evidence. Keep the request, approvals, baseline, test results, implementation log, communications, and final version in the election file. For union officer elections, the Department of Labor says election records, including votes, eligibility lists, credentials, logs, software code, encrypted ballot files, and tally results, must be retained for one year.

Make the decision record easy to review

The best change log is short enough to use during a busy afternoon and detailed enough to explain the decision six months later. It should not become a project-management exercise. The goal is traceability: what changed, why it changed, who approved it, how it was tested, and what voters were told.

Keep the log beside your broader election operations file, not in an individual administrator’s inbox. The same record helps your committee answer a candidate’s question, reconstruct a support event, and demonstrate that each voter was treated under the same approved rule.

Frequently Asked Questions

Can we change an online ballot after it has been approved?

Yes, if the change is authorized under your governing rules and passes the right review. Reopen the proofing cycle for the affected content, document why the change was necessary, and test every voter path it may affect. If voting has already begun, get the designated decision-maker involved before changing anything.

Who should approve an election configuration change?

Name the authority in advance. For a routine correction, that may be the election administrator and a second reviewer. Material or live-election changes should usually require the chief election officer, election committee, or other authority identified in the bylaws or election rules, with counsel involved when the rule is unclear.

What should we do if a ballot error is found after voting opens?

Preserve the facts first: capture the ballot version, affected voter group, timestamps, and any votes already cast. Escalate under the pre-set incident process, decide whether the error can be corrected without unequal treatment, then record the decision and communicate any needed action. Do not silently edit a live ballot and hope the issue disappears.

Are change logs required for every member election?

Your governing documents and applicable law determine formal requirements. Even where a detailed log is not expressly required, it is a sound administrative safeguard because it connects approvals, testing, voter communications, and the final audit file.

The Bottom Line

Election change control is not bureaucracy for its own sake. It is the discipline that keeps a correction from becoming a new dispute. Define the decision lanes before the rush, require independent review for material changes, test the full voter path, and retain the evidence with the final election record.

If your team is preparing an online member election and needs a reviewable process for voter files, ballot approvals, and last-minute exceptions, talk with Votem’s election team before you set the voter-notice date. A clear release gate is easier to build before ballots open than to reconstruct after a question is raised.