1. The word certified needs an object
A voting system is certified. A laboratory is accredited. A delivery passes an acceptance check. A test of a particular election’s setup produces the expected results. These statements may all belong in a sound account of election preparation, but they are not synonyms. Each concerns a different object, a different decision and a different body of evidence.
The distinction matters whenever someone tries to make one certificate answer every question. A certification record can be meaningful without proving that a particular delivery arrived in working condition, that the correct ballot definition was loaded, or that a completed election produced the right outcome. Equally, the existence of additional administrative responsibilities does not make certification meaningless. A bounded finding is not a worthless finding simply because other findings are also necessary.
The EAC’s currently linked Voting System Testing and Certification Program Manual is version 3.0. Its section 5.6 ties a Certificate of Conformance to a particular VVSG version and the specific configurations identified, submitted and evaluated. The manual also separates EAC conformity assessment from state responsibilities. It does not turn a product-family name into unlimited approval of every combination carrying that name. EAC certification program manual, version 3.0
A useful question is therefore not simply whether a system has a certificate. It is which claim the document supports, and whether the equipment or activity under discussion falls within that claim. Readers need enough specificity to connect an approval record with the thing being described. Without that connection, a true statement about one version can become a misleading statement about another.
This article uses an original fictional exercise called Alder Test Records to make the distinction concrete. Alder is not an election jurisdiction, manufacturer, laboratory or actual voting product. Its component labels, configurations, delivery quantities, test inputs and results are invented. No election system was accessed or tested for this article. The examples examine how to read evidence, not how to install, modify or operate voting equipment.
One real certificate is discussed only to demonstrate how an official record names its scope. None of Alder’s mismatches or problems is attributed to that product or any other real vendor. The purpose is neither to manufacture suspicion nor to offer a blanket reassurance. It is to make the boundary between a demonstrated capability, an authorized configuration, an observed test result and an election outcome intelligible enough that a reader can ask the right next question.
2. Three version numbers can describe three different things
Version numbers are useful only when attached to their nouns. A software release, a standard, a program manual and a testing document can each have a version without belonging to one numerical sequence. Treating the largest number as the newest or strongest voting system is a category error. A manual’s revision may change the assessment process without changing a particular product’s software at all.
The actual EAC documents illustrate this distinction. VVSG 2.0 is dated February 10, 2021. Its separately published Test Assertions version 1.4 is dated January 30, 2026. The assertions document says it supplies detailed conditions for selected requirements, not a separate assertion for every VVSG requirement. A reader should not mistake the assertion document’s version for the version of the underlying standard, or its contents for the entire assessment. VVSG 2.0, Test Assertions 1.4
Suppose Alder’s folder contains a fictional product release 4.2, a requirements document edition 2, a test plan revision 7 and a laboratory report revision 3. Writing version 7 passed would lose the subject. It might refer to a plan that has never been executed, while the completed report concerns release 4.2. The complete statement needs to identify the product, requirements basis, plan and report separately.
Document dates create similar traps. A report posted in October may describe tests completed in August. A certificate issued in September may be reproduced on a page updated in October. An archive download in November tells a reader when the copy was obtained, not when the system was evaluated. These distinctions become essential when a later component change is compared with an earlier test campaign.
For Alder, imagine a report with an initial issue date and two subsequent corrections. The latest correction changes a table heading but not the stated results. A second hypothetical report changes the tested configuration. Those are materially different kinds of revision even if both filenames end in revision three. The revision history, not the suffix alone, explains what changed.
A good evidence note would retain the full document title, issuing organization, version, date and the specific passage supporting the claim. It would not silently replace an older report with a newer file while continuing to quote the older conclusion. Nor would it presume that a document lacking a visible publication date must be new because a search engine labels it recently crawled.
This is not bureaucratic trivia. Version precision lets another reader reproduce the comparison. It also makes disagreement more productive: the parties can discover that they are reading different documents rather than arguing indefinitely over a word such as approved that conceals the mismatch.
3. Read an actual certificate without turning it into an endorsement
The EAC record for ClearVote 2.5 identifies a November 19, 2025 certification date, VVSG 1.0 as the testing standard and Pro V&V as the laboratory. The attached certificate and scope identify certification number CBG-CV-25. They expressly limit the finding to the evaluated version and configuration and distinguish it from a federal endorsement, warranty or determination that the system is ready for a particular election. Those are the document’s boundaries, not a criticism of the product. EAC ClearVote 2.5 record, certificate and scope
Notice how much more information that provides than a sentence saying the company is certified. The named object is a system version, not every future product the organization might sell. The standard has its own identity. The date marks a decision. The attached scope is part of the evidence, not optional background. The laboratory’s involvement and the EAC’s decision also remain distinguishable facts.
A reader who wants to understand a local purchase should next locate the purchase’s own records rather than infer them from this certificate. What model and configuration were ordered? Which equipment was delivered? What approvals and conditions apply in the relevant state? What acceptance and election-preparation records exist? The certificate supplies one part of that inquiry; it does not supply the answers to transactions and events that it does not describe.
The public record’s existence also should not be stretched into an independent evaluation by this publication. Reading an official certificate is not rerunning its tests, inspecting the product’s source code or examining a county’s equipment. This article makes no claim to have done those things. It identifies what the official document says and then uses a separately invented example to explain how scope reasoning works.
For Alder, imagine a brochure whose front page displays a product-family name while a later attachment names a particular release. A journalist quoting the family name alone could accidentally expand the attachment’s meaning. The repair is not to declare the brochure fraudulent; it is to identify the exact approved object and ask whether the broader wording is supported. Intent and compliance require evidence beyond the mismatch in phrasing.
A certificate can also be entirely authentic while irrelevant to the object in a photograph or invoice. Authenticity answers whether the document is what it purports to be. Applicability answers whether it covers the object being discussed. These are separate questions. A convincing seal, signature or official download location cannot repair an applicability gap, just as an applicability question does not by itself show that the certificate is forged.
4. Laboratory competence is not a certificate for every tested product
NIST’s explanation of NVLAP accreditation distinguishes laboratory competence from product certification. Accreditation concerns a laboratory’s management system and technical capability for specified tests or calibrations; NVLAP is not itself a certifier of products or test data. The published explanation was updated May 31, 2023. Its scope distinction remains relevant when an accreditation logo appears alongside a product claim. NIST, accreditation versus certification
Alder’s fictional laboratory packet contains three items: an accreditation document listing method families, a report of a specific test campaign and a decision letter issued by a separate approving body. A summary that calls all three certificates obscures their roles. The first concerns who is qualified for particular work. The second describes work and results. The third records a decision under an identified program.
Suppose the laboratory’s scope lists methods P and Q, while the report includes an additional examination labeled R. That observation creates a question about the basis and status of R. It does not automatically invalidate the work under P and Q, establish that R was improperly performed, or determine the approving body’s decision. The analyst needs the relevant scope and any explanation of how the additional work was treated.
For readers, the practical record question is how the roles connect. Does the campaign report identify the test object and methods? Does the approval decision identify the report or evidence it considered? Does the account make clear which organization performed the work and which made the decision? Those links help readers follow the assessment without pretending to become the laboratory or adjudicating a technical question from a logo.
A disagreement over one result should likewise be described at the level established by evidence. A corrected measurement, an unresolved observation and a withdrawn approval are not the same event. Nothing in the Alder exercise asserts that any real laboratory has experienced any of them. The example simply shows why the vocabulary of testing needs more precision than a single binary label.
5. Federal and state decisions are not interchangeable stamps
California’s Secretary of State describes a state approval process for voting systems and modifications before their use in California elections. Its published overview includes functional, volume, security and accessibility examination, along with public hearing and comment, against California’s standards. That is an example of state-specific review; it is not evidence that every state uses California’s process or that federal certification alone answers every state-law question. California voting-system approval
The federal program is also not compulsory in precisely the same way everywhere. The EAC’s current VVSG material says adherence is voluntary except where individual state law requires it. A report should identify the jurisdiction’s actual requirements instead of asserting that every state must obtain the same federal approval before using equipment. EAC VVSG overview
Alder’s fictional procurement file contains a national conformity decision, a state approval letter, a purchase agreement and a delivery inspection. These documents answer different questions: conformity to specified requirements, permission or conditions within a jurisdiction, what the buyer ordered, and what the receiver observed. Having all four is not a mathematical score of one hundred percent election integrity. Their subjects and relationships must still be read.
Imagine that the state letter identifies configuration Blue, but the purchase agreement merely names the product family. The procurement file is not yet specific enough to connect the purchase with the approval. A clarifying attachment may resolve the issue. Until then, it is an identification gap in the available record, not proof that an unlawful system was purchased or that any votes were affected.
A second version of the exercise includes a condition requiring a particular accessory for a stated use. The delivery record lists the main device but says nothing about accessories. That silence may mean the accessory arrived in a separately documented shipment, that it was omitted from the record, or that it was absent. The state approval cannot answer which happened. A reader needs evidence of the actual delivery and intended use.
Even a complete procurement file is not a substitute for the record of a later election. A purchase occurs at a time; equipment can be assigned, serviced or reconfigured afterward. This is not a claim that such changes were improper. It is the ordinary reason that a record of acquisition and a record of deployment have different evidentiary boundaries.
Readers do not need to memorize every state’s rules to understand the distinction. They need to avoid importing one jurisdiction’s requirements into another and avoid treating one kind of approval as permission for everything downstream. For a real legal or operational determination, the responsible authorities and the applicable current documents control, not this fictional example.
6. A list of components is not a list of every permissible combination
Alder’s invented configuration sheet describes two complete arrangements. Arrangement Blue pairs application A1 with reader R1. Arrangement Green pairs application A2 with reader R2. For this exercise, those are the only arrangements described by the sheet. No actual voting-system architecture, vendor naming convention or EAC test procedure is being reproduced.
There are two application labels and two reader labels, so four pairings are mathematically possible: A1 with R1, A1 with R2, A2 with R1 and A2 with R2. Only two appear in the stipulated sheet. Checking merely that A1 and R2 each occur somewhere in the document would incorrectly treat membership in the component list as evidence for their combination. The relationship between components matters.
That does not establish that the unlisted pairing is unsafe or incapable of functioning. It establishes that the supplied sheet does not support the claimed pairing. Another authoritative document might address it. Without that document, the reader should preserve the applicability question rather than inventing either permission or a defect. Absence from one scope is not an empirical test result.
Suppose Alder’s inventory then records A1, R1 and an operating-environment label E7, while the fictional configuration sheet also specifies E7. This is a three-part match in the represented records. It does not prove that the inventory accurately describes what is installed. The evidence for the inventory remains a separate issue. A comparison between two statements cannot, by itself, turn either statement into a direct physical observation.
A later worksheet says only reader R, dropping the final digit. Treating that shortened name as R1 would assume the answer. The uncertainty can be resolved by an authoritative mapping or a more precise record, not by choosing the convenient interpretation. Small omissions matter when the omitted character distinguishes the very configurations being compared.
The exercise can be recorded as a claim with a reason: the Blue arrangement is supported by the supplied configuration sheet; the cross-pairing is not supported by that sheet; the abbreviated inventory label is insufficient to decide. These are three different analytical states. Calling them all failed would be as misleading as calling them all certified.
This relational way of reading scope is useful beyond a single version number. A feature can depend on an accessory, an operating environment or an identified mode. The reader should examine what the actual scope says, rather than importing Alder’s simplified structure into a real product. The lesson is to preserve the connections stated in the evidence—not to manufacture a new certification rule from a toy example.
7. Acceptance concerns the delivery, not just the design
North Carolina’s State Board of Elections distinguishes acceptance testing from ballot proofing and pre-election logic-and-accuracy testing. Its current explanation says acceptance testing checks that the system delivered to a county is the system certified for use in North Carolina and is in working condition. It also describes testing every machine used in an election, including backups, for each election. These are North Carolina descriptions, not a nationwide operational checklist. NCSBE, preparing for accurate elections
Alder’s fictional delivery consists of twenty units. Its acceptance register initially contains eighteen completed passing records, one unresolved observation and one unit not yet tested. Saying that eighteen units passed is accurate under the exercise’s assumptions. Saying that the delivery passed because the product design has a certificate skips the observed condition of the delivered units. Saying two units failed also misstates the register: one has an unresolved observation, while the other has no test result yet.
The distinction becomes clearer when the register is reconciled by unit identifier. Suppose twenty rows exist, but one unit appears twice and another appears nowhere. A row count of twenty is not evidence that twenty distinct units were checked. The same principle applies to a batch of attachments: a report count, a unit count and a completed-test count are different measures. A robust summary identifies the population to which each applies.
For the original twenty-unit example, eighteen divided by twenty is ninety percent. That is the completion-and-pass share under the stipulated classification, not a reliability estimate or a claim that ten percent of real voting devices malfunction. If the untested unit is subsequently tested and passes, nineteen have passing records. If the unresolved observation is explained and the required review closes it, the register can show that later state while retaining the first observation and its resolution.
The evidence should also distinguish delivered from deployed. Imagine that eighteen units are assigned to locations and two are designated as backups. A report that tests only the assigned units may cover the entire initial assignment list while omitting equipment that could later be used. Whether that satisfies an actual jurisdiction’s requirements depends on those requirements. The fictional arithmetic merely shows why the population definition must be visible.
Another useful distinction is between an observation and an acceptance decision. A technician may record measurements or functional results, while a designated official makes a separate decision under a contract or policy. An invoice marked received does not necessarily represent either action. Readers should identify the function of each signature rather than treating every signed document as evidence of every check.
Finally, acceptance is not an opportunity for this article to prescribe maintenance or modifications. An unresolved observation should be handled by authorized personnel under applicable procedures. The public-interest task here is to read the register accurately: what arrived, what was examined, what was concluded, and what remains open. Those questions complement design-level assessment rather than competing with it.
8. A useful test needs an expected result that did not come from the result
The EAC’s Logic & Accuracy Testing Quick Start Guide is dated May 1, 2022, version 1.0. It describes preparation, tests with known voting patterns, comparison of results and documentation of discrepancies, while directing officials to follow state requirements. It also distinguishes test sessions and materials from actual election results. This is guidance for election officials, not a claim that every jurisdiction follows one identical test procedure. EAC logic-and-accuracy quick-start guide
Alder’s next example is a synthetic arithmetic exercise, not a test deck for real voting equipment. It defines fifteen fictional records in three categories: seven labeled Cedar, five labeled Elm and three labeled Pine. The expected category vector is therefore seven, five, three. The labels are invented options, not candidates or ballot measures. The article’s accompanying calculation file recomputes these totals; it does not run a voting system.
Suppose a reported output is seven, four, four. The grand total remains fifteen, but two category values differ from the expected vector. A check of only the grand total would miss the discrepancy. A check of every category reveals it. This does not establish why the difference occurred. It establishes which comparison failed under the stipulated inputs and expected values.
Now suppose the expected-results sheet was generated by copying the output being tested. It would also say seven, four, four, and a comparison would appear to pass. The agreement would be circular. The expected result must have a basis independent of the result whose correctness is being evaluated. Otherwise the test confirms that a number was copied consistently, not that it represents the intended input.
Independence does not require mystical certainty. The expected sheet can itself contain an error, which is why its preparation and review matter. In a separate Alder scenario, the intended pattern is seven, five, three, but the actual synthetic input contains seven, four, four because one input label was entered differently. A report of seven, four, four would then match the actual input while differing from the intended script. Inspecting the input resolves a different question than inspecting the output alone.
These alternative scenarios show why the test record should preserve the intended pattern, the actual inputs, the output and the comparison. The difference between intended and actual input is not the same as the difference between actual input and reported output. Locating that boundary makes a discrepancy explainable without prematurely accusing a device, a person or a process.
The exercise also demonstrates the limits of a successful check. A match for fifteen defined records establishes a match for those records under the specified exercise. It does not establish that every possible input, language, configuration or future circumstance has been examined. That is not a reason to abandon testing. It is a reason to describe the tested conditions and avoid expanding the conclusion beyond them.
9. Repetition and coverage are not the same quantity
Alder’s planning worksheet defines four fictional ballot-layout labels, two language labels and three interaction-path labels. For this exercise only, the intended review space consists of all combinations of these dimensions. Four times two times three produces twenty-four cells. This is an author-created planning model, not a claim that VVSG or any state requires this particular matrix.
Suppose the recorded work covers six distinct cells and repeats each one one hundred times. There are six hundred runs, but only six of the twenty-four defined combinations have been exercised. The cell coverage is twenty-five percent. The repetitions may provide useful evidence about consistency within the six cells, but they do not create observations in the eighteen cells that were never exercised.
The reverse comparison is also instructive. A second plan runs each of the twenty-four cells once. It has broader coverage of the stipulated combinations but much less repeated observation within each cell. Neither plan is automatically superior for every purpose. The first could address repeatability under selected conditions; the second could look for differences across the specified combinations. The reader needs the purpose before judging the run count.
The denominator is itself a design choice. If one interaction path is inapplicable to a particular fictional layout, a fully rectangular matrix might overstate the intended space. The plan should say which combinations are applicable and why, rather than quietly removing awkward cells after seeing results. A percentage with an unexplained denominator can make an incomplete test look comprehensive or make a well-scoped test look deficient.
Coverage can also be reported at the wrong level. A worksheet may mark a language covered because one screen appeared in that language, even though the planned exercise concerns a complete interaction. A device may appear in the register without a record of the specific path under discussion. These are hypothetical examples of claim granularity, not reports of deficiencies in actual accessibility testing or equipment.
A well-written result therefore names the unit of coverage: distinct defined combinations, devices, functions, observations or repeated runs. It can then state the missing cells and the reason for their status. Not applicable, not attempted, interrupted, unresolved and completed are different categories. Treating them all as passed or all as failed obscures what the work actually demonstrated.
There is no election-outcome probability hiding in this matrix. Twenty-five percent cell coverage does not mean twenty-five percent of votes would be correct. Six hundred successful runs do not by themselves imply a failure rate for an unexamined population. To make those inferences would require assumptions and methods not supplied by the exercise. The useful result is narrower: an explicit account of which planned conditions have evidence and which do not.
10. Follow a known result across the reporting boundary
A test can produce a correct result at one stage and a different presentation later. That possibility should be investigated with evidence rather than assumed to be either impossible or inevitable. Alder’s next exercise separates a source result, an exported representation and a displayed summary. It is a fictional data-reconciliation exercise; no actual election reporting service is being evaluated.
The first synthetic batch has category totals seven, five and three, for fifteen records. The second has two, six and two, for ten. Combining corresponding categories gives nine, eleven and five, totaling twenty-five. The arithmetic is straightforward, which makes it a useful reference when examining later representations.
Suppose an export preserves those numbers but a display associates the first two with the wrong labels. The display then says Cedar eleven, Elm nine and Pine five. Its grand total is still twenty-five. A total-only comparison would not reveal the label-association discrepancy. Comparing both the identifiers and values identifies the difference without needing to speculate about how it arose.
In a separate version of the exercise, the labels are correct but the first batch is included twice. The resulting category totals become sixteen, sixteen and eight, for forty records. This is not the same defect as the label association problem. One changes the mapping of values to names; the other changes the population included. Their diagnostic evidence and remedies would differ, even though a casual description might call both a reporting error.
A third version displays the correct twenty-five-record total while suppressing the batch breakdown. That display may be sufficient for one audience and insufficient for another. The absence of a breakdown does not show that aggregation was wrong. It limits what a reader can verify from that display alone. The appropriate next source is the detailed record, not an invented account of concealed activity.
The value of preserving intermediate results is that they can localize a disagreement. If the source and export agree but the display differs, the available evidence places the discrepancy after the export. If the source records already disagree with the expected input, investigating only the display would miss the earlier boundary. This is ordinary causal reasoning from a documented sequence, not proof of a particular software flaw.
It is also important not to confuse a test environment’s result with an actual election’s result. Alder’s records are explicitly synthetic. Their successful reconciliation would demonstrate the arithmetic and labeling of the exercise, nothing about votes cast by real people. In a real public report, the environment, input population and run identifier should be sufficiently clear that readers do not mistake a preparation exercise for an election finding.
11. A newer standard does not automatically erase an older certification
The EAC’s May 28, 2026 migration explanation says moving to VVSG 2.0 does not automatically decertify systems certified to earlier standards. It distinguishes new certification applications from limited maintenance modifications to legacy-certified systems, and retains the role of state or local law in use and procurement. The age or number of the standard alone therefore does not establish that a currently listed system has lost certification. EAC VVSG migration guidance
That does not mean every proposed change is covered by an existing approval. It means the reader needs the actual status and scope records rather than a rule invented from a version number. A statement that old equals prohibited can be wrong; a statement that certified once equals covered forever can also be wrong. Both skip the decision record that would answer the specific question.
Alder’s fictional change packet proposes replacing component R1 with R3 in arrangement Blue. Its cover letter describes the reason, but the packet initially includes no decision addressing the replacement. The proposal is evidence that a change was requested, not that it was authorized, implemented or tested. Those later states require their own records. A file named approved-update cannot substitute for reading the approval it purports to contain.
Now suppose the packet includes an authoritative fictional decision permitting a specified replacement under stated conditions. The inventory still shows R1. That may mean the approved change has not been implemented, that the inventory is out of date, or that a different unit is being discussed. The approval and inventory need reconciliation; neither document alone establishes the current installed state.
A separate example concerns a revised ballot definition rather than a component replacement. A prior run record identifies definition D4; the upcoming exercise identifies D5. The previous run remains evidence about D4. Whether it supports a particular claim about D5 depends on what changed and what additional evaluation is required. This article does not prescribe a retest rule. It shows why a report must preserve the identity of the thing actually exercised.
A useful change history therefore distinguishes proposed, authorized, installed, checked and accepted states rather than treating updated as a single event. The distinctions are analytical, not a substitute for the governing program’s procedures. They allow a reader to locate the evidence supporting each claim and avoid attributing completion to work that remains planned.
There is a practical communication benefit here. Officials can explain a continuing certification without claiming that nothing ever changes. They can explain additional checks without implying that earlier assessment was worthless. Critics can ask about a particular change without asserting that the existence of change proves misconduct. The evidence becomes more informative when it describes the actual decision and configuration instead of treating every version transition as either an automatic assurance or an automatic alarm.
12. Publish the narrow finding, not the biggest possible interpretation
Alder’s completed exercise can support several useful statements. The supplied configuration sheet describes Blue and Green, not every mathematical cross-pairing. The initial acceptance register contains eighteen passing records, one unresolved observation and one untested unit. The defined arithmetic input has a known expected vector. The coverage worksheet distinguishes six hundred repetitions from six distinct combinations. Each statement is reproducible from the stipulated records and calculations.
None of those statements should be compressed into the system passed all tests. That phrase would combine different populations, times and criteria while discarding the unresolved states. Nor should the open acceptance observation be promoted into proof that an actual election outcome was wrong. The exercise contains no election outcome at all. Its evidence is about fictional records and the logic of the inferences made from them.
A reader-facing summary can be both short and precise. It can identify the test object and run, state the expected and observed values, describe the comparison and disclose the remaining limitation. For the fifteen-record example, that means saying that one hypothetical output differed in two category values despite matching the total. It does not mean asserting a cause before comparing the intended script, actual input and output.
A second summary can describe the reporting exercise: two batches should produce nine, eleven and five; a label-swapped display and a duplicated-batch display represent different hypothetical discrepancies. A third can describe the configuration exercise: the supplied evidence supports two stated arrangements, leaves a cross-pairing unsupported and leaves an abbreviated inventory label unresolved. These are concrete findings, not slogans about trust.
For a real publication, the corresponding supporting documents should be identifiable and the account should distinguish what was directly observed from what an official document states. Reading a certificate is not laboratory testing. Reading a test report is not witnessing its execution. Witnessing one execution is not proving every future use. Each can contribute evidence while retaining its own limits.
This distinction also protects the meaning of successful testing. A documented match under specified conditions is a substantive result. It should not be dismissed merely because it is bounded. But exaggerating that result into a universal guarantee makes the account less credible and deprives readers of the information needed to understand additional safeguards. Precision is not an argument against confidence; it is the basis on which justified confidence can be built.
The central question is certified for what, followed by tested on what, under which conditions, with what result. A standard, a laboratory assessment, a certification decision, state approval, delivered-unit checks and election-specific preparation each have a role. Explaining their boundaries lets the public scrutinize those roles without inventing vulnerabilities, dismissing genuine evidence or confusing a product assessment with proof of a particular election’s outcome.