For many not-for-profit organisations, elections are still managed with a combination of paper forms, email, spreadsheets and voting at an annual general meeting.

That can work when an organisation has a small, local membership. But once members are spread across different cities, states or countries, the process becomes harder to manage — and much harder to demonstrate as fair and reliable.

Online elections can make the process considerably easier. Members can vote remotely, results can be counted automatically, and administrators can manage the election without manually reconciling hundreds of ballot papers.

But putting an election online does not automatically make it secure.

A good online election needs to protect the eligibility of voters, confidentiality of ballots, accuracy of results and integrity of the overall process.

For Australian not-for-profits, there is another consideration: the technology needs to fit the organisation’s governing document and the rules that apply to its particular legal structure.

The following is a practical framework for getting it right.

What is an online election?

An online election is an election in which eligible members cast their votes electronically through a secure voting platform rather than using paper ballot papers or voting solely in person.

A typical member election might involve:

The technology is only one part of this process.

The election rules come first.

Start with the governing document

This is probably the most important step — and one organisations sometimes overlook when moving from paper voting to an online system.

A charity’s governing document sets out how the organisation is governed, including how its governing body makes decisions and consults members. The ACNC specifically advises charities to ensure their governing document accurately reflects how the organisation operates.

Depending on the organisation, the document might be called a:

The relevant state or territory legislation may also affect incorporated associations.

Before setting up an online election, check the rules covering:

The ACNC’s current regulatory focus for 2026–27 includes governing documents, reinforcing the practical importance of making sure the document accurately reflects how a charity actually operates.

Don’t assume online voting requires changing the constitution

There is no single Australian rule saying every not-for-profit must amend its constitution before using online voting.

The answer depends on the organisation’s legal structure, governing document and applicable legislation.

For example, companies governed by the Corporations Act have specific provisions dealing with member meetings, technology, participation and voting. The Corporations Act also contains rules concerning how votes are carried out at meetings.

An incorporated association, however, may be governed primarily by the applicable state or territory legislation and its own rules.

So the sensible approach is not to start with the voting software.

Start with the rules.

Why security matters in a not-for-profit election

An election may not involve millions of dollars or thousands of shareholders, but the outcome can still have significant consequences.

A committee election determines who will govern the organisation. A contested result can affect relationships with members, volunteers, donors, employees and other stakeholders.

There are four areas worth paying particular attention to.

1. Voter authentication

The system needs to establish that the person voting is actually entitled to vote.

A simple public web form is rarely sufficient for a formal election.

A properly designed voting process should use an appropriate authentication method, such as unique voter credentials, a secure voting link, a PIN or another method appropriate to the organisation’s risk profile.

The goal is straightforward:

One eligible voter should be able to cast their permitted vote, while an ineligible person should not.

Vero Voting’s online voting process, for example, uses voter authentication before a participant reaches the ballot paper.

2. Ballot confidentiality

Authentication and anonymity need to be considered together.

An election may need to verify who is voting without allowing administrators or other members to see how that person voted.

This is one reason a secure election platform should separate voter authentication from the recorded ballot wherever the election requires a secret ballot.

A member might therefore be authenticated against the electoral roll, while their actual voting preferences are kept separate from their identity.

That distinction is critical.

3. Preventing duplicate voting

A member should not be able to submit multiple ballots simply by refreshing the page, using another browser or forwarding their voting credentials.

The system should have controls to identify whether a voting entitlement has already been used and prevent additional unauthorised submissions.

This is particularly important for elections where every member has one vote.

4. Protecting the election record

Security doesn’t end when the member clicks Submit.

An election produces valuable information and records that may need to be retained according to the organisation’s governance and legal requirements.

The organisation should understand:

If personal information is involved, privacy needs to be considered as part of the election design rather than added afterwards.

The OAIC’s guidance for not-for-profits recommends that organisations consider their obligations under the Privacy Act and Australian Privacy Principles, collect only information they need, store it securely and delete information when it is no longer required.

For organisations that are APP entities, Australian Privacy Principle 11 requires reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

Don’t confuse election security with general website security

A secure website does not necessarily make a secure election.

For example, an organisation might use HTTPS and have a secure membership portal, but that does not answer important election questions:

The election itself needs appropriate controls.

The Australian Cyber Security Centre recommends basic measures such as multi-factor authentication, keeping software updated and maintaining backups as part of an organisation’s broader cyber security practices.

These controls are particularly relevant to election administrators because an administrator account can provide access to sensitive voter or election information.

Use strong controls for election administrators

Voter security gets most of the attention, but administrator security is just as important.

Consider an organisation where three committee members and an external administrator have access to an election platform.

If one administrator’s password is compromised, the attacker could potentially access voter data or interfere with election administration.

Good practice includes:

The ACSC describes MFA as one of the most effective measures organisations can use to protect accounts from unauthorised access.

The principle is simple: give people only the access they need to perform their role.

Make the voting method clear before the election opens

Security isn’t just technical.

A surprisingly common source of election disputes is confusion about the voting rules.

Before voting begins, members should be able to understand:

This is particularly important for preferential elections.

For example, if five candidates are contesting two committee positions, the organisation needs to make it clear whether members:

There is no universally correct method.

The correct method is the one required by the organisation’s rules and applicable legislation.

Consider accessibility and member participation

A secure election is not much use if a significant portion of the membership struggles to participate.

Online voting can actually improve accessibility for members who:

But accessibility should be considered when choosing and configuring the system.

A practical election should work on common devices and browsers and present voting instructions clearly.

It is also worth considering what happens when a member cannot access the online system.

For some organisations, an alternative voting channel or assisted voting process may be appropriate.

The aim is not simply to maximise the number of votes.

It is to provide eligible members with a fair opportunity to participate.

Build an audit trail without compromising ballot secrecy

A good election should leave enough evidence to demonstrate that the process was properly administered.

That does not mean creating a record that reveals every member’s voting preferences.

Instead, organisations should think about an audit trail that can establish things such as:

The exact information required will depend on the election.

The important distinction is between auditability and loss of anonymity.

You want enough information to investigate a genuine dispute without creating a record that unnecessarily exposes individual voting choices.

Independent election administration can reduce disputes

For a contentious committee election, having the organisation’s own office bearers manage every aspect of the vote can create an awkward perception.

Even where the process is technically sound, members may question whether the people running the election had influence over the outcome.

Using an independent election administrator or returning officer can help separate:

the people contesting or overseeing the election

from

the people operating the voting process.

This is particularly useful when:

Independence does not replace good governance, but it can provide an additional layer of confidence.

A practical process for running a secure online election

For most not-for-profits, a straightforward election workflow looks something like this.

Step 1: Confirm the rules

Review the constitution, governing document, relevant legislation and any election policy.

Confirm the voting method before building the ballot.

Step 2: Confirm the electoral roll

Establish which members are eligible to vote as at the relevant date.

Check for:

Step 3: Finalise nominations

Confirm that each candidate satisfies the organisation’s eligibility and nomination requirements.

Provide members with the information they need to make an informed choice.

Step 4: Configure the ballot

Set up the candidates, positions and voting rules.

Test the ballot thoroughly before it opens.

Step 5: Test the election

Run test votes using different scenarios.

For example:

This is where many configuration errors are discovered.

Step 6: Communicate with members

Send clear instructions explaining how to vote and where to get assistance.

Avoid sending a long technical explanation.

Members mainly need to know what to do.

Step 7: Open voting

Monitor participation and technical issues without interfering with the secrecy of the ballot.

If appropriate, send reminders to members who have not yet voted.

Step 8: Close the election

Close voting at the predetermined time.

Avoid changing the rules or extending the deadline informally once voting has commenced unless the organisation’s rules and governance process allow it.

Step 9: Count and verify

Calculate the result using the election method established before voting opened.

For a preferential election, this may involve multiple rounds of counting and redistribution of preferences.

Step 10: Declare and retain the result

Provide the required result information to the organisation and retain appropriate election records.

If the election is likely to be contentious, make sure the organisation knows who is responsible for retaining the records and responding to any formal challenge.

Common mistakes not-for-profits make with online elections

Using a general survey tool for a formal election

A survey tool can be excellent for collecting opinions.

That doesn’t necessarily make it suitable for a governance election.

A formal election may require stronger controls around voter eligibility, duplicate voting, anonymity, auditability and counting rules.

Treating email voting as equivalent to secure online voting

Asking members to email their preferred candidate is easy to set up, but it can create problems around confidentiality, authentication, duplicate submissions and administration.

Email can be useful for communications.

It is rarely the strongest mechanism for running a contested member election.

Deciding the voting method after nominations close

The voting method should be established before members vote.

Changing the rules halfway through an election creates unnecessary risk and can undermine confidence in the result.

Giving too many people administrator access

More administrator accounts mean more opportunities for mistakes or compromised credentials.

Keep access limited and review it before and after the election.

Forgetting the governing document

The software may allow an organisation to configure almost any voting method.

That does not mean the organisation is entitled to use it.

The governing rules come first.

Failing to test the ballot

A candidate missing from the ballot, an incorrectly configured preferential vote or an incorrect number of positions can create a serious problem.

Test before opening the election.

How Vero Voting can assist not-for-profit organisations

For organisations that want to move away from paper ballots or basic online forms, an independent voting platform can take much of the administration out of the process.

Vero Voting’s online voting platform supports voter authentication, online ballot submission, vote counting and voting records, with options designed around secure and confidential voting.

Vero also supports different election methods, including preferential voting, where the organisation’s rules require voters to rank candidates.

For an AGM or member election, Vero can also support the broader meeting and voting process rather than simply supplying a ballot link.

The value of using an experienced voting provider is not simply that members can click a button from home.

It is the combination of planning, voter authentication, ballot configuration, security, vote management, counting and reporting.

Vero states that its voting platform is certified to ISO/IEC 27001:2022 for its information security management system and independently audited by Insight Assurance.

For an organisation considering a provider, these are the kinds of claims worth verifying rather than simply taking at face value.

What should you ask an online voting provider?

Before selecting a platform, ask practical questions.

Security

Privacy

Election integrity

Administration

Reliability

These questions will tell you much more about a provider than a list of features on a sales page.

Key takeaways

Running a secure online election is not simply a matter of replacing a paper ballot with a web page.

A robust process should:

The best online elections are usually the ones that members barely have to think about.

They receive clear instructions, verify their identity, cast their vote and receive confirmation that it has been lodged.

Behind the scenes, however, there should be a carefully designed process that the committee can explain and defend if the result is ever questioned.

Sources