Choosing an online voting provider can look like a straightforward technology decision.

It isn’t.

When an organisation puts an AGM, board election, member ballot, employee vote or important resolution online, the software becomes part of the governance process itself. If the system gets voter eligibility wrong, mishandles a proxy, exposes a secret ballot or cannot properly explain how the result was produced, the problem is much bigger than a technical glitch.

The right question is not simply, “Which online voting platform has the best features?”

It is:

“Which provider can run our particular vote securely, fairly, transparently and in accordance with the rules that apply to us?”

That distinction matters for Australian organisations because voting requirements vary considerably between companies, associations, charities, unions, strata organisations and other member-based bodies.

This guide explains what to look for when comparing an Australian online voting provider, and the questions worth asking before you entrust one with an important vote.

1. Start with the voting requirements, not the software

Before comparing providers, define the vote you actually need to conduct.

A simple one-member-one-vote election has very different requirements from a company AGM where shareholders may have different voting entitlements, proxies and poll voting.

Likewise, an employee ballot may require strict voter eligibility and ballot secrecy.

For example, a vote might involve:

Write down the rules before you start shopping for technology.

Your constitution, governing legislation, meeting rules, election rules or ballot order may determine who can vote, how votes are weighted, whether proxies are permitted, when voting opens and closes, and how the result must be recorded.

For companies, for example, the Corporations Act 2001 contains specific provisions dealing with meetings, voting and polls. ASIC also explains that companies must follow the Corporations Act and applicable constitutional rules when conducting meetings and resolutions.

For protected action ballots, the requirements are more specific again. The Fair Work Commission states that an electronic protected action ballot must ensure that only employees on the voter roll can access the system, each employee can vote only once, there is a record of who has voted, and there is no way to identify how an individual employee voted.

The provider needs to fit the process — not the other way around.

2. Look beyond “secure” and ask how the voting system actually works

Almost every online voting provider will describe its platform as secure.

That word alone tells you very little.

Ask the provider to explain the controls behind the claim.

Voter authentication

How does the system establish that the person voting is entitled to vote?

Depending on the election, this might involve:

The strongest approach depends on the circumstances.

A public election and a confidential employee ballot do not necessarily need the same authentication model.

Vote secrecy

For a secret ballot, the provider should be able to clearly explain the separation between who voted and how they voted.

This is particularly important for employee and industrial ballots.

The Fair Work Commission’s requirements for electronic protected action ballots explicitly require a record of who has voted while preventing identification of how an individual employee voted.

If a provider cannot explain how that separation works, keep asking questions.

Access controls

Ask who can access the election administration system.

For example:

These are practical governance questions, not just IT questions.

3. Ask for evidence of information security

An online voting provider handles information that can be highly sensitive.

That may include names, contact details, membership information, shareholder information, employee information, voter eligibility data and voting records.

The Australian Privacy Principles require covered organisations to take reasonable steps to protect personal information against misuse, interference, loss and unauthorised access, modification or disclosure. The OAIC also states that personal information that is no longer required should generally be destroyed or de-identified, subject to applicable exceptions.

So don’t stop at asking whether a provider uses encryption.

Ask:

Useful evidence can include:

ISO/IEC 27001 is particularly useful as a reference point because it specifies requirements for an information security management system, including processes for managing and continually improving information security.

A certification or audit should not be treated as a guarantee that a provider can never experience an incident. It is evidence that can help you assess the maturity of its information security management.

Ask to see the relevant certification or independent assurance documentation rather than relying solely on a logo on a website.

4. Find out where your voting data is stored

“Australian provider” and “Australian-hosted data” are not necessarily the same thing.

A company may have an Australian office while using infrastructure, cloud services or subcontractors located overseas.

That may or may not be acceptable for your organisation. What matters is that you understand the arrangement and assess it against your obligations and risk profile.

Ask:

The OAIC’s guidance on Australian Privacy Principle 8 deals specifically with cross-border disclosure of personal information and the circumstances in which Australian entities may disclose information to overseas recipients.

For many Australian organisations, data location is therefore worth putting on the procurement checklist rather than assuming it.

5. Check the audit trail

A voting system should produce more than a final percentage.

A good audit trail should allow an authorised person to understand what happened during the voting process without exposing the secrecy of individual votes where anonymity is required.

Depending on the type of election, useful records may include:

The exact records required will depend on the type of vote.

The objective is simple: if the result is questioned six weeks later, can your organisation demonstrate how it was reached?

This is especially relevant for charities and other organisations with formal record-keeping responsibilities. The ACNC says registered charities must keep appropriate financial and operational records and that records should be easy to find, including when held electronically.

An audit trail also provides something valuable that is sometimes overlooked: confidence.

People are more comfortable accepting an election result when there is a clear process behind it.

6. Make sure the provider can handle your voting rules

This is where many apparently good platforms fall short.

A voting system may be perfectly capable of asking:

Do you vote Yes or No?

But that doesn’t mean it can handle your actual governance requirements.

Check whether the system supports the voting methods you need.

One-member-one-vote

Common for associations, clubs and many member-based organisations.

Weighted voting

Some organisations give members voting power based on shareholding, membership categories, unit entitlements or another defined weighting.

Preferential voting

Candidates may need to be ranked rather than simply selected.

Proxy voting

The system may need to record proxies and apply them correctly to relevant resolutions.

Multiple voting rights

Some members may have different voting rights depending on the resolution or membership class.

Secret ballots

The system needs to protect the secrecy of individual votes while still providing sufficient participation records.

Quorum requirements

For some meetings, voting cannot simply proceed without considering whether the required quorum has been achieved.

The provider should be able to explain precisely how each rule is configured.

Don’t accept “yes, our platform can do that” as the end of the conversation.

Ask to see it.

7. Ask whether the provider understands Australian governance

There is a difference between selling voting software in Australia and actually understanding Australian voting processes.

A provider working with Australian organisations should understand that the technology sits within a broader governance framework.

That may include:

The Fair Work Commission, for example, maintains specific requirements around protected action ballots, including who can conduct them. Protected action ballots can be conducted by the AEC or another approved eligible ballot agent, subject to the relevant rules.

That is why industry knowledge matters.

The best provider is not necessarily the one with the longest feature list. It is the one that understands the consequences of getting the process wrong.

8. Check whether the provider can act independently

For contentious elections, independence can be just as important as technology.

Consider a board election where several candidates are closely involved with the organisation.

Who controls the voting system?

Who has access to the voter list?

Who decides whether a disputed vote is accepted?

Who controls the count?

Who declares the result?

An independent third-party provider can help separate the organisation’s administrative role from the operation of the ballot.

This is particularly useful where there may be competing candidates, internal disputes or concerns about impartiality.

Ask whether the provider can:

For an ordinary internal poll, you may not need all of these services.

For a contested election, you might.

9. Consider the experience for voters

Security is essential, but a technically sophisticated voting system that confuses voters is still a poor solution.

Before selecting a provider, think about the people who will actually vote.

Can someone vote easily from:

What happens if someone loses their voting email?

What happens if their details have changed?

Can the provider resend credentials securely?

Is there a support team available when voting opens?

These details can have a direct impact on participation.

For large or geographically dispersed memberships, accessibility and simplicity can be just as important as the underlying technology.

10. Ask what support you receive on voting day

This is one of the biggest differences between a software subscription and a managed voting service.

Imagine an AGM begins at 7:00 pm.

At 7:04 pm, several members cannot vote.

At 7:08 pm, the chair asks whether the poll is open.

At 7:12 pm, someone discovers that a proxy was entered incorrectly.

Who is dealing with those issues?

A provider should be able to explain its support model clearly.

Ask:

For important votes, having experienced people available can make a substantial difference.

11. Understand the reporting you will receive afterwards

The election does not finish when the “Close Voting” button is pressed.

Your organisation may need to retain evidence of the process.

Ask to see a sample results pack before signing up.

Depending on the vote, this might include:

The report should be understandable to someone who was not involved in setting up the ballot.

That is a good test.

If the results report requires the provider’s technical team to explain every line, it may not be sufficiently useful as a governance record.

12. Review the provider’s privacy and retention policies

Privacy should be considered before the ballot starts, not after it ends.

Ask for the provider’s:

Also ask a practical question:

What happens to our voter data after the election?

The answer should be specific.

“We keep it for as long as necessary” is not particularly useful.

You should understand what information is retained, why it is retained, who can access it and when it will be deleted or de-identified where appropriate.

The OAIC’s current APP 11 guidance specifically emphasises that organisations should actively consider whether personal information needs to be retained and take reasonable steps to destroy or de-identify information that is no longer needed, subject to the relevant exceptions.

13. Don’t compare providers on price alone

Price matters.

But the cheapest voting system is not necessarily the cheapest election.

Consider the total cost of running the process, including:

A low-cost self-service platform may be perfectly suitable for a simple internal vote.

A complicated election may require considerably more support.

The right comparison is therefore not:

Provider A costs $X and Provider B costs $Y.

It is:

What does each provider actually take responsibility for?

14. Ask for a demonstration using your actual scenario

A generic product demonstration can make almost any voting platform look impressive.

A better approach is to give providers a realistic scenario.

For example:

We have 1,200 members. There are five candidates. Members can vote preferentially. Some members have proxy arrangements. Voting is open for seven days and the final result needs to be independently reported.

Then ask the provider to demonstrate how that election would actually work.

Or:

We are conducting a hybrid AGM. Some shareholders are attending in person, others online. Voting includes proxies and weighted shareholdings.

Can the provider show you the workflow?

This exercise quickly exposes whether the provider understands your requirements or is simply demonstrating generic software features.

15. Questions to ask an Australian online voting provider

If a provider gives clear, specific answers to these questions, you are already in a much better position to compare them.

What makes a good Australian online voting provider?

There is no single checklist that guarantees a provider is right for every organisation.

But a strong provider should generally demonstrate five things:

1. Security

The provider should have mature information security controls and be able to provide meaningful evidence of them.

2. Voting integrity

The system should correctly apply eligibility, voting rights, ballot rules, anonymity requirements and counting methodology.

3. Auditability

There should be a defensible record of how the election was conducted and how the result was produced.

4. Australian governance knowledge

The provider should understand the regulatory and constitutional environment in which Australian organisations conduct votes.

5. Practical support

When something goes wrong, you should be dealing with experienced people rather than trying to solve a critical voting issue through a generic help centre.

How Vero Voting approaches online voting

Vero Voting provides online voting and election services for Australian organisations, including elections, AGMs, member voting, ballots and Enterprise Agreement-related voting. Its services can range from a voting platform through to managed election and meeting support.

For AGM and meeting voting, Vero supports processes such as proxy voting, real-time voting and elections, with systems designed to accommodate different voting rights and structures.

For elections, Vero can manage the process from nominations through to results, including board, committee, employee representative and association elections.

Vero also states that its information security programme includes ISO/IEC 27001:2022 certification and a SOC 2 Type II audit, providing independent assurance evidence alongside its own security controls.

The important point is not simply that a provider has a list of features.

It is whether those features and services fit the governance process you actually need to run.

For a straightforward member poll, self-service online voting may be enough. For a contested election, complex AGM or regulated ballot, having an experienced team involved from planning through to results can be far more valuable.

Key takeaways

When choosing an Australian online voting provider:

The best online voting provider is the one that makes the result easier to trust.

Technology should make the process simpler. It should not make the governance harder.

If your organisation is planning an election, AGM, member ballot or other important vote and you would like to discuss the right approach, Vero Voting can help you assess the requirements and demonstrate how the voting process can be managed from start to finish.

Sources

Australian Government and Regulators