Online ballots are becoming part of modern organisational voting

For many Australian organisations, running a ballot used to mean printing voting papers, sending envelopes, collecting completed forms and manually checking the results.

That process can still be appropriate in some situations. But for organisations with members, employees, shareholders or other voters spread across different locations, an online ballot can make participation much simpler.

An online ballot system allows eligible voters to access a ballot through a secure digital platform, verify their eligibility, cast their vote and receive confirmation that their vote has been submitted.

The technology, however, is only one part of a properly managed ballot.

A good online ballot needs to answer several basic questions:

These questions matter whether the ballot is for an AGM, committee election, member resolution, workplace vote, union election, association election or another organisational decision.

The exact rules also depend on the type of organisation and the ballot being conducted. For example, companies must follow the Corporations Act 2001 and their constitution, while some workplace and registered-organisation ballots are subject to specific Fair Work requirements.

What is an online ballot system?

An online ballot system is a digital platform that allows an organisation to conduct a ballot electronically.

Instead of returning a paper ballot, an eligible voter receives instructions for accessing an online voting system.

A typical process looks like this:

1. The organisation prepares the voter roll.
2. Eligible voters are loaded into the voting system.
3. Voters receive instructions for accessing the ballot.
4. The voter verifies their identity or eligibility.
5. The voter views the ballot questions or candidates.
6. The voter makes their selections.
7. The system records the vote.
8. The voter submits the ballot.
9. The system prevents further voting where the ballot rules require one vote per person.
10. Results are calculated and checked after voting closes.

The important distinction is that voter verification and vote secrecy do not have to be the same thing.

A system may need to know that a particular person is entitled to vote without allowing administrators to see how that person voted.

This separation is one of the key design principles of a properly managed secret ballot.

Where online ballots are used

Online ballot systems can be used for many different types of organisational voting.

Company and shareholder voting

Companies may use electronic voting as part of meetings and resolutions, subject to the Corporations Act, the company’s constitution and the rules that apply to the particular vote.

ASIC states that companies must follow the Corporations Act 2001 as well as applicable constitution or replaceable rules when conducting meetings and resolutions.

For virtual and hybrid meetings, the technology used must provide members with a reasonable opportunity to participate, including the ability to vote where voting is required.

This means an online voting system should be considered as part of the wider meeting and governance process, rather than simply as a digital replacement for a paper form.

Association and member voting

Associations, clubs and other member-based organisations may use online ballots for:

The organisation’s rules will determine who can vote, how votes are counted and what type of voting process is required.

Workplace and industrial ballots

Some workplace ballots have specific legal requirements.

For example, the Fair Work Commission provides procedures for electronic voting in protected action ballots. These requirements include ensuring that only employees on the voter roll can access the electronic voting system, each employee can vote only once, the system records who has voted, and there is no way to identify how an employee voted.

This is a good example of why an organisation should not simply choose a generic online survey tool for a formal ballot.

The voting method needs to match the legal and governance requirements of the ballot.

Strata and property-related voting

Electronic voting can also be used in some strata processes, depending on the relevant state or territory legislation and the rules applying to the owners corporation.

The requirements are not identical across Australia, so strata managers should check the legislation applying to the particular scheme before selecting a voting method.

Why voter access matters

Security is only useful if eligible people can actually vote.

A common problem with online voting is assuming that every voter has the same access to technology, email and mobile services.

They do not.

A voter might:

A well-designed ballot process should consider these issues before voting opens.

Keep the voting process simple

A voter should not need technical knowledge to cast a vote.

Good voter instructions should explain:

If the process is complicated, voters are more likely to contact the organisation for help.

Give voters a secure way to recover access

There is also a difference between making a ballot easy to access and making it easy to bypass security.

A voter who cannot find their original invitation should have a controlled recovery process rather than simply receiving a new voting link with no verification.

For example, a system may use a voter record together with a one-time authentication step to confirm that the person requesting access is an authorised voter.

The recovery process should be designed so that it does not reveal sensitive information about other voters.

Voter verification: confirming who is entitled to vote

Voter verification is one of the most important parts of an online ballot.

The organisation needs confidence that:

The person accessing the ballot is an eligible voter.

The exact method will depend on the ballot.

Possible approaches include:

The goal is not necessarily to collect as much information as possible.

In fact, collecting unnecessary personal information can create additional privacy and security risks.

The OAIC states that organisations covered by the Australian Privacy Principles must take reasonable steps to protect personal information from misuse, interference and loss, as well as unauthorised access, modification or disclosure.

That means organisations should think carefully about what information an online ballot actually needs.

Authentication and ballot secrecy are different

This is one of the most important concepts to understand when evaluating an online ballot system.

Authentication answers:
“Is this person allowed to vote?”

Ballot secrecy answers:
“Can anyone determine how this person voted?”

A properly designed secret ballot can verify that a person is entitled to vote while keeping their voting choices confidential.

For example, the system may record that:

But the system should not expose:

where the ballot requires secrecy.

This separation is particularly important for elections and workplace ballots where voters need confidence that their choices cannot be traced back to them.

What makes an online ballot secure?

There is no single feature that makes an online ballot secure.

Security should be treated as a combination of controls.

1. Secure voter authentication

The system should have a reliable method of confirming that only eligible voters can access the ballot.

The level of authentication should match the risks of the ballot.

A small internal poll may have different requirements from a formal election involving thousands of members.

2. Protection against duplicate voting

The system should have controls to prevent an eligible voter from submitting multiple votes when the rules allow only one vote.

The Fair Work Commission’s electronic protected action ballot procedure, for example, specifically requires each employee to be able to vote only once.

3. Encryption and secure connections

Voting systems should protect information while it moves between the voter’s device and the voting platform.

Organisations should also ask how sensitive information is protected when stored.

4. Access controls

Only authorised people should be able to administer the ballot or access administrative information.

An administrator who can change voter records or ballot settings should not automatically have unrestricted access to information that could compromise ballot secrecy.

5. Audit logs

A strong online ballot system should create records of important events.

Depending on the system, these may include:

Audit information can be valuable if a question is raised about how the ballot was conducted.

6. Independent security assurance

Organisations should look beyond statements such as “secure” or “bank-level security”.

Ask what evidence exists.

For example:

Independent assurance does not remove every risk, but it provides more useful evidence than a marketing statement alone.

Privacy is part of ballot security

An online ballot may contain more information than the actual vote.

Depending on the organisation and ballot, the system may process:

That information needs to be managed carefully.

The OAIC’s guidance on Australian Privacy Principle 11 says organisations covered by the APPs must take reasonable technical and organisational measures to protect personal information.

The OAIC also states that organisations should consider the information lifecycle, including what information is collected, how it is stored and when it should be destroyed or de-identified if it is no longer needed.

For higher-risk projects, a privacy impact assessment can also be useful. The OAIC recommends considering privacy from the beginning of projects involving personal information rather than treating it as an issue to solve later.

Do not confuse an online survey with a formal ballot

This is a common mistake.

Tools designed for surveys and simple polls can be useful for collecting opinions.

But a formal election or ballot may require much more.

Consider the difference.

This does not mean every formal vote requires an expensive or complicated system.

It means the system should be selected based on the requirements of the ballot.

How should organisations check online ballot results?

The result should not simply appear on a screen with no supporting process.

A good ballot process should provide confidence that:

The Australian Electoral Commission provides a useful example of the importance of controls around ballot integrity. Its election processes include measures for tracking ballot papers, verifying captured preference data and identifying discrepancies.

An online organisational ballot will not necessarily use the same process as a federal election. However, the underlying principle is relevant: the result should be supported by a controlled and auditable process.

What should happen if someone challenges the result?

A ballot can become difficult to defend if the organisation has no record of how it was conducted.

Before voting opens, decide what records will be retained.

These may include:

The exact retention period will depend on the organisation, the ballot and applicable legal or regulatory requirements.

Do not automatically keep every piece of voter information forever.

Privacy and governance requirements should be considered together.

A practical checklist for choosing an online ballot system

Before selecting a provider, ask the following questions.

Voter access

Eligibility and authentication

Ballot secrecy

Security

The Australian Cyber Security Centre recommends multi-factor authentication as one of the most effective controls organisations can use to reduce the risk of unauthorised access to online services.

Auditability

Data and privacy

Business continuity

These questions are often more useful than simply comparing the number of features on each provider’s website.

Plan the ballot before choosing the technology

The best online voting projects usually start with the voting rules, not the software.

Before selecting a system, define:

Then select technology that supports those requirements.

This approach also makes it easier to identify legal or constitutional issues before the ballot is launched.

For companies, for example, ASIC notes that meeting and resolution processes are governed by the Corporations Act and applicable company rules or constitution.

For Fair Work matters, specific legislation and Commission directions may apply.

A voting platform cannot fix an incorrect voter roll, an invalid notice or a voting process that does not comply with the rules governing the ballot.

The technology supports the process. It does not replace good governance.

How Vero Voting can help

Vero Voting provides online voting and ballot services for Australian organisations conducting elections, member votes, AGMs, workplace ballots and other formal voting processes.

Its online voting platform is designed around voter access, secure authentication, auditability and controlled voting processes.

Vero Voting also provides voter self-verification, giving eligible participants another way to securely access a poll when they cannot use their original voting invitation, while still requiring the configured authentication process.

For organisations with more complex requirements, Vero Voting can support the voting process from voter communications and ballot setup through to voting, results and audit records.

Vero Voting states that it is ISO/IEC 27001:2022 certified and SOC 2 Type II audited, providing independent assurance around its information security controls.

The right voting arrangement will depend on the organisation and the type of ballot being conducted. The useful question is not simply “Can we vote online?”

It is:

Can we conduct this particular ballot securely, fairly, accessibly and in a way that we can properly support and defend afterwards?

Key takeaways

Online ballot systems can make organisational voting easier for both voters and administrators, but a good system needs more than a simple online form.

The main areas to consider are:

For a simple internal poll, a basic tool may be enough.

For a formal election, AGM resolution, member ballot or regulated workplace vote, the requirements can be much higher.

If you are planning an online ballot and want to understand what type of voting system and process would suit your organisation, contact Vero Voting or request a demonstration.

Sources

The following official sources provide useful information when reviewing the legal, privacy, security and governance requirements behind online voting in Australia: