  Risk-limiting audits (RLAs) offer a statistical guarantee: if a full manual
tally of the paper ballots would show that the reported election outcome is
wrong, an RLA has a known minimum chance of leading to a full manual tally.
RLAs generally rely on random samples. Stratified sampling--partitioning the
population of ballots into disjoint strata and sampling independently from the
strata--may simplify logistics or increase efficiency compared to simpler
sampling designs, but makes risk calculations harder. We present SUITE, a new
method for conducting RLAs using stratified samples. SUITE considers all
possible partitions of outcome-changing error across strata. For each
partition, it combines P-values from stratum-level tests into a combined
P-value; there is no restriction on the tests used in different strata. SUITE
maximizes the combined P-value over all partitions of outcome-changing error.
The audit can stop if that maximum is less than the risk limit. Voting systems
in some Colorado counties (comprising 98.2% of voters) allow auditors to check
how the system interpreted each ballot, which allows ballot-level comparison
RLAs. Other counties use ballot polling, which is less efficient. Extant
approaches to conducting an RLA of a statewide contest would require major
changes to Colorado's procedures and software, or would sacrifice the
efficiency of ballot-level comparison. SUITE does not. It divides ballots into
two strata: those cast in counties that can conduct ballot-level comparisons,
and the rest. Stratum-level P-values are found by methods derived here. The
resulting audit is substantially more efficient than statewide ballot polling.
SUITE is useful in any state with a mix of voting systems or that uses
stratified sampling for other reasons. We provide an open-source reference
implementation and exemplar calculations in Jupyter notebooks.
