How to Document a Housing Lottery So It Survives a Challenge

Most housing lotteries are run carefully. Far fewer are documented in a way that would hold up if someone decided to fight about it.

That gap is where agencies get hurt. Nobody sets out to run an unfair drawing. What happens instead is that a drawing is run correctly, six or eighteen months pass, an applicant or an advocate or an auditor asks a pointed question, and the agency discovers that everything it has to offer as proof is a spreadsheet that anyone could have edited and a staff member's recollection of a Tuesday afternoon.

This post is about closing that gap. It is written to be useful whether or not you ever work with an outside processor.

What "defensible" actually means

A defensible lottery record is one that lets a neutral third party (an auditor, a board, a judge, a journalist) confirm three things without taking your word for any of them:

1. The drawing happened when you say it happened.
2. The results are the ones the drawing produced.
3. Nothing was altered between the drawing and the record you are showing them.

Notice what is not on that list. Defensibility is not about proving the drawing was random in a mathematical sense, and it is not about proving your staff acted in good faith. Those things matter, but they are not what gets contested. What gets contested is the chain between the event and the evidence.

An agency that can close that chain is in a different position entirely from one that cannot. The first agency answers a challenge with a document. The second answers it with an argument.

The six components of a defensible record

Over seven years the same six pieces have proven to be what actually gets asked for. If your lottery record contains all six, you are in good shape. If it is missing two or three, you have a gap you will not notice until it matters.

1. The source data, preserved untouched

Keep an exact copy of the applicant list as it existed at the moment the drawing ran. Not the working file you edited afterward, not a cleaned-up version. The unmodified input.

This is the piece agencies most often lose, because the applicant list is a living file right up until it isn't. Once the drawing runs, that file needs to be frozen and set aside.

2. The complete draw order

Not just the winners. Every entry, in the order it came out, including positions well past the number of available units. Waitlists get worked further down than anyone expects, and a record that stops at position 40 is useless in month fourteen when you are calling position 41.

3. A timestamp on every draw, not just the run

A single "lottery completed at 2:14 PM" line proves very little. A record showing each entry drawn at its own distinct moment demonstrates a sequential process that unfolded over time, which is much harder to fabricate after the fact than a single line in a log.

4. A processing log written during the run

Logs written afterward are summaries. Logs written as the drawing happens are evidence. The distinction matters to auditors, and it matters more if a result is ever litigated, because a contemporaneous record carries evidentiary weight that a reconstruction does not.

5. A public-safe version of everything

Housing lottery results get requested. Board packets, public-records requests, applicant inquiries, and press questions all arrive eventually, and each one creates pressure to hand over documentation quickly.

If your only record contains applicant names, emails, and addresses, every one of those requests becomes a redaction project done under time pressure, which is exactly the condition under which personally identifiable information gets released by accident. Produce a censored version at the same time as the full one, before anyone asks.

6. Something that proves the file hasn't changed

This is the component almost nobody has, and it is the one that does the most work.

A spreadsheet of results proves nothing about its own integrity. Anyone with the file can change a number, and there is no way to look at the file and tell whether they did. What closes that gap is a signature derived from the data itself: a value computed from the contents such that changing any character anywhere produces a different signature.

That property is what makes a record tamper-evident. It does not prevent someone from altering the file. It makes the alteration detectable, which for evidentiary purposes is the more useful of the two.

What the federal rules actually require

There is a common misconception that HUD prescribes how to run a lottery. It does not, and being precise about this is worth a moment.

Random selection is not a federally mandated method. Federal regulations governing the Housing Choice Voucher program address how applicants are selected from a waiting list without authorizing or prohibiting lotteries specifically. What 24 CFR § 982.202(d) requires is that your admission policy state the system you use:

"The PHA admission policy must state the system of admission preferences that the PHA uses to select applicants from the waiting list, including any residency preference or other local preference."

So a lottery is a permitted local method, not a required one, and the obligation it creates is that your written policy describes it accurately and you follow what your policy says.

Selection cannot turn on protected characteristics. 24 CFR § 982.202(b) prohibits basing admission on age, race, color, religion, sex, national origin, disability, or familial status, among other criteria. A properly run random drawing is one of the cleanest ways to demonstrate compliance here, because a genuinely random process cannot have considered characteristics it never received.

Records must be retained and produced on demand. 24 CFR § 982.158(f) requires PHAs to keep records for at least three years, including "records that provide income, racial, ethnic, gender, and disability status data on program applicants and participants."

And § 982.158(c) is the provision to read twice:

"HUD and the Comptroller General of the United States shall have full and free access to all PHA offices and facilities, and to all accounts and other records... including the right to examine or audit the records, and to make copies."

Full and free access, with the right to audit and copy. That is the standard your lottery documentation has to meet, and it is a three-year window minimum. Longer for LIHTC, and longer still for anything under an active challenge.

(These are the federal HCV rules. LIHTC lotteries answer to state allocating agencies, tribal programs operate under NAHASDA, and municipal inclusionary lotteries follow local ordinance. Check the framework that governs your specific program.)

The question that exposes the gap

Here is a useful exercise. Take your most recent lottery and imagine an attorney asks:

"How do I know these are the results your drawing produced, and not results someone edited afterward?"

Then try to answer it using only documents you currently hold.

Most agencies find that their honest answer is some version of "because we didn't edit them." That is almost certainly true. It is also not evidence. It is testimony, and testimony from an interested party is the weakest form of proof available.

The agencies that can answer that question with a document rather than an assurance are the ones that thought about it before the question arrived.

A practical checklist

Whatever tooling you use, a lottery record should be able to answer all of these:

If you are running lotteries in a spreadsheet today, you can improve your position substantially without changing tools: freeze and archive the input file, export the full draw order rather than just the selections, keep a contemporaneous log, and produce a redacted copy at the same time as the full one. That covers five of the eight rows above.

The row it does not cover is the last technical one: whether anything has changed since. That one is genuinely difficult to solve with general-purpose software, because a tool that lets you edit a file cannot also prove the file was not edited.

Frequently asked questions

How long do we need to keep housing lottery records? Federal HCV rules require a minimum of three years under 24 CFR § 982.158(f). LIHTC programs generally require longer, and state or local programs set their own terms. If a result is under challenge, retain everything until the matter is fully resolved regardless of the minimum.

Does HUD require a specific lottery method? No. Federal regulations do not prescribe a randomization method. They require that your admission policy state the system you use and that you follow it. The method is a local policy decision; the documentation obligation is not.

Can we publish lottery results publicly? Yes, provided personally identifiable information is removed. Many agencies publish a censored results list showing ticket or application numbers and draw positions without names or contact details. Prepare that version at the same time as the full one rather than redacting under deadline pressure.

What makes a record "tamper-evident"? A record is tamper-evident when it carries a value computed from its own contents, so that altering any part of the data produces a different value than the one on file. It does not prevent alteration; it makes alteration detectable.

Is a third-party processor necessary? No. An agency can run a well-documented lottery internally. What an independent processor adds is organizational separation (the entity that ran the drawing has no stake in the outcome) and a record generated outside the agency's own control, which removes the "you could have changed it" objection entirely.

The short version

A housing lottery decides who gets housed. That makes it worth documenting to a standard higher than most administrative processes, and higher than a spreadsheet can reach on its own.

The good news is that the standard is knowable and the components are finite. Six pieces: preserved input, complete draw order, per-entry timestamps, a contemporaneous log, a public-safe copy, and a signature that proves nothing changed. Assemble those at the moment of the drawing, when it costs almost nothing, rather than reconstructing them later, when it may not be possible at all.

Lenora Castrellon is the founder of AuditDraw, which processes housing lotteries as a neutral third party for housing authorities, municipal housing departments, and affordable-housing organizations. AuditDraw has been running real housing lotteries since 2019.

Nothing here is legal advice. Program rules vary by jurisdiction and funding source; your counsel and your funder's requirements govern.