Audits and Certification

Many audits, different questions

A licensed online operator in a mature market can easily face eight or ten different audits a year. Internal audit reviews a process. The statutory auditor signs the accounts. A security auditor tests against an information security standard. A test house certifies games and random number generators before release and audits change control afterwards. An AML auditor reviews the financial crime framework. A regulator-approved auditor checks compliance with licence conditions. Payment partners and banks run their own due diligence. Each one asks for documents, interviews people and produces a report with findings.

The common mistake is to treat these as interchangeable, or as a burden to be got through. They are neither. Each audit answers a specific question for a specific audience, and the evidence one produces is often usable by another. A business that understands what each audit is for can prepare once, reuse evidence, and use the findings as part of its own assurance rather than as a series of unrelated to-do lists.

This lesson takes the main types in turn and then sets out how to prepare. As a map of the territory, the main types compare as follows.

Two practical consequences follow from the table. Each audit has a different scope, so a clean result in one says nothing about the others. And each has a different audience, so the same finding can carry very different consequences depending on whose report it appears in.

Internal audit

Internal audit is the third line described in lesson 1: an independent function, reporting to the board or its audit committee, that gives assurance on governance, risk management, compliance and control. The profession's standards are the Institute of Internal Auditors' Global Internal Audit Standards, issued in January 2024 and effective from January 2025, which organise the discipline into five domains and fifteen principles, among them being positioned independently, being overseen by the board, and communicating engagement results and monitoring action plans.

For a gambling business, internal audit's value is that it can audit the second line. Compliance monitoring tests whether the first line's controls work. Internal audit can ask whether the monitoring programme itself is risk-based, whether its sampling is sound, whether findings are closed properly, and whether the board is getting an accurate picture. Nobody else in the organisation is positioned to ask those questions.

Smaller operators often outsource internal audit to an accounting or advisory firm. That is legitimate, but the IIA's 2026 statement on the three lines is clear that outsourcing does not change the board's accountability for the activity being effective and independent. An outsourced internal audit that reports to the chief financial officer and audits only what the CFO asks it to audit is not a third line.

Statutory and financial audits

The statutory audit of the financial statements is the most familiar and the least directed at compliance. The auditor's opinion is on whether the accounts give a true and fair view. That said, it touches regulatory matters at several points: the treatment of customer balances and segregated funds, gaming tax and duty liabilities, provisions for regulatory penalties, and disclosure of contingent liabilities from investigations.

Several regulators extend the statutory audit with specific regulatory assurance. The Malta Gaming Authority's Directive 3 of 2018 requires audited financial statements within 180 days of the year end and separate auditor assurance on gaming tax, licence fees and player funds. The MGA's FAQs on agreed-upon procedures reports (version 1, September 2022) explain that these reports on player funds and gaming revenue follow the international standard for agreed-upon procedures engagements, ISRS 4400 (Revised), and are submitted annually no later than six months after the financial year end.

An agreed-upon procedures report is worth understanding because it is not an opinion. The auditor performs specific procedures agreed in advance and reports what it found, without concluding whether the whole is compliant. Reading one as a clean bill of health misunderstands it.

Regulator-mandated compliance and systems audits

Some regulators require compliance or systems audits by auditors they approve, which sit somewhere between an internal audit and an inspection.

Malta. The Gaming Compliance and Enforcement Regulations (S.L. 583.06) allow the MGA to require any authorised person to undergo a compliance audit "on a regular or ad hoc basis", and recognise only audits by auditors the Authority has approved. The MGA's Approved Audit Service Provider Policy (version 5, November 2022) describes the main types: a systems audit as part of licence onboarding or when deemed necessary; a systems review, "generally carried out one year after the licence issuance"; and a compliance audit carried out "throughout the licence period as required by the Authority". The policy treats services provided to the licensee in the previous two years, including internal audit services, as a conflict of interest, and the MGA approves each engagement. The firm that designed your controls cannot audit them.

New Jersey. The internet gaming rules at N.J.A.C. 13:69O-1.2 require each casino licensee offering internet gaming to perform "an annual system integrity and security assessment conducted by an independent professional", subject to approval by the Division of Gaming Enforcement. The report must include the scope, the assessor, the date, the findings, recommended corrective action and the licensee's response. That last element is easy to overlook: the regulator expects to see the response, not only the findings.

Spain. Royal Decree 1613/2011, on the technical requirements for gaming, requires the technical gaming systems to be audited every two years, by a recognised entity different from the one that carried out the last certification. If a favourable report is not filed in time, the regulator provisionally suspends the operator's activity and begins revocation.

The common thread is rotation and independence. Regulators that rely on third-party audits design rules to stop the same firm becoming too comfortable with the same licensee.

Information security audits

Information security is where gambling regulation most directly borrows an international standard. ISO/IEC 27001:2022 sets requirements for an information security management system, and it is the basis of several regulators' security requirements.

In Great Britain, the Gambling Commission's testing strategy requires a full annual security audit by an independent auditor for a defined list of remote licences, including remote casino, remote bingo, remote pool betting and remote lottery licences with entries above £250,000 a year. The requirements are "based on relevant sections of ISO/IEC 27001:2022", and licensees must satisfy themselves that the auditor "is reputable, is suitably qualified to test compliance with ISO/IEC 27001:2022 and that the auditor is independent from the licensee". The scope covers systems that process customer data, random number generation, game results and state, points of entry and exit, and communication networks. Where the audit identifies major non-conformities, the licensee must send it to the Commission within seven days of receiving it.

Two points are worth drawing out. First, the regulatory audit is against the regulator's security requirements, which are based on ISO 27001; it is not the same thing as holding ISO 27001 certification, although a certified business will find the audit easier. Second, the seven-day rule means a security audit with major findings is effectively a regulatory notification. Plan for that before the auditor arrives, not after.

Certification itself runs on a cycle. BSI, the UK national standards body, describes the usual certification process as stage 1 and stage 2 audits, surveillance audits during the three years of the certificate's validity, and recertification at the end.

Game, RNG and system certification

Technical certification answers a narrower question: does this game, random number generator or system do what it claims and meet the technical standard?

In Great Britain, licence condition 2.3.1 requires compliance with the Commission's technical standards and its testing requirements. The procedure for testing requires games and RNGs to be tested by a Commission-approved test house before release, covering game design, maths, rules and theoretical return to player, and for RNGs, documentation, source code and statistical testing of output. Updates that do not affect game fairness are minor and can be released without external retesting, provided change control is followed and recorded. The annual games testing audit then has an approved test house check a random sample of major and minor updates, to confirm whether they did or did not need external testing, and that change controls were followed. The results are counter-signed by the relevant personal management licence holder and submitted to the Commission.

That design is a good model of assurance. The licensee is trusted to classify its own changes, and an independent party later tests a sample of those classifications. A business that misclassifies a fairness-affecting change as minor will be found in the annual audit, and a PML holder will have signed the result.

Elsewhere the principle is similar. Ontario's Registrar's Standards require games, RNGs and system components to be approved by the Registrar or certified by an independent testing laboratory registered by the Registrar before they are provided. In April 2023 the AGCO penalised three operators a combined $70,000 for offering slot games that had not been certified. The Netherlands requires the gaming system to be fully certified before use, with planned changes also certified.

Test houses publish their technical standards. GLI's standards library lists, among others, GLI-19 for interactive gaming systems and GLI-33 for event wagering systems, both of which include appendices for operational audits of procedures and technical security controls. eCOGRA describes its game testing as verifying that the RNG produces random and unbiased outcomes and that RTP percentages are calculated correctly. The casino game mathematics course explains RTP and RNGs in detail, and the glossary covers certification and the RNG.

AML independent audits

Most anti-money laundering regimes require independent testing of the AML framework, proportionate to the business.

In the UK, regulation 21 of the Money Laundering Regulations 2017 requires a relevant person, where appropriate to the size and nature of its business, to "establish an independent audit function" responsible for examining and evaluating the adequacy and effectiveness of its policies, controls and procedures, making recommendations, and monitoring compliance with those recommendations. The obligation does not end with the report: monitoring whether recommendations were implemented is part of it.

In the United States, the casino AML programme rule at 31 CFR 1021.210 requires "internal and/or external independent testing for compliance", with scope and frequency "commensurate with the money laundering and terrorist financing risks posed by the products and services provided by the casino". FinCEN has penalised casinos for failing this element; its 2011 penalty against a Minnesota tribal casino cited failures in internal controls, adequate independent testing and training. The AML and Financial Crime course covers the framework being tested.

The value of an AML audit is entirely in its independence and its depth. One that reviews the policy, interviews the MLRO and samples ten customer files will produce few findings and tell the board little. One that re-performs alert reviews, tests source of funds conclusions and checks that risk ratings change anything will be uncomfortable and useful.

Preparing for any audit

The preparation is similar whatever the audit, and most of it should already exist if the monitoring programme in lesson 2 is working.

Before. Agree the scope, period and deliverables in writing. Identify every obligation and control in scope from the obligations register. Collect the evidence index: where each record lives and who can extract it. Brief control owners on what will be asked and who answers. Check previous findings from any audit covering the same area, and be ready to show what was done about them, because the auditor will ask.

During. Appoint one coordinator who logs every request, the date it was made, who is responsible and when it was answered. Provide what is asked for, promptly and accurately, and nothing misleading. Let the auditor extract data directly where possible, because evidence the auditor pulled is more persuasive than evidence the business supplied. Raise disagreements about facts early, with evidence, rather than at the draft report stage.

After. Agree management responses that address the cause, not just the condition. Put every action into the same remediation tracker used for internal findings, with owners and dates. Validate closure independently. Tell the regulator where a report must be submitted or where findings are reportable, on time.

Reusing assurance

An assurance map, as described in lesson 1, lets one piece of work serve several audiences. A well-documented ISO 27001 certification reduces the work of the regulatory security audit. A test house's annual change control audit is evidence for internal audit's review of the release process. The AML independent audit informs the compliance monitoring plan.

Reuse has limits. The IIA's three lines statement describes external audits and regulatory inspections as serving external parties, and an assurance provider can only rely on another's work if it understands that work's scope, independence and quality. An ISO certificate covers the scope written on it, which may not include the gaming platform. A clean AUP report says what was tested, not that nothing else is wrong. Reading the scope before relying on the result is the discipline that makes reuse safe.