Governance and Building the Assurance Function

Assurance is a governance product

The earlier lessons built the parts: an obligations register, a monitoring programme, controlled reporting, audits used well, a disciplined approach to regulators, and an understanding of what happens when it all fails. None of those parts works on its own. They work when the people who run the business receive what they produce, understand it, and act on it.

That is governance, and it is where gambling regulators increasingly direct their attention. The Gambling Commission's National Strategic Assessment 2020 put it plainly: within gambling companies, "the culture, strategic direction, and oversight start with the ownership and Board of Directors", and "We expect Board members and senior Executives to ask questions, scrutinise regulatory outcomes and intervene to ensure compliance with the licence conditions." Ontario's Registrar's Standards for Internet Gaming state that "primary accountability for compliance resides with the Board", and require an internal audit function that regularly audits the control environment and compliance management framework, independent from operational management.

This final lesson covers how boards and committees receive assurance, what useful management information looks like, how to position, resource and equip the function, and the culture that decides whether any of it is real.

What the board must be able to do

A board cannot test controls itself. It can do four things, and the assurance function exists to make them possible.

1. Set appetite. Decide how much compliance risk the business will accept, in which areas, and what it will not accept at any price.
2. Know the position. Understand, at any time, where the main compliance risks are, how well they are controlled, and what is going wrong.
3. Challenge. Ask why, ask for evidence, and ask what has not been looked at.
4. Intervene. Change resources, priorities, products or people when the position is unacceptable, including when that costs revenue.

The governance failures in the published record are usually failures of the second and fourth. The Victorian Royal Commission into the Casino Operator and Licence, reporting in October 2021, found that Crown Melbourne's board had failed "to ensure that the organisation satisfied its legal and regulatory obligations", and offered two explanations: "Perhaps the board was not told what was going on", or the board "fell asleep at the wheel". Either way, information was not reaching the people with the power to act, or it was reaching them and they did not act.

Listed companies face a parallel expectation from corporate governance codes. The UK Financial Reporting Council's UK Corporate Governance Code 2024 applies on a comply or explain basis to companies listed in the commercial companies category in London, and its Provision 29, applicable from 1 January 2026, asks boards to monitor the risk management and internal control framework, review its effectiveness at least annually, cover "all material controls, including financial, operational, reporting and compliance controls", and include in the annual report a declaration of the effectiveness of material controls at the balance sheet date. The FRC's Provision 29 guidance note of January 2026 reports that most companies are identifying "somewhere between 30 and 50 material controls", and notes that the Code does not require testing of material controls to be supported by external assurance: "this is a decision for the board and management". For a listed gambling group, regulatory compliance controls are an obvious candidate for the material list, and the monitoring programme in lesson 2 becomes part of the evidence for the board's declaration.

Committee structure

Most licensees route compliance assurance through one or more committees rather than the full board. Common patterns:

• Audit committee. Receives internal audit, external audit and often compliance reports. Strong on financial reporting, sometimes weaker on the detail of gambling regulation.
• Risk and compliance committee. A separate board committee focused on regulatory risk, safer gambling and financial crime. Increasingly common at larger operators.
• Executive compliance committee. A management-level committee, chaired by the chief executive or chief operating officer, where first-line owners answer for findings and actions, reporting up to the board committee.

Whichever structure is used, a few features matter more than the labels. The head of compliance and the MLRO should attend the board-level committee as of right and be able to meet its chair without executives present. Internal audit should have the same access. Minutes should record challenge, not only noting: "the committee asked why the overdue actions had increased and requested a recovery plan by the next meeting" is evidence of oversight; "the committee noted the report" is not. Regulators read minutes, and in Ontario the AGCO's notification matrix asks for board, audit committee and compliance committee minutes to be submitted quarterly.

Management information that means something

Most compliance reporting to boards is activity reporting: reviews completed, policies updated, training modules delivered, alerts processed. It describes effort. A board reading it cannot tell whether the business is more or less compliant than last quarter.

Useful compliance MI answers four questions.

Some practical rules make MI honest:

• Show trends, not snapshots. One quarter's number tells the board nothing without the previous four.
• Rate against defined criteria. A red, amber, green rating must have written thresholds. Ratings that drift towards green because nobody wants to report red are a known failure mode.
• Report exceptions in full. If three self-excluded customers received marketing, say three, say how, and say what is being done, rather than reporting "self-exclusion control: amber".
• Include the "where are we blind" section. It is the section most often missing and the one that protects the board, because it records that the board was told where assurance did not reach.
• Keep it short. A twelve-page pack the committee actually reads beats a ninety-page pack it notes.

Recall the Platinum Gaming outcome from lesson 6, where the Commission's Director of Enforcement called for "structured reporting and board level oversight". Structured reporting means MI built around these questions.

Independence and positioning

The assurance function only works if it can report bad news without consequences for the people reporting it.

In Great Britain the head of compliance is a specified management office under licence condition 1.2.1, requiring a personal management licence at licensees above the small-scale threshold, and the Commission's licensing policy states that "the person who occupies the Head of Compliance role will not normally also occupy one of the other specified management offices". Malta's Directive 3 of 2018 lists compliance, the prevention of money laundering and internal audit among the key functions for which the MGA approves a responsible person.

The IIA's 2026 statement on the three lines sets out the elements of organisational independence, and they apply to a compliance function as much as to internal audit: reporting lines and the mandate to escalate without restriction; autonomy over scope and planning; unrestricted access to information, people and systems; control over sufficient resources, with resource limitations reported; and protection from retaliation or undue influence. Tested against those, a compliance function whose head reports to the chief commercial officer, whose monitoring plan is approved by the people it monitors, and whose budget is cut whenever findings are inconvenient is not independent, whatever the organisation chart says.

A practical test: has the head of compliance or the MLRO, in the last year, stopped or changed something commercially valuable, and did the board hear about it? If the answer is never, either the business is unusually well controlled or the function lacks the authority to act.

Resourcing

There is no regulatory formula for the size of a compliance function, and there should not be. The right size follows from the obligations register and the monitoring plan: how many obligations, across how many licences, how many controls need testing at what frequency, and how much regulator contact the business attracts.

Three resourcing mistakes recur.

All advisers, no testers. A team of regulatory specialists who answer questions and write policies, with nobody whose job is to test. The advisory work crowds out monitoring every quarter.

No data skills. Modern monitoring depends on querying platform data directly. A function that has to ask the data team for every extract, and wait weeks, cannot run full-population tests or keep up with a regulator that analyses transaction data itself.

Capacity hidden from the board. The monitoring plan quietly shrinks to fit the team, and the board is told the plan was delivered. The IIA's standard that resource limitations be reported exists for this reason. If the plan has been cut, the "where are we blind" section should say so.

Outsourcing parts of the work, such as specialist testing or a periodic independent review, is reasonable. Outsourcing the accountability is not possible, as lesson 1 noted.

Regtech and automation

Tools help most where volume is high and rules are clear: maintaining the obligations register and tracking regulatory change; automated controls testing that queries full populations on a schedule; case management for findings and actions with ageing and audit trails; screening and transaction monitoring; and data quality checks on regulatory feeds.

Three cautions apply. A tool implements the logic it is given, so a wrong threshold automated is a wrong threshold applied consistently. Automated monitoring needs its own assurance: someone must test that the queries still return what they should after each platform change, because a monitoring query that silently stops matching is the same failure as a control that silently stops working. And dashboards do not own risk. A green dashboard nobody understands is not oversight.

Regulators are investing in the same capabilities. The Dutch regulator describes its supervision as risk-based and data-driven. A licensee whose monitoring is less automated than its regulator's analysis should expect the regulator to find things first.

Culture

Every published governance failure is, in the end, a culture failure: information that was available and not escalated, or escalated and not acted on, because the incentives pointed elsewhere. When FinCEN imposed an $8 million penalty on a California card club in November 2017, it cited a "deficient culture of compliance" alongside the failure to implement adequate internal controls and the failure to file suspicious activity reports on activity the club knew about.

Culture is hard to measure directly, but its symptoms are observable:

• Who gets rewarded. If bonuses depend only on revenue and the compliance consequences of revenue never reach a performance review, the incentive is clear.
• What happens to bad news. Whether a manager who reports their own control failure is thanked or blamed decides whether the next one is reported.
• Where commercial and compliance views conflict. Whether the conflict is resolved by the facts or by seniority.
• How findings are received. As information to act on, or as an attack to be negotiated down.
• Whether senior people know the detail. The UK casework on personal licences, discussed in lesson 6, repeatedly found holders who could not explain decisions in their own areas.

The assurance function influences culture mainly by being consistent: rating findings on criteria, reporting them as they are, and showing that issues raised early are treated better than issues found late.

A maturity model

A simple way to locate a function and plan the next step:

Most licensees sit between levels 2 and 3. The jump that matters most is from 2 to 3, because it is the point at which the business can show a regulator that it finds its own problems.

The first ninety days

For someone taking over or building an assurance function, a workable sequence:

1. Weeks 1 to 3. Read the last two years of regulator correspondence, assessments, enforcement and audit reports. Read the board and committee minutes. List every open finding and action, from any source, in one place.
2. Weeks 3 to 6. Build or validate the obligations register for the highest-risk areas first: safer gambling, AML, self-exclusion and marketing suppression, regulatory reporting. Map controls and owners.
3. Weeks 6 to 9. Run three quick full-population tests on the controls that have caused enforcement elsewhere. Test the key event process against the SAR log and incident log. Reconcile the last regulatory return to source.
4. Weeks 9 to 12. Present the board committee with an honest baseline: what is known to work, what is known to be broken, where assurance does not reach, and a risk-based plan with the resources it needs.

The baseline will be uncomfortable. It is also the document that will matter most if a regulator asks, a year later, when the business knew and what it did. The other compliance courses on the Learning Hub, including AML and Financial Crime, Responsible Gambling and Marketing Compliance, set out the rules this function exists to prove are being kept.