iGaming security audit: define scope and close findings

Which framework and systems are in scope?

The UKGC’s security-audit advice identifies an independent annual audit requirement for specified remote licence types. Its RTS security requirements reference relevant ISO/IEC 27001:2022 controls and define critical-system scope.

Confirm applicability before commissioning work. List the systems that process customer information, balances, game state and other relevant records. Include outsourced components and the interfaces the operator controls.

How are different assurance activities distinguished?

A penetration test examines particular technical weaknesses. A management-system certificate concerns its defined certification scope. A regulatory audit assesses the specified obligations and evidence. These activities can support each other but are not interchangeable.

Ask an auditor to explain the framework, systems, period and evidence to be assessed. Avoid a proposal that promises “full compliance” without naming the scope or excluded dependencies.

What evidence should be prepared?

Organise evidence by control and responsible owner.

• Asset and data-flow inventories.
• Access provisioning, privileged access and removal records.
• Change management and release approvals.
• Vulnerability management and remediation tracking.
• Logging, monitoring and incident-response evidence.
• Backup and recovery test results.
• Supplier assurance and the operator’s retained controls.

How should supplier certificates be used?

Read their scope, period and exclusions. A data-centre certificate may support part of the assessment while leaving the operator’s account configuration and access management unexamined.

For example, secure infrastructure does not prove that former staff access was removed from an application. Map each assurance document to the control it actually supports and identify what evidence the operator must still provide.

What should happen after findings are issued?

Give each finding an owner, action, due date and evidence of closure. Distinguish a risk formally accepted through the appropriate process from work that is simply overdue.

Retest where necessary and preserve the final audit pack. Management should understand material unresolved issues and their operational implications. The value of the audit is in improving and evidencing the controls, not merely obtaining a report for a filing deadline.