The Importance of an Annual Audit

Compliance is slowly but surely being recognised as a central and essential component for all gambling operators. It has been a long road; the boring cousin to the excitement of product innovation or technology. However more and more operators are realising the power of compliance and the relative ease of placing it front and centre of operations, at least when looking at the big picture and the potential cost implications of treating it as an afterthought.

The problem is that compliance is an easy word to throw around, but what does it really mean? The answer to this question - of course - is nuanced. Not only is it nuanced, but it evolves. It is an ever-changing concept and the goalposts are regularly moved. The role of Compliance Officer, or a Compliance Team, is therefore increasingly difficult. Most industries that require this high-level of compliance require a regular audit process. The reasons for this are multi-faceted, and I will examine a few of these here, along with some suggestions for a meaningful and successful audit regime. 

Why are audits so important?

The principal reason is simply regulatory compliance. A key step in ensuring compliance across the board and the final line of defence if you subscribe to the three lines of defence operational model, not to mention a crucial line of defence if later questioned by a regulator.

The audit outcomes can provide vitally important information. Identifying areas of non-compliance is the most obvious! Or spotting areas which are drifting towards non-compliance or a grey area, ideally before any regulatory intervention. Ensuring funding is being used appropriately, proportionately and effectively is another serious benefit. 

Regulators also value and appreciate the importance of a robust audit process. Independent Security Audits and Games Testing Audits are mandatory for applicable operators in the UK, and the Anti-Money Laundering and Counter Terrorist Financing Risk Assessment serves as a kind of AML audit for all UK operators. The Malta Gaming Authority requires various Systems Audits and Compliance Audits using an approved Audit Service Provider, along with monthly B2B Compliance Reports, direct to the MGA. These are simply two examples; it is clear that a number of regulators implement an audit process of sorts and see the clear benefits of doing so.

The UK’s stance on audits is becoming increasingly clear, as an ever-growing list of operators now have the following condition, or words to this effect, on their licence:

Licensee to conduct a third-party audit within 12 months to examine whether the Licensee is effectively implementing its anti-money laundering and social responsibility policies, procedures and controls

Why are audits so helpful?

Audits are revealing and knowledge can be powerful. Are your staff members actually taking their training on board? Are the fancy, 1,000-page policies being implemented? Is there a true culture of compliance or is it ignored or mocked? Is the Compliance Committee actually doing anything? Does the Compliance Committee even have the right people on it? Is the reporting honest and accurate? Is there genuine buy-in on compliance across the company?

If the foundations are not right - no compliance committee, no training plans, no corporate governance - then the culture of compliance cannot grow. A strong culture of compliance does not happen overnight; it is normally a result of persistence and patience.

Stress testing of systems can also produce answers to a number of important questions, such as how easy is it to create fake accounts? Is it possible to bypass verification procedures? A meaningful audit can reveal potential problems in previously unexamined areas, and prevention tends to be easier than cure. Missed opportunities, hidden pitfalls and clarity of operations are all helpful outcomes of a good audit.

How to carry out a successful audit

1. Planning the Audit

The first step is to consider how and when an annual review is conducted. The UK Gambling Commission’s ever-popular licence condition might be a particularly compelling reason for some. For others, and perhaps those wanting to avoid the need for this condition, make sure your policies and procedures detail the audit. Who will carry it out – internal or external? How will it be conducted, what will be examined, how will it be recorded and how will changes be implemented?

The first question posed, internal or external, is an interesting one. Firstly, consider the organisation itself. The size, structure and nature of the operations. If the organisation is multi-national, multi-product and multi-team, perhaps there is an ‘independent’ internal team who are well placed to conduct a smaller audit on a different area of the business. If the organisation is smaller in size, limited to one jurisdiction and has a single central operations team, it is unlikely to have any individuals well placed in terms of independence to conduct a meaningful audit. It is difficult to truly audit yourself; non-executive directors or similar can, of course, help.

An external team can provide fresh eyes, fresh outlooks and a level of authority which does not bow to the commerciality of financial considerations. Not to mention the obvious regulatory advantage of independence. However it is an additional cost, and not always required for an audit. 

2. Carrying out the Audit

The second step is to consider the audit itself. A three stage approach is normally most appropriate: a paper review of policies and procedures, interviews with key personnel and operational oversight or analysis. The first two are self-explanatory, the final stage tends to mirror that of a UK Gambling Commission Compliance Audit with a deep dive into systems and customer records. 

3. Reporting and Implementation

The final step, perhaps the most important, is the findings and their implementation. An audit must delve into the organisation’s operations and stress test its policies and procedures. If these are not working, discover why not and what changes need to be made. Key personnel must be identified who can take ownership of the implementation stage and follow up with the right people at the right time. 

Don’t forget to be mindful of any reporting duties to a regulator at this stage.

What to Avoid…

Common pitfalls of an annual audit are treating it simply as a box-ticking exercise. Nothing in the world of gaming stands still and compliance is no different; what was satisfactory last year (whether as an exercise or an analysis) is unlikely to be enough this year. 

Furthermore, if you conduct a box-ticking exercise with an eloquent report at the end detailing how marvellous your systems are, only to discover later down the line an area of non-compliance, that’s an own goal.  Not to mention the potential added costs of discovering a problem too late, whether that’s a regulator fine or simply third-party services at an urgent rate. 

Conclusion

Many operators, particularly those learning the rewards of placing compliance at the front and centre, relish an audit. A chance to put your teams through their paces and find out where the holes are – before someone else points them out.

Staying compliant is easier than recovering from compliance failures, and fixing smaller problems is easier than fixing big ones. When you put it in these terms, suddenly an annual compliance audit seems like a no-brainer…

---

Bio: Amanda is a Partner at Woods Whur, a specialist licensing and gaming law firm based in the UK. She regularly advises a wide range of operators on all gambling matters, with a particular focus on regulatory and compliance concerns.

Explore these and other topics at Eventus International’s upcoming events: https://www.eventus-international.com/