An e-gaming platform is a stack, not a single system. Audit only the application and you have checked the shop window. Here is how to scope the full three layers, application, operating system and database, in the cloud.
Marco Cavani
Cybersecurity Analyst
Ask where an e-gaming platform “is” and you will get three answers, all correct. It is the application, the gaming engine, the wallet, the bonus logic, the reporting, delivered as software. It is the operating system and infrastructure that application runs on, the servers, containers and cloud compute beneath it. And it is the database, where every balance, wager and revenue figure is finally recorded. Three layers, stacked, each depending on the ones below.
An audit that stops at the top layer has looked at the shop window and called the shop secure. The controls that actually protect the money, and the integrity of the game, are spread across all three. This article is about scoping the full stack, and about how the cloud quietly changes who owns the controls at each level.
Before scoping anything, it helps to be precise about what each layer is and what can go wrong there.
Miss any one and you have an unaudited path to the money. A perfectly controlled application on an unpatched, wide-open server is not secure; a hardened server whose database anyone can edit directly is not secure either.
Audit only the application and you have checked the shop window. The money lives three layers down, in a database, on an operating system, in someone else’s cloud.
At the top, the controls are application controls, the completeness, accuracy, validity and authorisation of transactions, exactly as an auditor examines them in any financial system. For e-gaming that means the input, processing and output controls over wagers, deposits, payouts, wallet updates and gross gaming revenue, plus access control over sensitive functions like adjusting a balance or configuring a bonus, and change management over the business logic itself.
The SaaS dimension adds a twist. If the platform, or a component of it, is consumed as software-as-a-service from a vendor, the operator no longer controls that layer’s internals and must instead rely on the vendor’s assurance, a SOC 1 or SOC 2 report, read for its scope, period and exceptions, and act on the complementary user entity controls it assumes. Auditing a SaaS layer is therefore partly a review of the platform’s own controls and partly a review of how the operator governs its reliance on the vendor.
One boundary is worth naming: game fairness and random number generation are typically certified separately by accredited testing houses under the gaming regulator’s rules. The financial and IT audit does not re-test the RNG, but it does confirm that the certified components are the ones actually running, and that their outputs flow into the wallet and revenue correctly.
Beneath the application sits the layer auditors most often under-scope, and attackers most often use. The operating system and infrastructure controls are the classic IT general controls applied to the platform’s foundations:
The cloud reshapes this layer more than any other. On infrastructure-as-a-service, the operator still owns the operating system, patching it, hardening it, controlling access, exactly as on-premises. On platform- or managed-service models, the provider takes over the OS, and the operator’s responsibility shifts up to configuration and access. The auditor must know which model applies to each component, because the shared responsibility line moves with it, and a control the operator assumes the provider owns, or vice versa, is a gap by default.
At the bottom is the financial truth: the tables holding player balances, the transaction ledger and the revenue figures. This is where an e-gaming audit either earns its assurance or fails to. The critical controls are the ones covered in depth in the SOC 1 for iGaming article, and they bear repeating:
The database is the layer where the whole stack’s integrity is finally decided, which is exactly why it must never be the layer an audit skips.
Across all three layers, the same IT general controls recur, access, change management and operations, applied at each level, and the same cloud question recurs, who owns this control, us or the provider. That gives a clean way to scope a full-stack e-gaming audit:
Do that, and “full scope” stops being a phrase and becomes a map.
An e-gaming platform is three layers deep, and the money can only be trusted if all three are controlled: an application whose transactions are complete and authorised, an operating system that is hardened, patched and access-controlled, and a database where the financial truth cannot be altered without a trace. The cloud does not remove any of these responsibilities; it moves the line of who owns each one, which is precisely why the auditor must trace it deliberately rather than assume it. Scope the full stack, follow the data down to the database and the responsibility across to the provider, and the assurance is real. Stop at the application, and you have audited the shop window while the vault stayed unopened.
Written by
Marco Cavani
Cybersecurity analyst and IT governance professional. Author of digital reports on threat intelligence, critical infrastructure security, and IT audit frameworks.
In an online gaming platform the financial truth lives in a database, and that database increasingly lives in the cloud on infrastructure the operator does not run. Here is how a SOC 1 gives assurance over it, and what an auditor actually tests.
For a SaaS company, a SOC 2 is the report a serious customer wants before they trust you with their data. Here is what the Trust Services Criteria actually mean, how SOC 2 differs from SOC 1, and how to read one properly.
In 2022, the Lapsus$ group compromised Microsoft, Okta, Samsung, and Nvidia by spamming push MFA notifications until tired users approved. Cloudflare was also targeted. Their FIDO2 hardware keys made the attack irrelevant. Authentication is the control that decides which outcome you get.
Get the latest cybersecurity reports, threat intelligence, and IT governance insights delivered straight to your inbox. No spam. Unsubscribe any time.
No spam. Unsubscribe at any time.
The RACM ITGC SaaS platform helps audit professionals manage IT General Controls assessments, from risk and control mapping to workpaper generation and evidence tracking.
