What the MGA system audit is for
The MGA expects license holders to prove two things. First, the systems they use to run gaming are set up and run as described in their application. Second, those systems meet the Authority's technical and security rules. An independent firm approved by the MGA carries out the system audit. It focuses on the critical parts of your gaming system and where they are hosted.
Rules and approved auditors change over time. So always confirm the current scope and process in the MGA's published guidance, and with your auditor, before you start.
Checklist: documentation
- A diagram of your system showing every critical part and where it is hosted
- Diagrams showing how player data, money and game results move through your systems
- A list of suppliers: platform, game providers, payment providers and hosting
- Your security policy and the policies under it (access, change, incident, backup)
- Plans to keep the business running and recover from a disaster, with test results
- Who does what, including who owns security and compliance
Checklist: technical controls
- A separate account for each person, MFA (a second login step, such as a code on your phone) and least privilege (only the access each person needs). This matters most for back office and admin tools
- A process for staff who join, move roles or leave, with proof that old access was removed
- Logs of key actions (balance, bonus and limit changes, admin logins), stored so they are hard to alter
- All systems set to the same clock, so logs line up
- Network segmentation (walling off critical systems from the rest of the network) and firewall rules around them
- Player data encrypted (scrambled so outsiders cannot read it) when it is stored and when it is sent
- Regular security updates (patches) and checks for weak spots, with recent scan results
- A recent penetration test, where an expert tries to break in with your permission. It should cover the player site, cashier, back office and APIs (the links between apps), with fixes tracked
- Backups that are tested, not just scheduled
Checklist: before the auditor arrives
- Walk through how the system is built with the people who will be interviewed.
- Collect evidence in one folder: screenshots, settings exports, tickets, logs and reports.
- Make sure what is running matches what you described to the MGA.
- Fix high-risk findings from your penetration test and scans, and keep the evidence.
- Agree how the auditor will get into the systems and documents they need.
Start six to eight weeks ahead if this is your first audit. Gaps found early cost far less than findings in the final report.
How NextGarrison helps
We are not an MGA-approved auditor. We get you ready for the audit: a gap check against the list above, penetration testing, access and logging fixes, and a tidy evidence pack. We do the same for the UKGC security audit and for GLI-19 lab testing. See our iGaming security services.
Need a hand with this?
Talk to a senior consultant. We reply within one business day with clear next steps and a scoped quote.
Written by
NextGarrison Security TeamPenetration testers, SOC analysts and compliance consultants
Our consultants test applications and networks, run 24/7 security monitoring and prepare companies for SOC 2, ISO 27001 and PCI DSS assessments. We write about what we see in real engagements, in plain English.