Why it is important to audit the platform every six months

For six months, a lot has changed in iGaming: OS and browser versions, SDKs of payment providers, sanctions lists, regulatory requirements, store policies, botnet attacks, peak loads, team composition. The semi-annual audit captures the platform's "health slice," reduces operational and legal risks, and provides an improvement plan with a projected ROI.

1) Why audit every six months - five reasons

1. Security: new CVEs, L7 attack technique/bots, outdated cipher suites.

2. Compliance: license requirements updates, GDPR/PCI, responsible play (RG) rules.

3. Reliability: SLO drift, time to withdrawal, TTS/FPS regression.

4. Economy: cloud costs/PSP commissions/fraud losses - always "crawl."

5. Team memory: post-morems are forgotten; the audit consolidates processes and knowledge.

2) Inspection areas (pass-through checklist)

Security: TLS/ciphers, HSTS, CSP/SRI, secret management, mTLS, pinning in applications, SAST/DAST, pen test reports.

Data and privacy: PII classification, disk/field encryption, KMS/HSM, retention/DSR, WORM logs.

Payments: idempotence of money, 3DS/SCA, tokenization, webhooks with HMAC/anti-replay, deposit/withdrawal time.

KYC/AML: pass-rate, liveness, sanctions/REP rescreening, STR/SAR processes, accuracy of models/rules.

RNG/RTP & game integration: version control, build hashes, simulation protocol, laboratory reports.

RG (responsible game): visibility of limits/timers, self-exclusion, activity log.

Performance: TTS (time-to-spin), FPS, p95/p99 API latency, live video stability and WebSocket.

Reliability/DR: RPO/RTO, backups, recovery, asset-regions, autoscale, DDoS readiness.

Observability: trace, trace-id correlation, SIEM/UEBA, cash alerts/CCM.

Product/UX/availability: registration/deposit/output funnels, A/B diagram, contrast/screen readers.

Vendors: SLA/uptime, audit reports, country coverage, cost per audit/transaction.

Finance/FinOps Cloud/Computing/CDN Costs, Cache Policies, Cold/Hot Data.

Law and Storas: T&C texts/policies, App Store/Google Play/PWA requirements, cookie banners.

3) How to audit: Process in 10 steps

1. Scope & goals: what part of the platform and what metrics we consider critical.

2. Collection of artifacts: architecture diagrams, access matrix, domain lists, service inventory, SDK versions.

3. Interview: Sec/DevOps/Payments/KYC/Support/Compliance/BI.

4. Technical checks: port/cipher scans, TLS policy, SAST/DAST reports, load tests.

5. Review of logs and metrics: SIEM/Prometheus/Grafana/APM, selective money routes.

6. Sampling user paths: registration → deposit → game → output.

7. Game version control: hash reconciliation, release logs, RTP simulations.

8. Vendor-rating: SLAs, incidents, fines, prices, DR plans.

9. Risk scoring: probability × impact; risk map (High/Medium/Low).

10. Remediation: a roadmap with priorities, timelines and owners.

4) Artifacts that should be "on the table"

System diagram (asset/channels), data flow matrix.

Policies: access (RBAC/ABAC), keys, retentions, IR/DR, depletion.

API/Swagger/Protobuf contracts, money idempotency schemes.

Reports: pen test, RNG/RTP laboratories, KYC/PSP providers.

Post-morems of incidents and a list of open action items.

5) Metrics that show progress

Security: critical vulnerability closure time (MTTR vulns),% covered by SAST/DAST, share of key rotations.

Payments: average deposit/withdrawal time, repetition/take rate, chargeback rate.

KYC/AML: pass-rate, average TTV (time-to-verify), FPR/TPR alerts.

Perf: TTS, p95 latency API box office/games, crash-free, FPS.

Reliability: RPO/RTO tests, success of DR exercises, share of automatic rollbacks.

RG: share of sessions with limits, use of "cooling."

FinOps: $/1000 spins, $/GB egress, CDN hits, micro-cache hit.

6) Semi-annual schedule (example for 2 weeks)

Day 1-2: Scope, checklists, collecting artifacts.

Day 3-5: security, data, TLS/ciphers, pen test batches.

Day 6-7: payments/KYC/AML, webhooks, idempotency of money.

Day 8-9: RNG/RTP/game versions, simulations, cache/perf.

Day 10: DR/Observability/DDoS, FinOps, Vendors.

Day 11-12: Risk summary, roadmap, C-level presentation.

7) Typical finds → fast "wine-wine" fixes

Mixed content and weak ciphers: enable HSTS/CSP/SRI, cut TLS 1. 0/1. 1.

Webhooks replays: add HMAC/anti-replay and 'Idempotency-Key'.

Long TTS: lazy-loading, asset compression, micro-cache 1-10 sec.

Long conclusions: parallel checks, divide queues into KYC/AML, step-up by risk.

No DR rehearsal: quarterly "DR days" + recovery checklist.

Low visibility RG: bring limits/timers to the 1st screen of the cash register.

Cloud spending: CDN cache, cold storage, auto-scale by real metrics.

8) Frequent audit errors

They check "what is convenient," and not "what is critical for money and license."

Report without specific owners/timing → the regiment.

There is no prioritization by risk - everything is "important."

There is no idempotency check of money and duplicate transactions.

Ignoring vendor risks (KYC/PSP/SMS/email) and their DR plans.

Do not share findings with support/affiliates → repeat incidents.

9) How to issue a final report

Executive summary: 1 page, top 5 risks and economic impact.

Risk register: table (risk, probability, influence, control, owner, term).

Technical application: conclusions on sections, logs, tracks, screenshots, test results.

Remediation roadmap: quarterly task grid (Quick wins/Must/Should/Could).

Target metrics: Target SLO/OKRs before the next audit.

10) Mini RACI to audit

Owner: CTO/COO.

Security: CISO/SecEng - security, data, IR/DR.

Payments: Head of Payments — касса, PSP, webhooks.

Compliance: MLRO/Legal - KYC/AML/RG/licenses.

Game Tech: Head of RGS - RNG/RTP/versions, simulations.

SRE/DevOps: pen/observability/scale/DDoS.

BI/FinOps: metrics, cost, reporting.

11) Checklist template (save)

TLS 1. 3/1. 2, HSTS/CSP/SRI, pinning, secrets at KMS/Vault
Database/backup encryption, retention/DSR, WORM logs
Money idempotence, HMAC webhooks, anti-replay
KYC Pass-Rate, Sanctions Rescreen/PEP, STR/SAR Process
RNG/RTP: build hashes, simulations, lab reports
RG: limits/timers/self-exclusion in plain sight
Perf: TTS≤3 c, p95 API, FPS, WebSocket/LL-HLS stability
DR: backups, RPO/RTO test, asset-asset/Anycast/CDN/WAF
SIEM/alerts, money tracing, p95/p99 dashboards
FinOps: $/1000 spins, CDN hit, cold data archive
Vendors: SLA/uptime, reports, prices, DR plans
Stores/right: T & C/Privacy/Cookie, SDK versions, store rules

The semi-annual audit is the rhythm of sustainability. It identifies technical and procedural debt before it turns into incidents, validates compliance with licences and reduces the cost of risk. Audit by a fixed process, with measurable metrics and personal responsibility - and every six months your platform will become faster, safer and more predictable for players, partners and regulators.