What can supply chain assurance tell operators beyond the contract?
Chantelle Turton, Former Gambling Inspector with GSC and Regulatory Compliance Manager at eGaming Integrity, explains why supplier contracts and policies tell only part of the story and how supply chain assurance gives operators evidence of what happens in practice.
A supplier can give an operator all the right answers during onboarding. The paperwork can all look right too. Policies are approved, contracts are signed and the supplier explains how its controls work.
The tougher question comes later. What evidence does the operator have that those controls are still operating as expected?
The contract is the starting point. After that, supply chain assurance gives the operator a way of knowing whether the supplier is actually working as agreed. That means looking for current evidence of what is happening in practice.
The contract only tells you so much
On paper, a supplier can look absolutely fine. Everything has been agreed, signed off and filed away.
In my opinion, you should always be “audit ready”. Following your policies and operating your controls shouldn’t suddenly become a priority because an audit or review is coming up. It should be part of the way you operate every day. If a supplier has to spend weeks getting its processes and evidence in order because it knows someone is coming to check, that can be an indication that compliance isn’t fully embedded into its day-to-day operations.
This is where compliance testing and ongoing monitoring play an important role. Having a policy or contractual requirement in place is only the first step. You need to be able to test whether the control is actually operating as intended.
That testing should be risk-based and proportionate to the supplier and the specific relationship. Not every supplier presents the same level of risk, so I wouldn’t expect every supplier to be subject to exactly the same level or frequency of assurance.
What does good evidence look like?
The first thing I would ask is what you have beyond the policy.
Evidence that demonstrates what is actually happening, rather than simply describing what should happen, is the evidence I would trust most. The strongest evidence is current, independently verifiable and directly linked to the control we are trying to assess. It doesn’t necessarily need to be extensive. It needs to clearly show whether the control is operating as intended.
That could include recent compliance testing results, management information, system or control records, incident and remediation records, audit or assurance reports and evidence of ongoing monitoring. The type of evidence required will depend on the control being assessed and the risk associated with the supplier.
I would also check whether the evidence lines up with what the supplier has told us and what we relied on at onboarding. If something doesn't line up or there are gaps, that can tell you as much as the evidence itself.
The response to a control failure can also tell you a lot. If a supplier can show that an issue was identified, escalated, investigated, remediated and then retested, that gives you evidence that the control environment is being actively managed rather than simply existing on paper.
This is where you find out if it really works
You can test a number of controls in practice rather than simply accept them at face value. This could include jurisdictional restrictions, website and game availability, licence information, customer-facing requirements and where games are actually being distributed through the wider supply chain.
For example, where an operator relies on a platform provider, aggregator, or game reseller, periodic, risk-based monitoring of downstream websites can help establish where its games are actually appearing and whether that remains consistent with the arrangements assessed and agreed. This could identify a new intermediary, sub-licensee or website that wasn’t previously known or assessed, something that may not be apparent from the supplier’s onboarding documentation alone.
The recent Gambling Commission settlement with Evolution Malta is a good example of why this type of testing and monitoring matters. The Commission found that five genuine Evolution games had appeared on six websites operated by two operators that were unlicensed by the Commission but accessible to consumers in Great Britain. It identified weaknesses in Evolution’s third-party risk assessment and found that its policies, procedures, and controls were not effective in ensuring its games were available in Great Britain only through Commission-licensed operators.
What I think is particularly relevant from a supply chain assurance perspective is whether operators know all the sites their games appear on and whether they have procedures in place to monitor this periodically.
It isn’t enough to know who your immediate supplier is. You also need to understand what is happening further down the supply chain. If a supplier relies on third parties or sub-licensees to distribute your games, that should form part of the risk assessment and ongoing assurance.
The most valuable assurance comes from testing the point where the control meets the real world. That’s where you can find things that a policy, contract or onboarding questionnaire simply cannot show you.
When the story starts to change
Ongoing compliance testing can identify where something no longer matches what you were previously told. I wouldn't automatically assume that a discrepancy means a control has failed. There may be a reasonable explanation, such as a change in technology, a new third party or a change in how the service is delivered.
The first step is to go back to the supplier with specific evidence and ask what changed, when and why, and whether the change followed their change management process.
For example, a supplier had previously confirmed that a particular provider was responsible for implementing geo-blocking controls on the operator’s games, but a later review identified that the underlying provider had changed. The supplier explained that this was part of a planned technology change and provided details of the new arrangement.
Geo-blocking was one of the controls we’d relied on in our original assessment. The provider had changed, and we didn’t know if the replacement could do the same job. We also needed to see whether anyone had reassessed the control. With those questions unanswered, we couldn’t carry the original assessment forward.
What do you do with what you find?
The response should be proportionate to what you find and the risk it presents. Not every finding will require the same response. If something is a minor issue with a straightforward explanation and no material impact on the control environment, it may simply need to be documented and monitored.
Where a finding indicates that a control isn't operating as expected, I would want to understand the root cause, what the supplier proposes to do about it and whether the issue could affect other areas of the relationship.
If the finding changes our understanding of the supplier's risk, or highlights a risk that wasn't previously identified, that's when I would go back to the risk assessment and consider whether the supplier's risk rating or ongoing assurance requirements need to change.
I also think it's important to agree on the remediation and follow it through. Depending on the finding, that might mean asking for more evidence, increasing monitoring or retesting the control.
It is also important to document findings over time. Something that looks relatively minor in isolation may, when considered alongside previous findings, point to a wider or emerging issue.
The response should be driven by the risk and the evidence available, rather than by the fact that a finding has been identified.
Would the evidence still stack up later?
Six months later, someone who wasn't involved in the original assessment should be able to understand what was considered, what evidence was reviewed, what risks were identified and why the decision was made.
The file should clearly document the evidence relied upon, the checks undertaken, any issues or discrepancies identified, the supplier's response and how those findings were considered as part of the overall assessment. If the decision is to accept a risk or continue with the supplier despite a finding, the file should say why.
Records made at the time should show what the position was and why the decision was taken.
You shouldn’t have to piece the reasoning together months later.
About eGaming Integrity
eGaming Integrity is an independent assurance provider specialising in online gambling compliance, internal audit and supply chain assurance. Its team combines former regulators with senior compliance leaders and operator-side experience.
Services include mock audits, remediation, internal audit, safer gambling assurance and training. Through evidence-based testing, the company helps licence holders prepare for regulatory inspections, address compliance deficiencies and strengthen regulatory readiness across jurisdictions.