Why are there Licenses and Audits?

If you step into a brick-and-mortar casino almost anywhere in the world, the odds are very high that the place pays lots of taxes to some local authority. The revenue opportunity is just too good for the government to overlook it. This also means also that the local authorities have some form of licensing program, mainly so that they can then formally check on the casino to be sure they are not cheating on their taxes. These arrangements - licensing and audits -- can also inspire confidence in the patron, though a few "rogue jurisdictions" only worry whether the casino is cheating the government. The public is on its own in those places.

In the electronic world of online gambling, licensing and audits are not something that can be assumed. And even when a web site says it is licensed and audited, the visitor may want to check more closely. In 2007, AtlanticVegas.com displayed proudly that it was licensed in Alderney, a jurisdiction in the English Channel Islands. It was a false claim. The website was unlicensed. The fraud was uncovered by Casinomeister, a well-known online gambling watchdog website.

What is an Audit?

By the same token, being "audited" can mean dozens of different things. Promotional web sites prey on the U.S. customer's conventional understanding that "audit" means a detailed, financial accounting verification by a Certified Public Accountant. Sometimes that does occur, but the normal audit of an online gambling site is considerably more limited and less rigorous.

It behooves the customer to seek more details about what sort of audit it was, how far it went, and what was the result. The result is an important aspect that gaming establishments typically do not reveal to the public. Any company, even a total fraud, can have an audit. If the fraud is really clever, the audit could come out "clean." But suppose the audit discovers, for example, ten areas in which controls are weak, or in which employees (or third party hackers) have access to sensitive information, or in which the company is behaving in reality much differently from its public statements. What happens next? If the audit report is unavailable (and it is always unavailable), how does the public know that problems have been detected and solved?

In truth, the specifics of an individual audit do not matter too much to the public. Much more important is the fact of the audit, and whether the auditors (or the association or standard-setting entity) is respected, known and trusted, and whether it continues to work with or associate with the company subject to the audit. Eventually the dishonest or incompetent companies will exit the industry through the garbage chute, or they will be banned or shunned by respectable third-party auditors and independent associations.

Types of Audits

It is important to distinguish among the different procedures that can be covered by the somewhat vague term "audit." Many websites have this hopelessly confused. An "audit" should not be confused with an evaluation of the random number generator (RNG) of a web site's software. The RNG is not linked to the financial side of things, though the financial outcome for the casino depends upon it in part. The RNG evaluation is a statistical analysis whether the results of "plays" generated by the software are randomized to a degree that mimics the random results of a fair gaming device in the physical world. [link to RNG]. The focus is on the shuffling and dealing of cards, the roulette wheel, the dice, the tiles, or other gaming accoutrements.

The conventional financial audit, common for companies with shares listed on stock exchanges, is not the same thing as an online gambling audit. The securities of several prominent online gambling companies are in fact listed on exchanges around the world, and as such are required to publish periodic independent audits by certified professionals. This information is usually made available to the public for inspection. With the exception of single, significant events affecting revenue, these audit reports will not contain much information or assurances about how the gaming operations are conducted. For example, when President Bush signed the UIGEA, and several European companies hurriedly withdrew from the U.S. market, shockwave felt throughout the industry was the sort of influence reported upon in the financial audits.

Payout Audits

When an online casino trumpets the fact that it is "audited" by some independent entity, it is referring most likely to its payout percentages (also called payback percentages or payoff percentages). This term emerged in the days of mechanical slot machines and continued into the era of video slots and poker machines. The idea was that a mechanical device could be set to control the frequency and number of coins returned to the player. The setting of the mechanical device, which then became the programming of a computer chip, creates a "theoretical" payback. In practice, of course, there is a random variation to how often the machine "hits" a payoff. Over many, many plays, the "real" experience of payoff should come very close to the "theoretical" payoff programmed into the machine.

The same concept is used with online gambling, since it is software driven, and functionally, much like the innards of a modern slot machine (only more complex, obviously).

The easiest way of thinking about this is to consider a spin of a roulette wheel. A bet on a specific number has one chance in 38 of winning. The payment is thirty-five to one (or as if there were one chance in 36 of winning). If many single-number bets were placed, the casino would tend to make pay outs to winners about 2.63% of the time. However, its total payouts would only amount to an average of 94.74 cents out of every dollar received. The house edge, theoretically, is 5.26% on this particular bet. If someone were to gather information on all the wagers placed of this exact type over a defined period, and calculate how much the casino paid out as a percentage of how much it took in on every bet, the result should be a payout percentage close to 94.74%. The more generalized or "average" payout percentages, of course, reflect many different kinds of bets, either in the same game, or in several.

Most casinos understand that they must make this information available to the public. Having an outside accounting firm check the math and maybe the concepts underlying the collection of the data is a good idea. These results are often available from the casino, and also from the independent entity performing the check.

Payout percentage reports are often detailed, breaking out information by specific game. Curiously, the public still patronizes the high-edge games anyway. The data are not broken down by specific bet (as in the case of the above example of a single number in roulette). Payout percentage numbers are given for casinos only. They do not apply to poker rooms. There, the house makes its revenue by the "rake" of the pot and not from winning or losing on its own account. Likewise, sports and race books theoretically involve "balanced action" by the book, in which a fee of roughly 5% is collected for handling the bets. Books also take positions on propositions, of course, but the concept of "payoff percentage" just does not apply. The "vig" or commission collected by the book is the same, no matter who wins or loses.

Interpreting a Payout Percentage Number

What is a good number? If the payout percentage is 100%, it means the casino gives back to winners 100% of the money it takes in as a bet. If the payout percentage is in the high 90's, it means that almost all the money collected goes back to winners. Different people will say that different payout percentages are "good" or "all right." The higher it is, obviously, the more beneficial it is for the customer. But remember that any number under 100% means that the player has a negative edge against the house. And remember also the maxim that the richest man in the world will go broke against a tiny house edge if he plays long enough. In truth, whether the number is good enough for play must be determined by a comparison to the theoretical payout percentage (derived from the house edge) in the game in question. Blackjack, craps, roulette, three-card poker, etc. all have different house edges, and will vary according to the specific rules being played in that casino at that time.

Comparing Payout Percentage and Profit

If the "payout percentage" is 98% of the bet, does this mean that the casino's margin of gross profit is only 2%? No. Do not feel sorry for the casino.

The following example may help to clarify what is happening. Mentally take $1000 out of your wallet and deposit it with an online casino. "Sit" at a virtual blackjack table, and play strict "Basic Strategy" blackjack for four hours. Suppose that the casino's edge against you is small. Depending on the rules being played it could vary between half a point and several points. Assume it to be 1%. Does this mean that when you get up from the table you should have $990 in your pocket, and the casino should have made just $10 for the good time it gave to you? No. With $10 bets, sometimes doubled or split, you can expect to bet at the rate of, let us say, $2000 per hour. Over four hours, that is $8000. Unless you had some long strings of bad luck, you probably never wagered most of the dollars in the bankroll. But the dollars on top of the stack were wagered many times! On average, each dollar was wagered 8 times in the course of four hours. The casino kept $80 of your money. You lost at the rate of $20 per hour. Of course, it is possible to do much better than that, and much worse than that, because the standard deviation of the rate of winning and losing is large relative to its expected value.

Thus, when the casino announces a 98% payout percentage, it is still a lucrative rate for the casino. Audits will not tell you how much the public lost at that rate in terms of the number of cents of each bankroll dollar left behind at the casino.

To evaluate one's own payout percentage it is often possible to use the web site's review of hands function to see the last several plays or more (up to hundreds!), so that the actual experience of an individual session can be compared to the published figures. Another item that an online gambling audit will disclose is whether prizes offered by online web sites are ever won, and if won, if they are ever paid. This refers to the actual "payout" instead of the "payout percentage." Do winners win? This matter is relatively easy to confirm with any casino that is truly open to the outside reviewing entity.

Accounting for Deposits and Payment of Withdrawals

Casino audits may also include an evaluation of the software and procedures associated with receiving deposits from customers, in keeping track of the value in a customer's account, and in paying out a withdrawal when requested. A sub-issue is how the casino treats bonus dollars or match play money. Disreputable web sites play tricks on the customers or impose onerous (or impossible) restrictions on their use. A good casino audit will make sure that this part of the "back office" or "back end" of the casino is functioning competently and fairly.

Periodically a casino may be the subject of an "audit" for consumer satisfaction (which are really more surveys than audits). They report on which casinos have the best customer service in this respect.

Software Integrity and Hardware Stability

Online casino audits also encompass a determination of the integrity of the software employed. Obviously, if the software has bugs, or conceptual errors or downright dishonest procedures, all other "bets should be off." Third-party software suppliers engage outside evaluators to certify their software as honest and capable. [link to software suppliers] An individual gambler my develop a level of comfort, competence and trust in a specific software, and thus be attracted only to those web sites that employ that specific package. This has led to an influence by software manufacturers in the marketing of online gambling establishments. Proprietary software can be used as well. As a generality, the proprietary software of the industry leaders (like Bodog) can be trusted in the same way as a reputable third-party supplier's, but a new or unknown site with proprietary software should be given a pass.

Some casino audits give consideration to the specific implementation of a software package on the casino's server(s). With only a couple of exceptions [link to Absolute Poker], software procedures and controls do not attract much public attention. Hardware stability has also become a less important concern than in the past, particularly for those online gambling sites that have attracted a lot of traffic and have invested in the technology to handle it without delays, crashes and losses of data - nightmares that frequently happened in the early days of the industry, and still may occur on the fringes of the sector.

Auditors and Evaluators

Several entities have become known as reliable monitors of the competence and honesty of the more reputable online casinos.

Accounting Firm: Price-Waterhouse Coopers (PWC). PWC is one of the "Big Six" international accounting firms and has been particularly active in auditing online gaming establishments. This line of work is not prominently marketed by the accounting firm. Gambling receives a very quick and euphemistic mention on the web site as part of the "Leisure and Hospitality Industry" experience of the firm. Work for private clients is not brought up. Rather, the firm indicates that "It is essential for new gaming jurisdictions to establish thorough regulatory frameworks." No doubt PWC does work for some new gaming jurisdictions, but some of the work is for individual casinos. They properly draw a distinction between financial accounting and auditing on the one hand, and the performance of econometric and statistical research. Though web sites toss the term "audit" around, PWC would classify much its analytical work as econometric and statistical consulting.

Accounting Firm: KPMG. KPMG, works with eCOGRA, an industry standard-setting and certification organization (described below), with respect to their "Total Gaming Transaction Review" process, in which KPMG performs annual quality assurance reviews. KPMG Canada has a group of gaming advisers, prepared to consult on both strategic matters, like policy development) and operational concerns. Their Canadian clientele includes provincial authorities and Native American territories. KPMG in the United Kingdom has also developed a cadre of business advisors to the gaming industry.

Other Accounting Firms: It is not required to be one of the "Big Six" to be active in the field of online gambling. If a web site discloses that its books or procedures are audited, but the name is not familiar, it simply means that further inquiry is necessary to find out if the accountants are "for real." Be mindful of two details, however: rules of accountancy differ widely from one country to the next, so the effort and professionalism of the audit should be considered in light of the domicile of the firm mentioned. Second, accounting firms can be held legally responsible (in limited circumstances) if a member of the public relies on their certification and is injured. Thus, "bigger" is often "better" in more ways than just name or fame, whenever liability may become an issue. Accounting firms will become more varied and commonplace on web sites, as the needs for their services continue to grow. Licensing jurisdictions are becoming more careful and demanding, and securities exchanges and private investors always require detailed information of the companies themselves.

eCOGRA. eCOGRA stands for eCommerce and Online Gaming Regulation and Assurance. It is an independent, non-profit, voluntary industry organization, founded in 2003, with the objective of setting operating standards and criteria for online gambling establishments. One of its activities is the monitoring and auditing of the sites of member companies. Those receiving eCOGRA certification can display the "Play it Safe" logo on their web sites. The certification requires compliance with each of the 100 or more criteria. Approximately 80 online gaming sites display the logo. Some of the reputable and long-standing sites have chosen not to seek certification, but many have. eCOGRA's Fairness Certificates on a gaming site mean: monthly reports of payout percentages for slots, table games, poker games and all other games; monthly poker card-shuffling reports; and twice-yearly RNG reports for blackjack, roulette and video poker. eCOGRA also intermediates disputes between customers and sites, resolving issues quickly (2 days or less).

Association of Professional Casino Webmasters. This organization does not independently audit individual web sites, but it provides webmasters with standards and procedures for software downloads & installations, deposits and withdrawal methods, interactive game play, customer service responsiveness, bonus awards, and how web site affiliates are functioning. Thus, a website's membership in the APCW is some evidence that it is attempting to meet some sort of industry standard for procedures and the treatment of customers. Note that the organization is not looking out for the welfare of the general public, but for the well-being of the online casino webmaster.

The Online Gaming Alliance (OGA). This association is a "mixed bag" of independent standards and captive customers. Only websites that use software from Grand Virtual are permitted to be part of "the alliance." Thus, in a sense it is more like a users group than a standards-setting and auditing organization. Nevertheless, the OGA does promulgate a "Code of Conduct," "Ethical Principles" and standards and guidelines for website procedures, such as processing financial transactions, but there is no enforcing of these norms. They are simply "embraced" by the web site when it displays the OGA logo. There really is no auditing process or procedure. The OGA reviews its members' web sites periodically on-line, just to be sure they do not have anything to do with OGA "banned groups." These include any web site seeking to advance child pornography, gaming by minors, violence, hatred, organized crime, terrorism, drug use or Internet fraud. There is also a complaint mechanism whereby the public can report on a negative experience involving a member. Whether the OGA is real industry self-regulation or just vendor public relations depends mainly on whether, as a web site, you run Grand Virtual software.

Technical Services Testing (TST). As an accredited testing facility for (among other things) web-based gambling and e-Commerce. The TST review focuses on both fairness and reliability. It includes technical questions, such as security, procedures, the RNG, and the operating environment of the online gambling site. Typically TST becomes involved with the operation of the software, but not with customer service or financial auditing. Many of TST's clients are governmental bodies.

Certified Fair Gambling (CFG). California-based CFG provides analyses of gaming logs to online casinos. The service is usually provided over the Internet. If the analyses of the gaming logs disclose no worrisome concerns from the point of view of fairness, security or consistency, then a CFG "Certified Fair" logo can be displayed by the web site. There is no onsite visit, no review of manual procedures and controls, and no financial audit considerations. The focus is mainly on the RNG and on the RTP (return to player) calculations.

BMM Comliancce BMM provides consulting and advice on operations and compliance management to online gaming companies, as well as technical services and support. They perform testing, assurance and certification of gaming devices, software and procedures. Founded in Melbourne in 1981, the firm is over twice as old as the industry. They have eight offices spread around the globe and consult for nearly 300 gaming jurisdictions. One of their areas of competence is technical investigations for operators and regulators in the field of forensics. They will test and certify RNG's, shuffle results, and other virtual gaming devices.

Gaming Associates. Gaming Associates is a consulting company of gaming industry experts. They furnish investigative research and advice to regulators, both when acting in a rule-making capacity and when functioning as a quasi-judicial forum (mainly disciplinary disputes). Gaming Associates can certify the operational integrity of software and procedures employed by gaming web sites. As an accredited testing facilty, Gaming Associates provides independent and impartial testing, consultation and certifications for industry operators. This includes the evaluation of internal controls, policies, compliance programs and security. Unlike some of the entities whose logos frequently appear on Internet casino home pages, Gaming Associates is not in the business of certifying payout percentages based on gaming logs.

iTech Labs. iTech Labs will check out the RNG of a website's software system, and it engages in RTP (return to player) calculations (i.e., payout and payout percentage audits). Audits are performed monthly and published on the gaming establishment's web site. Using game logs, iTech Labs calculates and reports the ratio of the total amount won to the total amount bet in each of several game categories. RTP's for card games are compared against a theoretical benchmark. The game log data are examined for "sanity" and internal consistency. No on-site audit of procedures or controls is conducted, nor is there any examination or evaluation of financial accounting records. Customer Service Audits: Talisma. Talisma is a UK-based customer service specialist, capable of evaluating customer service across many different sectors or industries. Often it acquires its information through "secret shopping" or through customer surveys. A 2006 evaluation of the top 100 UK gambling sites disclosed that 40% of its emails were ignored, one in six of its telephone calls went unanswered, and in almost one in three Internet chat sessions in which it requested advice, the chat went ignored by the gambling establishment. Only one casino in 20 had self-service help available that the researcher considered truly able to answer the question. Talisma and other consultants in customer service (called "customer interaction management") regularly assist companies that are concerned about the level of customer service to improve.