Software audit reports: scope, build identity and traceable conclusions

Read the scope before the conclusion

The UK Gambling Commission testing procedure describes several distinct activities, including documentation, implementation and output review. This is a jurisdiction-specific example of why a test scope matters. A summary saying RNG tested should identify which activities were performed, which component was supplied and which environment was examined. Begin with the engagement boundary and exclusions, then read the result. If a reviewer reverses that order, a favourable headline can obscure that the relevant deployment mode or integration was never part of the work.

Build a report identity table

The NIST Secure Software Development Framework provides a shared vocabulary for software producers and purchasers. The worksheet above is an editorial review aid: it turns that communication goal into concrete questions, rather than presenting its fields as a verbatim legal checklist.

Understand what an artifact digest establishes

A cryptographic digest can help identify whether two files have identical bytes when the value and algorithm are recorded correctly. It does not by itself establish who built the file, whether the source was trustworthy or whether the executable behaves safely. Keep those questions separate. A useful evidence manifest lists the artifact path, version, digest algorithm and digest, then connects the record to the report’s tested configuration. If an archive contains several components, identify them at the level needed to explain changes rather than relying only on a friendly release name.

Track dependencies and integration assumptions

A reviewed component can behave differently when integrated with another library, platform or configuration. Record the dependencies relevant to the tested function and explain any substitution. Do not assume that a familiar product name guarantees the same binary or runtime settings. For an update, ask what interfaces changed and which prior evidence remains applicable. A supplier may reasonably reuse earlier work, but the rationale should be explicit. The review should identify the delta and the tests addressing it, so a downstream reader can distinguish justified reuse from an unsupported carry-over of the old conclusion.

Read findings and their closure evidence

A report can contain observations, failures, limitations and corrective actions with different meanings. Preserve the original finding, the build in which it occurred and the evidence used to close it. A statement that the developer fixed the issue is not identical to an evaluator confirming the correction. If a residual limitation remains, place it beside the affected conclusion. This makes the report useful for deployment decisions and later maintenance. It also discourages the habit of publishing only a pass page while removing the conditions that explain what was actually accepted.

Keep register references and release evidence connected

The Commission’s test-report submission guidance describes a games register and approved testing within its own regulatory scope. A register reference is useful for traceability, but it should not replace the underlying item identity and report. For a general evidence review, ask whether the supplied document corresponds to the release under consideration and whether a later update changes that relationship. Do not turn a reference number into a claim that every version or every market is approved. Where the public cannot inspect the complete record, state that access limit clearly.

Audit-package acceptance checklist

• Identify the issuer and verify the report reference through an official route.
• Match the tested build and configuration to the proposed artifact.
• Read exclusions and unresolved findings before relying on a headline.
• Document dependency changes and the evidence supporting reuse.
• Preserve prior versions and correction records in a controlled history.

The final acceptance note should be short enough to read but precise enough to challenge. State the decision, the evidence supporting it and the conditions that would trigger a new review. Avoid claiming complete security merely because the package contains many pages; the strength lies in the connections between the evidence and the decision.

Sources and verification

• Procedure for software and RNG testing — UK Gambling Commission — 2026-10-23
• SP 800-218: Secure Software Development Framework 1.1 — NIST — 2026-10-23
• Games and RNG test reports — UK Gambling Commission — 2026-10-23
• ISO/IEC 17025:2017 laboratory competence — ISO — 2026-10-23