Looking beyond the numbers to understand how gaming organisations really operate

Financial, operational and KPI data are essential tools for understanding organisational performance. They can highlight trends, identify areas of concern and provide early warning signs of emerging risks.

However, some of the most significant risks begin to develop long before their full impact appears in the numbers. In some cases, they may even be hidden behind strong performance, growing revenues and positive headlines.
The numbers tell us what happened, but they do not always explain why it happened. Behind every result sits a network of people, decisions, processes, controls and systems.

Two organisations may report similar performance, yet one may be supported by strong governance, effective controls and a healthy culture, while the other may be experiencing unmanaged risks, operational inefficiencies or mounting compliance pressures.

The difference is often hidden beneath the surface.

By understanding these underlying drivers, organisations can identify and address risks before they begin to affect performance. This is why focusing solely on financial and operational outcomes may overlook the very factors that support long-term success, including sound governance, effective risk management, reliable systems and a culture of accountability.

The auditor’s perspective

Auditors do more than verify numbers. Some of the most valuable insights arise from connecting reported results with the people, processes, governance structures, controls and technologies that produced them.

Financial reporting, operational data, control testing, governance reviews and technology assessments each reveal part of the picture. Considered together, they provide a clearer understanding of how an organisation operates, manages risk and sustains performance over time.

Auditors therefore seek to understand not only what an organisation has achieved, but how it achieved it. This involves examining the decisions taken, risks accepted, controls applied and behaviours that influence day-to-day operations.

Sustainable success is rarely built on financial results alone. It depends on strong foundations, responsible decision-making and a willingness to address weaknesses before they become more serious.

What This means for the gaming industry

This broader perspective is particularly relevant within the gaming industry, where performance is often measured through revenue, player numbers, retention and market expansion.

These indicators are important, but they may not provide a complete view of the organisation’s resilience or risk profile.

Behind every customer registration, deposit, wager and withdrawal is a network of people, technologies and decisions working together to protect players, monitor risk and uphold regulatory expectations. Understanding how these elements interact can reveal risks and opportunities that may not be immediately visible in management reports.

Consider a gaming operator that achieves record revenue growth. The figures may point to a successful year, but a broader assessment could reveal that customer due diligence reviews are beginning to accumulate because the compliance function has not expanded at the same pace as the business.

Nothing may have gone wrong, and financial results may remain strong. However, the growing backlog highlights an important reality. Sustainable growth depends not only on revenue, but also on whether governance, controls, systems and people have sufficient capacity to support that growth.

If left unaddressed, what initially appears to be a manageable operational strain could develop into a more significant regulatory and reputational concern.

In another example, an automated fraud monitoring system may identify unusual withdrawal activity across several accounts. Among thousands of legitimate transactions, a subtle pattern begins to emerge. No customer complaints or financial losses may have been reported, yet effective monitoring enables the organisation to intervene before the issue escalates.

Responsible gaming metrics also require careful interpretation. An organisation may report thousands of player interactions, suggesting a strong commitment to customer protection. However, if there is limited evidence showing whether those interventions changed player behaviour or reduced harm, the organisation may be measuring activity rather than effectiveness.

These examples demonstrate why organisations need to consider not only whether controls exist, but whether they are operating as intended and achieving the right outcomes.

Strengthening governance and operational resilience

For an industry built on trust, technology, customer protection and regulatory compliance, a clear understanding of underlying operational risks is essential.

By providing an independent assessment of governance, risk management and operational controls, auditors can help gaming operators:

• Identify weaknesses before they develop into significant issues
• Assess whether systems and processes remain appropriate as the business grows
• Strengthen compliance and risk management frameworks
• Evaluate whether controls are producing their intended outcomes
• Build greater operational and regulatory resilience

This broader approach allows organisations to move beyond reactive compliance. Rather than waiting for a problem to appear in financial or operational data, they can address the conditions that may eventually create it.

Culture as the invisible factor

While governance, controls and systems provide the formal foundations of a resilient organisation, culture often determines how effectively they operate in practice.

Even the strongest frameworks can be weakened when people are unwilling to speak up, challenge decisions or take responsibility when concerns arise.

Trust, accountability, integrity and teamwork cannot be measured easily through financial reports or performance dashboards. Yet they influence the decisions and behaviours that shape outcomes every day.

A healthy culture strengthens governance by encouraging transparency and constructive challenge. It supports effective risk management by making it easier for concerns to be raised and addressed. It also helps organisations identify emerging issues before they become more difficult or costly to resolve.

For boards and leadership teams, understanding culture therefore requires more than reviewing policies or employee surveys. It means examining whether expected behaviours are reflected in how decisions are made, how concerns are handled and how accountability is applied across the organisation.

Building success on strong foundations

The most resilient gaming organisations recognise that strong financial results tell only part of the story.

Revenue growth, player retention and operational performance remain important measures of success. However, behind every number are systems, controls, governance structures, processes and people working together to support responsible growth.

Long-term success depends on how effectively an organisation manages risk, protects its customers, responds to emerging challenges and earns the trust of regulators and wider stakeholders.

The organisations that perform sustainably are not always those with the strongest numbers today. They are those that build sound foundations before they are tested and remain willing to make difficult decisions when circumstances require them.

Numbers tell us what happened. People, governance and culture help us understand why.

RSM Malta supports gaming operators in looking beyond reported performance to understand the governance, controls, systems, and organisational behaviours that drive sustainable success. Combining deep industry knowledge with an independent perspective, our Audit and Assurance specialists help organisations identify emerging risks, strengthen resilience, enhance stakeholder confidence, and navigate an increasingly complex regulatory environment.

Article written by Ma. Remren Celian Ail Padillo - Senior, Audit