I spent four months investigating RNG auditing. What I found was that the auditing system is more Byzantine than the technology being audited, which is exactly what you want if you're trying to prevent cheating and exactly what you don't want if you're trying to understand anything.
Here's the situation: an online casino needs to prove that their games are fair. The only way to prove this is to have an independent auditor test their RNG. The independent auditor uses statistical tests to determine if the output matches true random behavior. If it does, the casino is presumably not cheating.
The auditor is typically a company like GLI (Gaming Laboratories International) or eCOGRA. These are real companies with real expertise in statistical analysis and cryptography. They are not rubber-stamping operations. They actually do the work.
The work involves analyzing output from the RNG. They generate hundreds of thousands of random numbers. They run statistical tests: chi-squared test, poker test, runs test, sequence test. Each test examines different aspects of randomness. If all tests pass, the output is statistically consistent with true randomness.
What This Actually Means
If an RNG passes auditing, it means the statistical output is consistent with random behavior. It does not mean the RNG is absolutely random. It means the output passes specific statistical tests designed to detect non-randomness.
A non-random RNG would fail these tests. It would produce predictable patterns. The auditor would catch it.
A cheating casino could implement an RNG that passes the audits but produces specific outcomes for specific players. This is theoretically possible. The casino could seed the RNG with information about which player is playing, then produce an outcome biased toward the house for that player.
However, detecting this bias would require a more sophisticated analysis than standard RNG auditing. The auditor would need to correlate specific player characteristics with specific outcomes. Standard auditing does not do this.
So the audit catches obvious cheating. It does not catch sophisticated, player-specific cheating.
The Practical Protection
What actually prevents casino cheating is not the audit itself, but the combination of auditing plus competition plus regulatory scrutiny.
If PokerStars was cheating through player-specific RNG seeding, they would need to hide this from the auditors. The auditors would need to examine the code and the output. If the code contained player-specific logic, an auditor who reviews the code carefully would find it.
But here's the issue: the auditor reviews the code that the casino shows them. If the casino has a secret code branch that operates under specific conditions, the auditor might not see it.
This is where competition comes in. If PokerStars was cheating, their player base would eventually figure it out. The data would show patterns. The players would leave. The competition would take their business.
This has never happened at a major poker site. It's not because auditing is perfect. It's because the cost of maintaining the deception would be higher than the benefit of the deception.
What You Should Understand
RNG auditing tests for statistical randomness. It passes or fails. If it fails, you should not play. If it passes, the output is statistically random.
Statistical randomness does not guarantee fairness. It guarantees that the output matches expected properties of random behavior. A casino could still cheat through other mechanisms: collusion, rigged player identification, account manipulation.
But if the RNG passes audit, the games are not obviously rigged in the mathematical sense. That's the floor. That's what you can guarantee.
If you're worried about fairness, play at audited casinos. If you're paranoid about audit integrity, that's a separate problem that you can't solve through technical analysis. You're in the realm of institutional trust.
The RNG audit is the mechanism through which that trust is tested. It's imperfect, but it's real.
