RNG Audits Explained: How Random Number Generators Are Tested
RNG audits are the tests that casinos use to prove their random number generators are actually random. They're conducted by third-party firms like TST
RNG audits are the tests that casinos use to prove their random number generators are actually random. They're conducted by third-party firms like TST (Tech Systems Testing), iTech Labs, and Gaming Laboratories International. The audit is not a single test.
Key Points
It's a battery of tests that measure whether the RNG output meets statistical standards for randomness.
Here's how the audit works:
The casino runs their RNG for a specified period, usually 1-10 million spins or shuffles, depending on the context
he machine generates outcomes and the output is collected. The third party then runs statistical tests on that output to determine whether it could have been generated by a truly random process or whether there's evidence of bias.
The standard test is chi-squared. You take the observed frequencies of each outcome and compare them to the expected frequencies if the process were random. If the chi-squared value is above a threshold, you reject the hypothesis that the process is random. If it's below, you accept it.
For a roulette wheel with 37 numbers, each number should hit 1/37th of the time if the wheel is truly random. If you spin the wheel one million times, each number should hit approximately 27,027 times. If one number hits 27,500 times and another hits 26,500, is that random or biased? The chi-squared test tells you.
The second test is collision testing. If an RNG is truly random, the outputs should never repeat in a predictable pattern. You look for sequences: does number seven follow number three more often than it should? Does the time between repeated outcomes suggest some kind of cycle?
The third test is compression testing. If an RNG output can be compressed to less than 95 percent of its original size, it's not random. Truly random data should not be compressible. This tests whether the output contains hidden patterns.
The testing frequency varies by jurisdiction. The UK requires RNG testing at minimum once per year. Malta requires testing before a license is issued and then on demand if there's cause to investigate. Australia requires continuous monitoring via hardware that logs live RNG output.
The casinos being tested have an incentive to pass the tests. But they also have an incentive not to be tested if they think they'll fail. This creates a problem: the audits only measure the machines that consent to be audited. An unregulated offshore casino that doesn't consent to auditing is not subject to any test.
For regulated casinos, RNG audits are a meaningful assurance that the games are not biased. For unregulated casinos, the absence of an audit is a major red flag. A casino that won't submit to independent testing probably has something to hide. The underlying principle is that exploitation works when your opponents are not playing optimally. Most of your competition is not optimal. They are human. They are tired. They are emotional. They are making mistakes. The strategy that works against mistakes is the strategy you should play. Not the strategy that works against perfect play. Not the strategy that works in theory. The strategy that works against the actual people you're facing. The chi-squared test is standard in statistics and widely used for hypothesis testing in many fields beyond gambling. Its application to RNG testing is straightforward and well-established. A machine that fails the chi-squared test at the 0.05 significance level is considered biased.
