1. 1 Gaming, Privacy and Security eGaming Experience in British Columbia British Columbia Lottery Corporation October 5, 2013 Gurmit Aujla – Director, Internal Audit

2. 22 PlayNow.Com Timeline Launch PlayNow.com July 2010 Mobile June 2013 Poker February 2011 Sports July 2012 Lottery B2B August 2013 Casino B2B January 2013

3. 33 Old World – Ways to Play

4. 44

5. 55 Competition

6. 66

7. 77 Top 5 Risk Areas Information Security & Privacy Regulatory Compliance Infrastructure Vendors Public Support (Integrity)

8. 88 Manitoba & Western Canada Concern Areas Contract compliance, SLA's Regulatory – multiple jurisdictions Gaming integrity Communication Risks Availability

9. 99 Governance Participants (Internal Vs. External) eGaming Security Information Security Audit Services … Regulator (GPEB) External Auditor Steering Committee eGaming Oversight BCLC

10. 10 Assurance Map Assurance Coverage Map (Internal) – eGaming Key Risk Areas DepartmentSub-DepartmentKey Business ProcesseSec.Int. AuditInfo Sec.RegulatorExt. Audit eGaming Marketing eGaming Operations eGaming Security eGaming Business Development Responsible Gambling Detailed data redacted

11. 11 What our B2B customer wanted Assurance Coverage Map (External) – eGaming Key Risk Areas Coverage What our Customer cares about External Auditor Regulator SOC1 IT General Controls Product Certification Change Management Controls IT Security Detailed data redacted

12. 12 Example Only New World Reporting Control AreasStatus Executive Dashboard PlayNow Continuous Monitoring eSecurity Internal Assurance External Assurance eGaming Risk Registry & Risk Coverage

13. 13 Internal Audit Resource Allocation

14. 14 Risks Vs. Controls Mapping Information Security & Privacy Security & Privacy Requirements Security Testing & Penetration Tests Privacy Impact Assessment Design Assessment Change Management QA & Compliance Testing Requirements Management Vendor SLA measurement Contract Management Regulator Coordination Independent Testing Verification of Gaming Standards Communications Management Advertising Infrastructure Vendors Regulatory Compliance Player / Public Support

15. 15 Questions?