How Norsk Tipping made compliance their engine for faster software delivery

published July 1, 2026

Controls

ISO27001

Compliance

Audit

Norsk Tipping is the Norwegian state-owned gambling operator running 2,500 to 3,000 production releases a year. Moving to AWS and GitHub-native workflows gave teams more freedom, but required new centralized quality gates. With Kosli’s admission control every change now carries its own provable evidence, and audits have shifted from reconstructing the past to inspecting a ready-made record.

Challenges

Distributed AWS/GitHub workflows gave teams freedom but lacked centralized control

No single system of record for testing, review, and approval evidence.

Audits meant reconstructing the past, not inspecting a ready-made record.

Solutions

Admission control re-establishes gates without removing teams' workflow freedom.

Kosli became the system of record for every change, cloud and on-prem.

Auditors now inspect a complete record instead of reconstructing the past.

Stefan Haugsrud, Head of Software Development and Quality Assurance, Norsk Tipping

Norsk Tipping is the Norwegian state-owned gambling operator, operating a wide range of lottery, sports and instant games. The 400-person technology organisation runs 2,500 to 3,000 production releases a year across iOS, Android, web, and backend infrastructure.

With a strategic initiative underway to migrate custom solutions to AWS and adopt GitHub native workflows, the organisation needed to answer a question that many regulated companies face at the same point in their cloud journey: how do you enforce quality controls when you’ve moved from a centralized pipeline to a distributed one?

“Teams had more freedom to define their own workflows,” says Stephan Haugsrud, Head of Software Development and Quality Assurance at Norsk Tipping. “As a highly regulated institution, we needed a central place to record our quality processes, and then base our release decisions on objective and proveable criteria.”

That need became more urgent as Norsk Tipping raised its quality ambitions. A period of intensified focus on software quality, driven by internal reviews and external audits, made it clear that the organization needed a better system of record for testing and change evidence. Proving what had been tested, peer reviewed, and approved for any given change was much harder than it should have been.

If it isn’t in Kosli, it hasn’t happened.

Kosli became the system of record to change that. Today, every change across the Norsk Tipping estate, in the cloud and on-prem, pushes evidence to Kosli before it can reach production. An admission control system built around Kosli evidence automatically blocks deployments that lack the required proof. “If it isn’t in Kosli, it hasn’t happened,” says Stephan.

The results came almost immediately in the next World Lottery Association and ISO 27001 audits. “I was more confident going into the audit this time,” says Stephan. Where previous audits had involved difficult conversations about what had or hadn’t been tested, the audit team could now inspect a complete, structured record of runtime system changes and their provenance. The conversation shifted from proving the past to discussing controls design.

“With the admission control system in place, we now have confidence that everything that reaches production has been tested according to our standards, and we can do speed safely again. Kosli has been a key part of that," Stephan concludes.