Sec. 36.03.10.16. Internal Audit Department Standards

A. At least 60 days before video lottery terminal operations are set to commence, a facility operator shall submit to the Commission for review and approval internal audit department operating standards and procedures that:

(1) Meet the requirements of Regulation .10E(6)(b) of this chapter;

(2) Conform to this regulation; and

(3) Ensure that an internal audit is conducted in accordance with generally accepted auditing standards in the United States.

B. A facility operator’s internal audit department operating procedures and standards shall, at a minimum, require the internal audit department to:

(1) Work independently of the departments of the facility that are subject to audit;

(2) Assess whether the facility’s internal controls comply with applicable law and Commission directives;

(3) Test the facility’s compliance with its internal controls;

(4) Immediately report a deficiency in, or noncompliance with, the facility’s internal controls to:

(a) The audit committee;

(b) The chief executive officer;

(c) Management; and

(d) The Commission;

(5) Recommend resolution for eliminating a deficiency in, or noncompliance with, the facility’s internal control system;

(6) Meet periodically with the audit committee or director of internal audit;

(7) Perform audits of:

(a) Unless an alternate risk assessment and audit plan is submitted in writing and approved in writing by the Commission, all departments of the facility that are designated under §§C and D of this regulation; and

(b) A department of the facility designated by the Commission;

(8) Prepare an audit report for each audit conducted;

(9) Accurately document the audit process and results in an audit report that, at a minimum, shall include:

(a) Audit objectives;

(b) Audit procedures and scope;

(c) Findings and conclusions;

(d) A recommendation for addressing a deficiency in, or noncompliance with, the facility’s internal controls;

(e) Resolution of all exceptions; and

(f) Management’s response;

(10) Submit audit reports to the Commission on a schedule specified by the Commission; and

(11) Verify that:

(a) A deficiency or noncompliance revealed during an audit has been corrected; and

(b) An exception disclosed during an audit has been resolved.

C. The audit department shall audit at least semiannually the functions and operations of the facility’s:

(1) Cashiers’ cage;

(2) Main bank;

(3) Collection of cash storage boxes;

(4) Cash count;

(5) Revenue audit;

(6) Operations department;

(7) Key control; and

(8) Table game operations.

D. The audit department shall audit at least annually:

(1) Responsible gaming program;

(2) Security department;

(3) Currency transaction reporting;

(4) Suspicious activity reporting;

(5) Information technology controls;

(6) Accounts payable;

(7) Purchasing;

(8) Surveillance department; and

(9) Player tracking system.

E. The internal audit department shall conduct an audit on an unannounced basis when possible.