# COMAR Title 36 — Maryland State Lottery and Gaming Control Agency

## Subtitle 03 — Gaming Provisions

### Chapter 10 — Video Lottery Facility Minimum Internal Control Standards

#### Regulation .16 Internal Audit Department Standards.

*COMAR 36.03.10.16*

A. At least 60 days before video lottery terminal operations are set to commence, a facility operator shall submit to the Commission for review and approval internal audit department operating standards and procedures that:

  (1) Meet the requirements of Regulation .10E(6)(b) of this chapter;

  (2) Conform to this regulation; and

  (3) Ensure that an internal audit is conducted in accordance with generally accepted auditing standards in the United States.

B. A facility operator's internal audit department operating procedures and standards shall, at a minimum, require the internal audit department to:

  (1) Work independently of the departments of the facility that are subject to audit;

  (2) Assess whether the facility's internal controls comply with applicable law and Commission directives;

  (3) Test the facility's compliance with its internal controls;

  (4) Immediately report a deficiency in, or noncompliance with, the facility's internal controls to:

    (a) The audit committee;

    (b) The chief executive officer;

    (c) Management; and

    (d) The Commission;

  (5) Recommend resolution for eliminating a deficiency in, or noncompliance with, the facilitys internal control system;

  (6) Meet periodically with the audit committee or director of internal audit;

  (7) Perform audits of:

    (a) Unless an alternate risk assessment and audit plan is submitted in writing and approved in writing by the Commission, all departments of the facility that are designated under §§C and D of this regulation; and

    (b) A department of the facility designated by the Commission;

  (8) Prepare an audit report for each audit conducted;

  (9) Accurately document the audit process and results in an audit report that, at a minimum, shall include:

    (a) Audit objectives;

    (b) Audit procedures and scope;

    (c) Findings and conclusions;

    (d) A recommendation for addressing a deficiency in, or noncompliance with, the facility's internal controls;

    (e) Resolution of all exceptions; and

    (f) Management's response;

  (10) Submit audit reports to the Commission on a schedule specified by the Commission; and

  (11) Verify that:

    (a) A deficiency or noncompliance revealed during an audit has been corrected; and

    (b) An exception disclosed during an audit has been resolved.

C. The audit department shall audit at least semiannually the functions and operations of the facility's:

  (1) Cashiers' cage;

  (2) Main bank;

  (3) Collection of cash storage boxes;

  (4) Cash count;

  (5) Revenue audit;

  (6) Operations department;

  (7) Key control; and

  (8) Table game operations.

D. The audit department shall audit at least annually:

  (1) Responsible gaming program;

  (2) Security department;

  (3) Currency transaction reporting;

  (4) Suspicious activity reporting;

  (5) Information technology controls;

  (6) Surveillance department; and

  (7) Player tracking system.

E. The internal audit department shall conduct an audit on an unannounced basis when possible.