<?xml version='1.0' encoding='utf-8'?>
<regulation prefix="Regulation" num=".16" citation="COMAR 36.03.10.16" title_num="36" subtitle_num="03" chapter_num="10" heading="Internal Audit Department Standards.">
  <paragraph num="A.">
    <text>At least 60 days before video lottery terminal operations are set to commence, a facility operator shall submit to the Commission for review and approval internal audit department operating standards and procedures that:</text>
    <paragraph num="(1)">
      <text>Meet the requirements of Regulation .10E(6)(b) of this chapter;</text>
    </paragraph>
    <paragraph num="(2)">
      <text>Conform to this regulation; and</text>
    </paragraph>
    <paragraph num="(3)">
      <text>Ensure that an internal audit is conducted in accordance with generally accepted auditing standards in the United States.</text>
    </paragraph>
  </paragraph>
  <paragraph num="B.">
    <text>A facility operator's internal audit department operating procedures and standards shall, at a minimum, require the internal audit department to:</text>
    <paragraph num="(1)">
      <text>Work independently of the departments of the facility that are subject to audit;</text>
    </paragraph>
    <paragraph num="(2)">
      <text>Assess whether the facility's internal controls comply with applicable law and Commission directives;</text>
    </paragraph>
    <paragraph num="(3)">
      <text>Test the facility's compliance with its internal controls;</text>
    </paragraph>
    <paragraph num="(4)">
      <text>Immediately report a deficiency in, or noncompliance with, the facility's internal controls to:</text>
      <paragraph num="(a)">
        <text>The audit committee;</text>
      </paragraph>
      <paragraph num="(b)">
        <text>The chief executive officer;</text>
      </paragraph>
      <paragraph num="(c)">
        <text>Management; and</text>
      </paragraph>
      <paragraph num="(d)">
        <text>The Commission;</text>
      </paragraph>
    </paragraph>
    <paragraph num="(5)">
      <text>Recommend resolution for eliminating a deficiency in, or noncompliance with, the facilitys internal control system;</text>
    </paragraph>
    <paragraph num="(6)">
      <text>Meet periodically with the audit committee or director of internal audit;</text>
    </paragraph>
    <paragraph num="(7)">
      <text>Perform audits of:</text>
      <paragraph num="(a)">
        <text>Unless an alternate risk assessment and audit plan is submitted in writing and approved in writing by the Commission, all departments of the facility that are designated under §§C and D of this regulation; and</text>
      </paragraph>
      <paragraph num="(b)">
        <text>A department of the facility designated by the Commission;</text>
      </paragraph>
    </paragraph>
    <paragraph num="(8)">
      <text>Prepare an audit report for each audit conducted;</text>
    </paragraph>
    <paragraph num="(9)">
      <text>Accurately document the audit process and results in an audit report that, at a minimum, shall include:</text>
      <paragraph num="(a)">
        <text>Audit objectives;</text>
      </paragraph>
      <paragraph num="(b)">
        <text>Audit procedures and scope;</text>
      </paragraph>
      <paragraph num="(c)">
        <text>Findings and conclusions;</text>
      </paragraph>
      <paragraph num="(d)">
        <text>A recommendation for addressing a deficiency in, or noncompliance with, the facility's internal controls;</text>
      </paragraph>
      <paragraph num="(e)">
        <text>Resolution of all exceptions; and</text>
      </paragraph>
      <paragraph num="(f)">
        <text>Management's response;</text>
      </paragraph>
    </paragraph>
    <paragraph num="(10)">
      <text>Submit audit reports to the Commission on a schedule specified by the Commission; and</text>
    </paragraph>
    <paragraph num="(11)">
      <text>Verify that:</text>
      <paragraph num="(a)">
        <text>A deficiency or noncompliance revealed during an audit has been corrected; and</text>
      </paragraph>
      <paragraph num="(b)">
        <text>An exception disclosed during an audit has been resolved.</text>
      </paragraph>
    </paragraph>
  </paragraph>
  <paragraph num="C.">
    <text>The audit department shall audit at least semiannually the functions and operations of the facility's:</text>
    <paragraph num="(1)">
      <text>Cashiers' cage;</text>
    </paragraph>
    <paragraph num="(2)">
      <text>Main bank;</text>
    </paragraph>
    <paragraph num="(3)">
      <text>Collection of cash storage boxes;</text>
    </paragraph>
    <paragraph num="(4)">
      <text>Cash count;</text>
    </paragraph>
    <paragraph num="(5)">
      <text>Revenue audit;</text>
    </paragraph>
    <paragraph num="(6)">
      <text>Operations department;</text>
    </paragraph>
    <paragraph num="(7)">
      <text>Key control; and</text>
    </paragraph>
    <paragraph num="(8)">
      <text>Table game operations.</text>
    </paragraph>
  </paragraph>
  <paragraph num="D.">
    <text>The audit department shall audit at least annually:</text>
    <paragraph num="(1)">
      <text>Responsible gaming program;</text>
    </paragraph>
    <paragraph num="(2)">
      <text>Security department;</text>
    </paragraph>
    <paragraph num="(3)">
      <text>Currency transaction reporting;</text>
    </paragraph>
    <paragraph num="(4)">
      <text>Suspicious activity reporting;</text>
    </paragraph>
    <paragraph num="(5)">
      <text>Information technology controls;</text>
    </paragraph>
    <paragraph num="(6)">
      <text>Surveillance department; and</text>
    </paragraph>
    <paragraph num="(7)">
      <text>Player tracking system.</text>
    </paragraph>
  </paragraph>
  <paragraph num="E.">
    <text>The internal audit department shall conduct an audit on an unannounced basis when possible.</text>
  </paragraph>
</regulation>