A facility operator shall develop a written description of its administrative and accounting procedures including the system of internal controls over instant bingo operations. A facility operator’s internal controls are subject to review and approval under this regulation. Internal controls shall, at a minimum, include: Administrative controls and record keeping that document the authorization of transactions; Accounting controls that provide reasonable assurance that: Transactions or financial events which occur in connection with instant bingo operations are: Executed in accordance with the facility operator’s authorization protocols; Recorded to permit preparation of financial statements in conformance with generally accepted accounting principles in the United States and the requirements of this chapter; and Recorded to permit proper and timely reporting and calculation of proceeds and to maintain accountability for assets; Access to assets is permitted only in accordance with the facility operator’s authorization protocols; and The recorded accountability for assets is compared with existing assets at reasonable intervals and appropriate action is taken with regard to a discrepancy; Procedures and controls for ensuring: That an instant bingo machine accurately and timely communicates all required activities and financial details to the instant bingo validation and accounting system; That all functions, duties and responsibilities are segregated and performed in accordance with sound financial practices by qualified personnel; and Through the use of a surveillance and a security department, that the facility is secure at all times during normal operation and during any emergency due to malfunctioning equipment, loss of power, natural disaster or any other cause; Access controls which address, at a minimum: Content of, and administrative responsibility over, the manual or computerized access control matrix governing employee access to restricted areas; Issuance of a temporary access credential; and Comprehensive key controls; A record retention policy; Procedures and controls over the movement of cash and the count room; Procedures and standards for conducting internal audits; and Other procedures and controls the Commission may require to be included in a facility operator’s internal controls. A facility operator shall maintain, in hard copy or electronic form, all superseded internal controls for at least five years subsequent to the date the internal controls were superseded.