<?xml version='1.0' encoding='utf-8'?>
<regulation prefix="Regulation" num=".20" citation="COMAR 36.10.13.20" title_num="36" subtitle_num="10" chapter_num="13" heading="Internal Audit Department Standards.">
  <paragraph num="A.">
    <text>Except as set forth in §B, this regulation is only applicable to the holder of a Class A sports wagering facility license.</text>
  </paragraph>
  <paragraph num="B.">
    <text>The Commission may require the holder of a Class B sports wagering facility license to comply with any or all of the requirements of this regulation.</text>
  </paragraph>
  <paragraph num="C.">
    <text>At least 60 days before sports wagering operations are set to commence or another time approved Commission, a sports wagering licensee shall submit to the Commission for review and approval internal audit department operating standards and procedures that:</text>
    <paragraph num="(1)">
      <text>Meet the requirements of Regulation .09E(6)(b) of this chapter;</text>
    </paragraph>
    <paragraph num="(2)">
      <text>Conform to this regulation; and</text>
    </paragraph>
    <paragraph num="(3)">
      <text>Ensure that an internal audit is conducted in accordance with generally accepted auditing standards in the United States.</text>
    </paragraph>
  </paragraph>
  <paragraph num="D.">
    <text>A sports wagering licensees internal audit department operating procedures and standards shall, at a minimum, require the internal audit department to:</text>
    <paragraph num="(1)">
      <text>Work independently of the departments of the sports wagering licensee that are subject to audit;</text>
    </paragraph>
    <paragraph num="(2)">
      <text>Assess whether the sports wagering licensees internal controls comply with applicable law and Commission directives;</text>
    </paragraph>
    <paragraph num="(3)">
      <text>Test the sports wagering licensees compliance with its internal controls;</text>
    </paragraph>
    <paragraph num="(4)">
      <text>Immediately report a deficiency in, or noncompliance with, the sports wagering licensees internal controls to:</text>
      <paragraph num="(a)">
        <text>The audit committee;</text>
      </paragraph>
      <paragraph num="(b)">
        <text>The chief executive officer;</text>
      </paragraph>
      <paragraph num="(c)">
        <text>Management; and</text>
      </paragraph>
      <paragraph num="(d)">
        <text>The Commission;</text>
      </paragraph>
    </paragraph>
    <paragraph num="(5)">
      <text>Recommend resolution for eliminating a deficiency in, or noncompliance with, the sports wagering licensees internal control system;</text>
    </paragraph>
    <paragraph num="(6)">
      <text>Meet periodically with the audit committee or director of internal audit;</text>
    </paragraph>
    <paragraph num="(7)">
      <text>Perform audits of:</text>
      <paragraph num="(a)">
        <text>Unless an alternate risk assessment and audit plan is submitted in writing and approved in writing by the Commission, all departments of the sports wagering licensee that are designated under §§C and D of this regulation; and</text>
      </paragraph>
      <paragraph num="(b)">
        <text>A department of the sports wagering licensee designated by the Commission;</text>
      </paragraph>
    </paragraph>
    <paragraph num="(8)">
      <text>Prepare an audit report for each audit conducted;</text>
    </paragraph>
    <paragraph num="(9)">
      <text>Accurately document the audit process and results in an audit report that, at a minimum, shall include:</text>
      <paragraph num="(a)">
        <text>Audit objectives;</text>
      </paragraph>
      <paragraph num="(b)">
        <text>Audit procedures and scope;</text>
      </paragraph>
      <paragraph num="(c)">
        <text>Findings and conclusions;</text>
      </paragraph>
      <paragraph num="(d)">
        <text>A recommendation for addressing a deficiency in, or noncompliance with, the sports wagering licensees internal controls;</text>
      </paragraph>
      <paragraph num="(e)">
        <text>Resolution of all exceptions; and</text>
      </paragraph>
      <paragraph num="(f)">
        <text>Managements response;</text>
      </paragraph>
    </paragraph>
    <paragraph num="(10)">
      <text>Submit audit reports to the Commission on a schedule specified by the Commission; and</text>
    </paragraph>
    <paragraph num="(11)">
      <text>Verify that:</text>
      <paragraph num="(a)">
        <text>A deficiency or noncompliance revealed during an audit has been corrected; and</text>
      </paragraph>
      <paragraph num="(b)">
        <text>An exception disclosed during an audit has been resolved.</text>
      </paragraph>
    </paragraph>
  </paragraph>
  <paragraph num="E.">
    <text>If applicable, the audit department shall audit at least semiannually the functions and operations of the sports wagering licensees:</text>
    <paragraph num="(1)">
      <text>Cashiers cage;</text>
    </paragraph>
    <paragraph num="(2)">
      <text>Collection of cash storage boxes;</text>
    </paragraph>
    <paragraph num="(3)">
      <text>Cash count;</text>
    </paragraph>
    <paragraph num="(4)">
      <text>Revenue audit;</text>
    </paragraph>
    <paragraph num="(5)">
      <text>Sports wagering operations department; and</text>
    </paragraph>
    <paragraph num="(6)">
      <text>Key control;</text>
    </paragraph>
  </paragraph>
  <paragraph num="F.">
    <text>If applicable, the audit department shall audit at least annually:</text>
    <paragraph num="(1)">
      <text>Responsible gaming program;</text>
    </paragraph>
    <paragraph num="(2)">
      <text>Security department;</text>
    </paragraph>
    <paragraph num="(3)">
      <text>Currency transaction reporting;</text>
    </paragraph>
    <paragraph num="(4)">
      <text>Suspicious activity reporting;</text>
    </paragraph>
    <paragraph num="(5)">
      <text>Information technology controls;</text>
    </paragraph>
    <paragraph num="(6)">
      <text>Surveillance department;</text>
    </paragraph>
    <paragraph num="(7)">
      <text>Bettor tracking system; and</text>
    </paragraph>
    <paragraph num="(8)">
      <text>Sports wagering platform.</text>
    </paragraph>
  </paragraph>
  <paragraph num="G.">
    <text>The internal audit department shall conduct an audit on an unannounced basis when possible.</text>
  </paragraph>
</regulation>