Md. Code Regs. 36.03.10.16

Current through Register Vol. 51, No. 12, June 14, 2024

Section 36.03.10.16 - Internal Audit Department Standards

A. At least 60 days before video lottery terminal operations are set to commence, a facility operator shall submit to the Commission for review and approval internal audit department operating standards and procedures that:

(1) Meet the requirements of Regulation .10E(6)(b) of this chapter;

(2) Conform to this regulation; and

(3) Ensure that an internal audit is conducted in accordance with generally accepted auditing standards in the United States.

B. A facility operator's internal audit department operating procedures and standards shall, at a minimum, require the internal audit department to:

(1) Work independently of the departments of the facility that are subject to audit;

(2) Assess whether the facility's internal controls comply with applicable law and Commission directives;

(3) Test the facility's compliance with its internal controls;

(4) Immediately report a deficiency in, or noncompliance with, the facility's internal controls to:

(a) The audit committee;

(b) The chief executive officer;

(c) Management; and

(d) The Commission;

(5) Recommend resolution for eliminating a deficiency in, or noncompliance with, the facility's internal control system;

(6) Meet periodically with the audit committee or director of internal audit;

(7) Perform audits of:

(a) Unless an alternate risk assessment and audit plan is submitted in writing and approved in writing by the Commission, all departments of the facility that are designated under §§C and D of this regulation; and

(b) A department of the facility designated by the Commission;

(8) Prepare an audit report for each audit conducted;

(9) Accurately document the audit process and results in an audit report that, at a minimum, shall include:

(a) Audit objectives;

(b) Audit procedures and scope;

(c) Findings and conclusions;

(d) A recommendation for addressing a deficiency in, or noncompliance with, the facility's internal controls;

(e) Resolution of all exceptions; and

(f) Management's response;

(10) Submit audit reports to the Commission on a schedule specified by the Commission; and

(11) Verify that:

(a) A deficiency or noncompliance revealed during an audit has been corrected; and

(b) An exception disclosed during an audit has been resolved.

C. The audit department shall audit at least semiannually the functions and operations of the facility's:

(1) Cashiers' cage;

(2) Main bank;

(3) Collection of cash storage boxes;

(4) Cash count;

(5) Revenue audit;

(6) Operations department;

(7) Key control; and

(8) Table game operations.

D. The audit department shall audit at least annually:

(1) Responsible gaming program;

(2) Security department;

(3) Currency transaction reporting;

(4) Suspicious activity reporting;

(5) Information technology controls;

(6) Surveillance department; and

(7) Player tracking system.

E. The internal audit department shall conduct an audit on an unannounced basis when possible.

Md. Code Regs. 36.03.10.16

Regulations .16 adopted as an emergency provision effective March 1, 2013 (40:6 Md. R. 470); emergency action expired effective July 20, 2013
Regulations .16 adopted effective adopted effective 40:16 Md. R. 1347, eff.8/19/2013
Regulation .16C amended effective 41:10 Md. R. 566, eff.5/26/2014 ; amended effective 42:26 Md. R. 1597, eff.1/7/2016; amended effective 45:21 Md. R. 973, eff. 10/22/2018; amended effective 47:21 Md. R. 905, eff. 10/19/2020; amended effective 50:26 Md. R. 1130, effective 12/12/2023, exp. 6/9/2024 (Emergency); amended effective 51:10 Md. R. 529, eff. 5/27/2024.