Section 3772-10-07 - Audits; other reports; suspicious transaction reporting(A) Each casino operator must have its annual financial statements audited by an independent certified public accountant or, when appropriate, an independent registered certified public accounting firm, licensed to practice in this state. The audit must be in accordance with generally accepted auditing standards and, when applicable, the standards of the accountancy board. The casino operator must report to the commission the name of the independent certified public accountant or independent registered certified public accounting firm as well as the lead audit partner or other individual taking primary responsibility for the financial statement audit engagement before the start of the engagement.(B) The lead audit partner or other individual taking primary responsibility for the financial statement audit engagement may serve a maximum of five years in such a position before being required to rotate off the engagement.(C) The annual financial statements audit must be prepared on a comparative basis for the current and prior fiscal years and present financial position and results of operations in conformity with generally accepted accounting principles. The financial audit required by this rule must include an explanation reconciling any differences between the financial statements included in any annual reports and the audited financial statements.(D) The casino operator must require the independent certified public accountant or independent registered certified public accounting firm auditing the casino operator's financial statements to render a report on the prospective financial statements, including a one-year forecast and three-year projection, expressing an opinion as to whether the prospective financial information is properly prepared on the basis of the assumptions and is presented in accordance with the relevant financial reporting framework, and any additional reports required by the executive director.(E) The casino operator must file with the commission the reports required by paragraphs (A) and (D) of this rule in a format determined by the executive director within one hundred twenty days following the end of the casino operator's fiscal year or upon receipt, whichever is earlier.(F) Each casino operator must contract with a third party to perform an independent IT audit and surveillance system audit. The third party must be approved by the executive director as qualified, independent, and capable of performing the audit. The audits must be performed, and a copy of the report provided to the commission, at least once every licensure period. The audits and corresponding report must assess the following:(1) The design, controls, maintenance, and security of the casino operator's IT and surveillance systems;(2) The casino operator's compliance with the IT and surveillance requirements of this chapter; and(3) Any other subject required by the executive director.(G) At any time, the executive director may require a special audit of a casino operator by commission personnel, an independent certified public accountant, an independent registered certified public accounting firm, or any other third party the executive director approves as qualified, independent, and capable of performing the special audit. The scope, procedures, and reporting requirements of any special audit are to be established by the executive director.(H) The casino operator must notify the commission of any report that is filed, or required to be filed, with the securities and exchange commission or other securities regulatory agency.(I) All audits and reports required by this rule are to be prepared at the sole expense of the casino operator.(J) Any audit engagement contract entered into under this rule is subject to decertification, as established under paragraph (A) of rule 3772-10-23 of the Administrative Code, or invalidation due to lack of qualification, independence, or capacity or a finding that the contract or conduct performed thereunder poses a material risk to the integrity of casino gaming in this state. The invalidation process is an action against the casino operator that is subject to the hearing procedures and disciplinary actions provided for under Chapters 3772-21 and 3772-22 of the Administrative Code, respectively. If an audit engagement contract is decertified or invalidated, the casino operator must enter into a new audit engagement contract to ensure the requirements of this rule are met.(K) Each casino operator must file with the commission a copy of any suspicious activity report. Replaces: 3772-10-07
Ohio Admin. Code 3772-10-07
Effective: 2/28/2022
Five Year Review (FYR) Dates: 02/28/2027
Promulgated Under: 119.03
Statutory Authority: 3772.03
Rule Amplifies: 3772.03, 3772.033, 3772.10
Prior Effective Dates: 04/01/2012, 09/26/2015, 01/26/2019