Section 3772-10-14 - Internal audit standards(A) Each casino operator's internal controls must include internal audit standards.(B) The casino operator must maintain a separate internal audit department whose primary function is to perform internal audit work that must be independent with respect to the departments subject to audit. The casino operator must ensure that the standards, conventions, and rules governing audits in the United States are followed for all audits. The internal audit department must be responsible for the following:(1) The review and appraisal of the adherence of the casino operator's internal controls to Chapter 3772. of the Revised Code and the rules adopted thereunder;(2) Performing tests to ensure compliance with the internal controls ;(3) The reporting to the casino operator's management and the commission of instances of noncompliance with the internal controls ;(4) The reporting to the casino operator's management and the commission of any weaknesses in the internal controls ;(5) The recommendation of procedures to eliminate any weaknesses in the internal controls ; and(6) Performing tests to ensure compliance with rule 3772-10-06 of the Administrative Code.(C) The auditing department must prepare documents to evidence all internal audit work performed as the work relates to the requirements in this rule, including all instances of noncompliance with the internal controls :(1) The internal audit department must operate with audit programs that address the requirements of this rule;(2) The internal audit department must accurately document the work performed, the conclusions reached, and the resolution of all exceptions; and(3) All audit reports must be prepared, maintained, and provided to the commission on a schedule approved by the executive director.(D) Internal audit personnel must perform audits of all major gaming areas of the casino operator. The following must be reviewed at least semi-annually:(1) Slot revenue and procedures;(2) Table games revenue and procedures;(5) Information technology;(6) Complimentaries and promotions;(7) Control of access to assets and restricted areas;(9) Any other internal audits as required by the executive director, audit committee of the board of directors, or any other entity designated by the executive director.(E) The audit reports must include the following information:(2) Audit procedures and scope;(3) Findings and conclusions; and(4) Management's response.(F) The internal audit department must perform follow-up examinations to verify that corrective action has been taken regarding all instances of noncompliance cited by internal audit and the independent accountant. Further, if directed by the executive director, the internal audit department must perform follow-up examinations to verify that corrective action has been taken regarding all settlement agreements, notices of noncompliance, and disciplines imposed by the commission. These verifications must be performed within three months of the issuance of the audit report.(G) Whenever possible, internal audit observations must be performed on an unannounced basis.(H) All exceptions disclosed during audits must be investigated and resolved.(I) All internal audit findings must be reported to management, who must respond to internal audit findings stating corrective measures to be taken to avoid recurrence of the audit exception. The management responses must be included in the internal audit reports that are delivered to the casino operator's management, the commission, audit committee of the board of directors, or other entity designated by the executive director.Ohio Admin. Code 3772-10-14
Effective: 2/28/2022
Five Year Review (FYR) Dates: 11/23/2021 and 02/28/2027
Promulgated Under: 119.03
Statutory Authority: 3772.03
Rule Amplifies: 3772.03, 3772.033
Prior Effective Dates: 04/01/2012, 05/27/2017