+---+---------------------------------+---+---+---+-----+------------+
| * |                                 |   |   |   |     |            |
| * |                                 |   |   |   |     |            |
| ( |                                 |   |   |   |     |            |
| a |                                 |   |   |   |     |            |
| ) |                                 |   |   |   |     |            |
| G |                                 |   |   |   |     |            |
| e |                                 |   |   |   |     |            |
| n |                                 |   |   |   |     |            |
| e |                                 |   |   |   |     |            |
| r |                                 |   |   |   |     |            |
| a |                                 |   |   |   |     |            |
| l |                                 |   |   |   |     |            |
| c |                                 |   |   |   |     |            |
| o |                                 |   |   |   |     |            |
| n |                                 |   |   |   |     |            |
| t |                                 |   |   |   |     |            |
| r |                                 |   |   |   |     |            |
| o |                                 |   |   |   |     |            |
| l |                                 |   |   |   |     |            |
| s |                                 |   |   |   |     |            |
| f |                                 |   |   |   |     |            |
| o |                                 |   |   |   |     |            |
| r |                                 |   |   |   |     |            |
| g |                                 |   |   |   |     |            |
| a |                                 |   |   |   |     |            |
| m |                                 |   |   |   |     |            |
| i |                                 |   |   |   |     |            |
| n |                                 |   |   |   |     |            |
| g |                                 |   |   |   |     |            |
| h |                                 |   |   |   |     |            |
| a |                                 |   |   |   |     |            |
| r |                                 |   |   |   |     |            |
| d |                                 |   |   |   |     |            |
| w |                                 |   |   |   |     |            |
| a |                                 |   |   |   |     |            |
| r |                                 |   |   |   |     |            |
| e |                                 |   |   |   |     |            |
| a |                                 |   |   |   |     |            |
| n |                                 |   |   |   |     |            |
| d |                                 |   |   |   |     |            |
| s |                                 |   |   |   |     |            |
| o |                                 |   |   |   |     |            |
| f |                                 |   |   |   |     |            |
| t |                                 |   |   |   |     |            |
| w |                                 |   |   |   |     |            |
| a |                                 |   |   |   |     |            |
| r |                                 |   |   |   |     |            |
| e |                                 |   |   |   |     |            |
| . |                                 |   |   |   |     |            |
| * |                                 |   |   |   |     |            |
| * |                                 |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 1 | Does gaming operation           | \ | \ | \ | 542 |            |
| \ | management take an active role  | _ | _ | _ | .16 |            |
| . | in the following: (Note: The    | \ | \ | \ | (a) |            |
|   | standard shall apply to each    | _ | _ | _ | (1) |            |
|   | applicable department within    | \ | \ | \ |     |            |
|   | the gaming operation.)          | _ | _ | _ |     |            |
|   |                                 | \ | \ | \ |     |            |
|   | Physical and logical security   | _ | _ | _ |     |            |
|   | measures are implemented,       |   |   |   |     |            |
|   | maintained, and adhered to by   |   |   |   |     |            |
|   | personnel to prevent            |   |   |   |     |            |
|   | unauthorized access that could  |   |   |   |     |            |
|   | cause errors or compromise data |   |   |   |     |            |
|   | or processing integrity?        |   |   |   |     |            |
|   | (Inquiry)                       |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 2 | Does gaming operation           | \ | \ | \ | 542 |            |
| \ | management take an active role  | _ | _ | _ | .16 |            |
| . | in the following: (Note: The    | \ | \ | \ | (a) |            |
|   | standard shall apply to each    | _ | _ | _ | (1) |            |
|   | applicable department within    | \ | \ | \ | (i) |            |
|   | the gaming operation.)          | _ | _ | _ |     |            |
|   |                                 | \ | \ | \ |     |            |
|   | All new gaming vendor hardware  | _ | _ | _ |     |            |
|   | and software                    |   |   |   |     |            |
|   | agreements/contracts contain    |   |   |   |     |            |
|   | language requiring the vendor   |   |   |   |     |            |
|   | to adhere to the tribal         |   |   |   |     |            |
|   | internal control standards      |   |   |   |     |            |
|   | applicable to the goods and     |   |   |   |     |            |
|   | services the vendor is          |   |   |   |     |            |
|   | providing? (Review other-       |   |   |   |     |            |
|   | vendor hardware and software    |   |   |   |     |            |
|   | agreements and contracts)       |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 3 | Does gaming operation           | \ | \ | \ | 5   |            |
| \ | management take an active role  | _ | _ | _ | 42. |            |
| . | in the following: (Note: The    | \ | \ | \ | 16( |            |
|   | standard shall apply to each    | _ | _ | _ | a)( |            |
|   | applicable department within    | \ | \ | \ | 1)( |            |
|   | the gaming operation.)          | _ | _ | _ | ii) |            |
|   |                                 | \ | \ | \ |     |            |
|   | Physical security measures      | _ | _ | _ |     |            |
|   | exist over computer, computer   |   |   |   |     |            |
|   | terminals and storage media to  |   |   |   |     |            |
|   | prevent unauthorized access and |   |   |   |     |            |
|   | loss of integrity of data and   |   |   |   |     |            |
|   | processing (hardware)?          |   |   |   |     |            |
|   | (Observation and inquiry)       |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 4 | Does gaming operation           | \ | \ | \ | 54  |            |
| \ | management take an active role  | _ | _ | _ | 2.1 |            |
| . | in the following: (Note: The    | \ | \ | \ | 6(a |            |
|   | standard shall apply to each    | _ | _ | _ | )(1 |            |
|   | applicable department within    | \ | \ | \ | )(i |            |
|   | the gaming operation.)          | _ | _ | _ | ii) |            |
|   |                                 | \ | \ | \ |     |            |
|   | Access to systems software and  | _ | _ | _ |     |            |
|   | application programs is limited |   |   |   |     |            |
|   | to authorized personnel?        |   |   |   |     |            |
|   | (Inquiry)                       |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 5 | Does gaming operation           | \ | \ | \ | 5   |            |
| \ | management take an active role  | _ | _ | _ | 42. |            |
| . | in the following: (Note: The    | \ | \ | \ | 16( |            |
|   | standard shall apply to each    | _ | _ | _ | a)( |            |
|   | applicable department within    | \ | \ | \ | 1)( |            |
|   | the gaming operation.)          | _ | _ | _ | iv) |            |
|   |                                 | \ | \ | \ |     |            |
|   | Access to computer data limited | _ | _ | _ |     |            |
|   | to authorized personnel?        |   |   |   |     |            |
|   | (Inquiry)                       |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 6 | Does gaming operation           | \ | \ | \ | 542 |            |
| \ | management take an active role  | _ | _ | _ | .16 |            |
| . | in the following: (Note: The    | \ | \ | \ | (a) |            |
|   | standard shall apply to each    | _ | _ | _ | (1) |            |
|   | applicable department within    | \ | \ | \ | (v) |            |
|   | the gaming operation.)          | _ | _ | _ |     |            |
|   |                                 | \ | \ | \ |     |            |
|   | Access to computer              | _ | _ | _ |     |            |
|   | communications facilities, or   |   |   |   |     |            |
|   | the computer system, and        |   |   |   |     |            |
|   | information transmissions       |   |   |   |     |            |
|   | limited to authorized           |   |   |   |     |            |
|   | personnel? (Inquiry)            |   |   |   |     |            |
|   | (Applicable to communication    |   |   |   |     |            |
|   | processes)                      |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 7 | Are the main computers (i.e.,   | \ | \ | \ | 542 |            |
| \ | hardware, software and data     | _ | _ | _ | .16 |            |
| . | files) for each gaming          | \ | \ | \ | (a) |            |
|   | application (e.g., keno, race   | _ | _ | _ | (2) |            |
|   | and sports, slots, etc.) in a   | \ | \ | \ |     |            |
|   | secured area with access        | _ | _ | _ |     |            |
|   | restricted to authorized        | \ | \ | \ |     |            |
|   | persons, including vendors      | _ | _ | _ |     |            |
|   | (physical security)?            |   |   |   |     |            |
|   | (Observation and review other-  |   |   |   |     |            |
|   | authorization lists)            |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 8 | Is access to computer           | \ | \ | \ | 542 |            |
| \ | operations restricted to        | _ | _ | _ | .16 |            |
| . | authorized personnel to reduce  | \ | \ | \ | (a) |            |
|   | the risk of loss of integrity   | _ | _ | _ | (3) |            |
|   | of data or processing (logical  | \ | \ | \ |     |            |
|   | security)? (Inquiry and review  | _ | _ | _ |     |            |
|   | other-authorization list)       | \ | \ | \ |     |            |
|   |                                 | _ | _ | _ |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 9 | Are incompatible duties         | \ | \ | \ | 542 |            |
| \ | adequately segregated and       | _ | _ | _ | .16 |            |
| . | monitored to prevent error in   | \ | \ | \ | (a) |            |
|   | general IT procedures to go     | _ | _ | _ | (4) |            |
|   | undetected or fraud to be       | \ | \ | \ |     |            |
|   | concealed? (Inquiry and review  | _ | _ | _ |     |            |
|   | other- authorization lists for  | \ | \ | \ |     |            |
|   | incompatible duties)            | _ | _ | _ |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 1 | Are non-IT personnel precluded  | \ | \ | \ | 542 |            |
| 0 | from having unrestricted access | _ | _ | _ | .16 |            |
| \ | to the secured computer areas?  | \ | \ | \ | (a) |            |
| . | (Inquiry)                       | _ | _ | _ | (5) |            |
|   |                                 | \ | \ | \ |     |            |
|   |                                 | _ | _ | _ |     |            |
|   |                                 | \ | \ | \ |     |            |
|   |                                 | _ | _ | _ |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 1 | Are the computer systems,       | \ | \ | \ | 542 |            |
| 1 | including application software, | _ | _ | _ | .16 |            |
| \ | secured through the use of      | \ | \ | \ | (a) |            |
| . | passwords or other approved     | _ | _ | _ | (6) |            |
|   | means where applicable          | \ | \ | \ |     |            |
|   | (Application software installed | _ | _ | _ |     |            |
|   | on specific computers, computer | \ | \ | \ |     |            |
|   | systems located in secure room, | _ | _ | _ |     |            |
|   | etc)? (Applicable to all gaming |   |   |   |     |            |
|   | and related areas) (Inquiry and |   |   |   |     |            |
|   | review other- perform log-in    |   |   |   |     |            |
|   | tests on network system(s) and  |   |   |   |     |            |
|   | each stand alone system.)       |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 1 | Do management personnel or      | \ | \ | \ | 542 |            |
| 2 | persons independent of the      | _ | _ | _ | .16 |            |
| \ | department being controlled     | \ | \ | \ | (a) |            |
| . | assign and control access to    | _ | _ | _ | (6) |            |
|   | system functions? (Inquiry and  | \ | \ | \ |     |            |
|   | review other- perform log-in    | _ | _ | _ |     |            |
|   | tests on network system(s) and  | \ | \ | \ |     |            |
|   | each stand alone system.)       | _ | _ | _ |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 1 | Are passwords controlled as     | \ | \ | \ | 542 |            |
| 3 | follows unless otherwise        | _ | _ | _ | .16 |            |
| \ | addressed in this section:      | \ | \ | \ | (a) |            |
| . | (Inquiry)                       | _ | _ | _ | (7) |            |
|   |                                 | \ | \ | \ | (i) |            |
|   | Does each user have their own   | _ | _ | _ |     |            |
|   | individual password?            | \ | \ | \ |     |            |
|   |                                 | _ | _ | _ |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 1 | Are passwords controlled as     | \ | \ | \ | 5   |            |
| 4 | follows unless otherwise        | _ | _ | _ | 42. |            |
| \ | addressed in this section:      | \ | \ | \ | 16( |            |
| . | (Inquiry and review supporting  | _ | _ | _ | a)( |            |
|   | documentation)                  | \ | \ | \ | 7)( |            |
|   |                                 | _ | _ | _ | ii) |            |
|   | Are passwords changed at least  | \ | \ | \ |     |            |
|   | quarterly with changes          | _ | _ | _ |     |            |
|   | documented?                     |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 1 | Are passwords controlled as     | \ | \ | \ | 54  |            |
| 5 | follows unless otherwise        | _ | _ | _ | 2.1 |            |
| \ | addressed in this section:      | \ | \ | \ | 6(a |            |
| . | (Inquiry and review supporting  | _ | _ | _ | )(7 |            |
|   | documentation)                  | \ | \ | \ | )(i |            |
|   |                                 | _ | _ | _ | ii) |            |
|   | For computer systems that       | \ | \ | \ |     |            |
|   | automatically force a password  | _ | _ | _ |     |            |
|   | change on a quarterly basis, is |   |   |   |     |            |
|   | documentation maintained        |   |   |   |     |            |
|   | listing the systems and the     |   |   |   |     |            |
|   | date the user was given access? |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 1 | Are adequate backup and         | \ | \ | \ | 542 |            |
| 6 | recovery procedures in place,   | _ | _ | _ | .16 |            |
| \ | which include : (Inquiry)       | \ | \ | \ | (a) |            |
| . |                                 | _ | _ | _ | (8) |            |
|   | Frequent backup of data files?  | \ | \ | \ | (i) |            |
|   |                                 | _ | _ | _ |     |            |
|   |                                 | \ | \ | \ |     |            |
|   |                                 | _ | _ | _ |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 1 | Are adequate backup and         | \ | \ | \ | 5   |            |
| 7 | recovery procedures in place,   | _ | _ | _ | 42. |            |
| \ | which include : (Inquiry)       | \ | \ | \ | 16( |            |
| . |                                 | _ | _ | _ | a)( |            |
|   | Backup of all programs?         | \ | \ | \ | 8)( |            |
|   |                                 | _ | _ | _ | ii) |            |
|   |                                 | \ | \ | \ |     |            |
|   |                                 | _ | _ | _ |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 1 | Are adequate backup and         | \ | \ | \ | 54  |            |
| 8 | recovery procedures in place,   | _ | _ | _ | 2.1 |            |
| \ | which include : (Observation    | \ | \ | \ | 6(a |            |
| . | and inquiry if onsite)(         | _ | _ | _ | )(8 |            |
|   | Adequate protection means       | \ | \ | \ | )(i |            |
|   | fireproof and restricted to     | _ | _ | _ | ii) |            |
|   | authorized personnel)           | \ | \ | \ |     |            |
|   |                                 | _ | _ | _ |     |            |
|   | Secured off-site storage of all |   |   |   |     |            |
|   | backup data files and programs, |   |   |   |     |            |
|   | or other adequate protection?   |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 1 | Are adequate backup and         | \ | \ | \ | 5   |            |
| 9 | recovery procedures in place,   | _ | _ | _ | 42. |            |
| \ | which include : (Inquiry and    | \ | \ | \ | 16( |            |
| . | review supporting               | _ | _ | _ | a)( |            |
|   | documentation)                  | \ | \ | \ | 8)( |            |
|   |                                 | _ | _ | _ | iv) |            |
|   | Recovery procedures, which are  | \ | \ | \ |     |            |
|   | tested on a sample basis at     | _ | _ | _ |     |            |
|   | least annually with             |   |   |   |     |            |
|   | documentation of results?       |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 2 | Is adequate information         | \ | \ | \ | 542 |            |
| 0 | technology system documentation | _ | _ | _ | .16 |            |
| \ | maintained, including           | \ | \ | \ | (a) |            |
| . | descriptions of hardware and    | _ | _ | _ | (9) |            |
|   | software, operator manuals,     | \ | \ | \ |     |            |
|   | etc.? (Review supporting        | _ | _ | _ |     |            |
|   | documentation )                 | \ | \ | \ |     |            |
|   |                                 | _ | _ | _ |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| * |                                 |   |   |   |     |            |
| * |                                 |   |   |   |     |            |
| ( |                                 |   |   |   |     |            |
| b |                                 |   |   |   |     |            |
| ) |                                 |   |   |   |     |            |
| I |                                 |   |   |   |     |            |
| n |                                 |   |   |   |     |            |
| d |                                 |   |   |   |     |            |
| e |                                 |   |   |   |     |            |
| p |                                 |   |   |   |     |            |
| e |                                 |   |   |   |     |            |
| n |                                 |   |   |   |     |            |
| d |                                 |   |   |   |     |            |
| e |                                 |   |   |   |     |            |
| n |                                 |   |   |   |     |            |
| c |                                 |   |   |   |     |            |
| e |                                 |   |   |   |     |            |
| o |                                 |   |   |   |     |            |
| f |                                 |   |   |   |     |            |
| i |                                 |   |   |   |     |            |
| n |                                 |   |   |   |     |            |
| f |                                 |   |   |   |     |            |
| o |                                 |   |   |   |     |            |
| r |                                 |   |   |   |     |            |
| m |                                 |   |   |   |     |            |
| a |                                 |   |   |   |     |            |
| t |                                 |   |   |   |     |            |
| i |                                 |   |   |   |     |            |
| o |                                 |   |   |   |     |            |
| n |                                 |   |   |   |     |            |
| t |                                 |   |   |   |     |            |
| e |                                 |   |   |   |     |            |
| c |                                 |   |   |   |     |            |
| h |                                 |   |   |   |     |            |
| n |                                 |   |   |   |     |            |
| o |                                 |   |   |   |     |            |
| l |                                 |   |   |   |     |            |
| o |                                 |   |   |   |     |            |
| g |                                 |   |   |   |     |            |
| y |                                 |   |   |   |     |            |
| p |                                 |   |   |   |     |            |
| e |                                 |   |   |   |     |            |
| r |                                 |   |   |   |     |            |
| s |                                 |   |   |   |     |            |
| o |                                 |   |   |   |     |            |
| n |                                 |   |   |   |     |            |
| n |                                 |   |   |   |     |            |
| e |                                 |   |   |   |     |            |
| l |                                 |   |   |   |     |            |
| . |                                 |   |   |   |     |            |
| * |                                 |   |   |   |     |            |
| * |                                 |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 2 | Is the IT department            | \ | \ | \ | 542 |            |
| 1 | independent of the gaming areas | _ | _ | _ | .16 |            |
| \ | (e.g., cage, pit, count rooms,  | \ | \ | \ | (b) |            |
| . | etc.) and are the IT procedures | _ | _ | _ | (1) |            |
|   | and controls documented and     | \ | \ | \ |     |            |
|   | responsibilities communicated   | _ | _ | _ |     |            |
|   | to appropriate personnel?       | \ | \ | \ |     |            |
|   | (Organizational reporting       | _ | _ | _ |     |            |
|   | independent of gaming and       |   |   |   |     |            |
|   | gaming related departments)     |   |   |   |     |            |
|   | (Inquiry and review supporting  |   |   |   |     |            |
|   | documentation)                  |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 2 | Are IT department personnel     | \ | \ | \ | 542 |            |
| 2 | precluded from unauthorized     | _ | _ | _ | .16 |            |
| \ | access to the following:        | \ | \ | \ | (b) |            |
| . | (Authorized access limited to   | _ | _ | _ | (2) |            |
|   | computer support activities.)   | \ | \ | \ | (i) |            |
|   | (Inquiry and review supporting  | _ | _ | _ |     |            |
|   | documentation)                  | \ | \ | \ |     |            |
|   |                                 | _ | _ | _ |     |            |
|   | Computers and terminals located |   |   |   |     |            |
|   | in gaming areas?                |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 2 | Are IT department personnel     | \ | \ | \ | 5   |            |
| 3 | precluded from unauthorized     | _ | _ | _ | 42. |            |
| \ | access to the following:        | \ | \ | \ | 16( |            |
| . | (Authorized access limited to   | _ | _ | _ | b)( |            |
|   | computer support activities.)   | \ | \ | \ | 2)( |            |
|   | (Inquiry and review supporting  | _ | _ | _ | ii) |            |
|   | documentation)                  | \ | \ | \ |     |            |
|   |                                 | _ | _ | _ |     |            |
|   | Source documents?               |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 2 | Are IT department personnel     | \ | \ | \ | 54  |            |
| 4 | precluded from unauthorized     | _ | _ | _ | 2.1 |            |
| \ | access to the following:        | \ | \ | \ | 6(b |            |
| . | (Inquiry and review supporting  | _ | _ | _ | )(2 |            |
|   | documentation)                  | \ | \ | \ | )(i |            |
|   |                                 | _ | _ | _ | ii) |            |
|   | Live data files (not test       | \ | \ | \ |     |            |
|   | data)?                          | _ | _ | _ |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 2 | Are IT personnel restricted     | \ | \ | \ | 542 |            |
| 5 | from the following: (Authorized | _ | _ | _ | .16 |            |
| \ | access limited to computer      | \ | \ | \ | (b) |            |
| . | support activities.) (Inquiry   | _ | _ | _ | (3) |            |
|   | and review supporting           | \ | \ | \ | (i) |            |
|   | documentation)                  | _ | _ | _ |     |            |
|   |                                 | \ | \ | \ |     |            |
|   | Having unauthorized access to   | _ | _ | _ |     |            |
|   | cash or other liquid assets?    |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 2 | Are IT personnel restricted     | \ | \ | \ | 5   |            |
| 6 | from: (Inquiry) Initiating      | _ | _ | _ | 42. |            |
| \ | general or subsidiary ledger    | \ | \ | \ | 16( |            |
| . | entries?                        | _ | _ | _ | b)( |            |
|   |                                 | \ | \ | \ | 3)( |            |
|   |                                 | _ | _ | _ | ii) |            |
|   |                                 | \ | \ | \ |     |            |
|   |                                 | _ | _ | _ |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| * |                                 |   |   |   |     |            |
| * |                                 |   |   |   |     |            |
| ( |                                 |   |   |   |     |            |
| c |                                 |   |   |   |     |            |
| ) |                                 |   |   |   |     |            |
| G |                                 |   |   |   |     |            |
| a |                                 |   |   |   |     |            |
| m |                                 |   |   |   |     |            |
| i |                                 |   |   |   |     |            |
| n |                                 |   |   |   |     |            |
| g |                                 |   |   |   |     |            |
| p |                                 |   |   |   |     |            |
| r |                                 |   |   |   |     |            |
| o |                                 |   |   |   |     |            |
| g |                                 |   |   |   |     |            |
| r |                                 |   |   |   |     |            |
| a |                                 |   |   |   |     |            |
| m |                                 |   |   |   |     |            |
| c |                                 |   |   |   |     |            |
| h |                                 |   |   |   |     |            |
| a |                                 |   |   |   |     |            |
| n |                                 |   |   |   |     |            |
| g |                                 |   |   |   |     |            |
| e |                                 |   |   |   |     |            |
| s |                                 |   |   |   |     |            |
| . |                                 |   |   |   |     |            |
| * |                                 |   |   |   |     |            |
| * |                                 |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 2 | Are program changes for         | \ | \ | \ | 542 |            |
| 7 | in-house developed systems      | _ | _ | _ | .16 |            |
| \ | documented as follows: (Inquiry | \ | \ | \ | (c) |            |
| . | and review supporting           | _ | _ | _ | (1) |            |
|   | documentation)                  | \ | \ | \ | (i) |            |
|   |                                 | _ | _ | _ |     |            |
|   | Requests for new programs or    | \ | \ | \ |     |            |
|   | program changes are reviewed by | _ | _ | _ |     |            |
|   | the IT supervisor and approvals |   |   |   |     |            |
|   | to begin work on the program    |   |   |   |     |            |
|   | are documented?                 |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 2 | Are program changes for         | \ | \ | \ | 5   |            |
| 8 | in-house developed systems      | _ | _ | _ | 42. |            |
| \ | documented as follows: (Inquiry | \ | \ | \ | 16( |            |
| . | and review supporting           | _ | _ | _ | c)( |            |
|   | documentation)                  | \ | \ | \ | 1)( |            |
|   |                                 | _ | _ | _ | ii) |            |
|   | A written plan of               | \ | \ | \ |     |            |
|   | implementation for new and      | _ | _ | _ |     |            |
|   | modified programs is maintained |   |   |   |     |            |
|   | and includes, at a minimum:     |   |   |   |     |            |
|   |                                 |   |   |   |     |            |
|   | The date the program is to be   |   |   |   |     |            |
|   | placed into service?            |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 2 | Are program changes for         | \ | \ | \ | 5   |            |
| 9 | in-house developed systems      | _ | _ | _ | 42. |            |
| \ | documented as follows: (Inquiry | \ | \ | \ | 16( |            |
| . | and review supporting           | _ | _ | _ | c)( |            |
|   | documentation)                  | \ | \ | \ | 1)( |            |
|   |                                 | _ | _ | _ | ii) |            |
|   | A written plan of               | \ | \ | \ |     |            |
|   | implementation for new and      | _ | _ | _ |     |            |
|   | modified programs is maintained |   |   |   |     |            |
|   | and includes, at a minimum:     |   |   |   |     |            |
|   |                                 |   |   |   |     |            |
|   | The nature of the change?       |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 3 | Are program changes for         | \ | \ | \ | 5   |            |
| 0 | in-house developed systems      | _ | _ | _ | 42. |            |
| \ | documented as follows: (Inquiry | \ | \ | \ | 16( |            |
| . | and review supporting           | _ | _ | _ | c)( |            |
|   | documentation)                  | \ | \ | \ | 1)( |            |
|   |                                 | _ | _ | _ | ii) |            |
|   | A written plan of               | \ | \ | \ |     |            |
|   | implementation for new and      | _ | _ | _ |     |            |
|   | modified programs is maintained |   |   |   |     |            |
|   | and includes, at a minimum:     |   |   |   |     |            |
|   |                                 |   |   |   |     |            |
|   | A description of procedures     |   |   |   |     |            |
|   | required in order to bring the  |   |   |   |     |            |
|   | new or modified program into    |   |   |   |     |            |
|   | service (conversion or input of |   |   |   |     |            |
|   | data, installation procedures,  |   |   |   |     |            |
|   | etc.)?                          |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 3 | Are program changes for         | \ | \ | \ | 5   |            |
| 1 | in-house developed systems      | _ | _ | _ | 42. |            |
| \ | documented as follows: (Inquiry | \ | \ | \ | 16( |            |
| . | and review supporting           | _ | _ | _ | c)( |            |
|   | documentation)                  | \ | \ | \ | 1)( |            |
|   |                                 | _ | _ | _ | ii) |            |
|   | A written plan of               | \ | \ | \ |     |            |
|   | implementation for new and      | _ | _ | _ |     |            |
|   | modified programs is maintained |   |   |   |     |            |
|   | and includes, at a minimum:     |   |   |   |     |            |
|   |                                 |   |   |   |     |            |
|   | An indication of who is to      |   |   |   |     |            |
|   | perform all such procedures?    |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 3 | Are program changes for         | \ | \ | \ | 54  |            |
| 2 | in-house developed systems      | _ | _ | _ | 2.1 |            |
| \ | documented as follows: (Inquiry | \ | \ | \ | 6(c |            |
| . | and review supporting           | _ | _ | _ | )(1 |            |
|   | documentation)                  | \ | \ | \ | )(i |            |
|   |                                 | _ | _ | _ | ii) |            |
|   | Testing of new and modified     | \ | \ | \ |     |            |
|   | programs is performed and       | _ | _ | _ |     |            |
|   | documented prior to             |   |   |   |     |            |
|   | implementation?                 |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 3 | Are program changes for         | \ | \ | \ | 5   |            |
| 3 | in-house developed systems      | _ | _ | _ | 42. |            |
| \ | documented as follows: (Inquiry | \ | \ | \ | 16( |            |
| . | and review supporting           | _ | _ | _ | c)( |            |
|   | documentation)                  | \ | \ | \ | 1)( |            |
|   |                                 | _ | _ | _ | iv) |            |
|   | A record of the final program   | \ | \ | \ |     |            |
|   | or program changes, including   | _ | _ | _ |     |            |
|   | evidence of user acceptance,    |   |   |   |     |            |
|   | date in service, programmer,    |   |   |   |     |            |
|   | and reason for changes, is      |   |   |   |     |            |
|   | documented and maintained?      |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| * |                                 |   |   |   |     |            |
| * |                                 |   |   |   |     |            |
| ( |                                 |   |   |   |     |            |
| d |                                 |   |   |   |     |            |
| ) |                                 |   |   |   |     |            |
| S |                                 |   |   |   |     |            |
| e |                                 |   |   |   |     |            |
| c |                                 |   |   |   |     |            |
| u |                                 |   |   |   |     |            |
| r |                                 |   |   |   |     |            |
| i |                                 |   |   |   |     |            |
| t |                                 |   |   |   |     |            |
| y |                                 |   |   |   |     |            |
| l |                                 |   |   |   |     |            |
| o |                                 |   |   |   |     |            |
| g |                                 |   |   |   |     |            |
| s |                                 |   |   |   |     |            |
| . |                                 |   |   |   |     |            |
| * |                                 |   |   |   |     |            |
| * |                                 |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 3 | Are computer security logs      | \ | \ | \ | 542 |            |
| 4 | generated by the system         | _ | _ | _ | .16 |            |
| \ | reviewed by IT supervisory      | \ | \ | \ | (d) |            |
| . | personnel for evidence of the   | _ | _ | _ | (1) |            |
|   | following: (Note: Standard does | \ | \ | \ | (i) |            |
|   | not apply to personal           | _ | _ | _ |     |            |
|   | computers.) (Inquiry)           | \ | \ | \ |     |            |
|   |                                 | _ | _ | _ |     |            |
|   | Multiple attempts to log-on?    |   |   |   |     |            |
|   | (Alternatively, the system      |   |   |   |     |            |
|   | shall deny user access after    |   |   |   |     |            |
|   | three login attempts)           |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 3 | Are computer security logs      | \ | \ | \ | 5   |            |
| 5 | generated by the system         | _ | _ | _ | 42. |            |
| \ | reviewed by IT supervisory      | \ | \ | \ | 16( |            |
| . | personnel for evidence of the   | _ | _ | _ | d)( |            |
|   | following: (Note: Standard does | \ | \ | \ | 1)( |            |
|   | not apply to personal           | _ | _ | _ | ii) |            |
|   | computers.) (Inquiry)           | \ | \ | \ |     |            |
|   |                                 | _ | _ | _ |     |            |
|   | Unauthorized changes to live    |   |   |   |     |            |
|   | data files?                     |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 3 | Are computer security logs      | \ | \ | \ | 54  |            |
| 6 | generated by the system         | _ | _ | _ | 2.1 |            |
| \ | reviewed by IT supervisory      | \ | \ | \ | 6(d |            |
| . | personnel for evidence of the   | _ | _ | _ | )(1 |            |
|   | following: (Note: Standard does | \ | \ | \ | )(i |            |
|   | not apply to personal           | _ | _ | _ | ii) |            |
|   | computers.) (Inquiry)           | \ | \ | \ |     |            |
|   |                                 | _ | _ | _ |     |            |
|   | Any other unusual transactions? |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| * |                                 |   |   |   |     |            |
| * |                                 |   |   |   |     |            |
| ( |                                 |   |   |   |     |            |
| e |                                 |   |   |   |     |            |
| ) |                                 |   |   |   |     |            |
| R |                                 |   |   |   |     |            |
| e |                                 |   |   |   |     |            |
| m |                                 |   |   |   |     |            |
| o |                                 |   |   |   |     |            |
| t |                                 |   |   |   |     |            |
| e |                                 |   |   |   |     |            |
| d |                                 |   |   |   |     |            |
| i |                                 |   |   |   |     |            |
| a |                                 |   |   |   |     |            |
| l |                                 |   |   |   |     |            |
| - |                                 |   |   |   |     |            |
| u |                                 |   |   |   |     |            |
| p |                                 |   |   |   |     |            |
| . |                                 |   |   |   |     |            |
| * |                                 |   |   |   |     |            |
| * |                                 |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 3 | If remote dial-up to any        | \ | \ | \ | 542 |            |
| 7 | associated equipment is allowed | _ | _ | _ | .16 |            |
| \ | for software support, does the  | \ | \ | \ | (e) |            |
| . | gaming operation maintain an    | _ | _ | _ | (1) |            |
|   | access log (computerized or     | \ | \ | \ | (i) |            |
|   | manual) that includes: (Inquiry | _ | _ | _ |     |            |
|   | and review supporting           | \ | \ | \ |     |            |
|   | documentation)                  | _ | _ | _ |     |            |
|   |                                 |   |   |   |     |            |
|   | Name of employee authorizing    |   |   |   |     |            |
|   | modem access?                   |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 3 | If remote dial-up to any        | \ | \ | \ | 5   |            |
| 8 | associated equipment is allowed | _ | _ | _ | 42. |            |
| \ | for software support, does the  | \ | \ | \ | 16( |            |
| . | gaming operation maintain an    | _ | _ | _ | e)( |            |
|   | access log (computerized or     | \ | \ | \ | 1)( |            |
|   | manual) that includes: (Inquiry | _ | _ | _ | ii) |            |
|   | and review supporting           | \ | \ | \ |     |            |
|   | documentation)                  | _ | _ | _ |     |            |
|   |                                 |   |   |   |     |            |
|   | Name of authorized programmer   |   |   |   |     |            |
|   | or manufacturer representative? |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 3 | If remote dial-up to any        | \ | \ | \ | 54  |            |
| 9 | associated equipment is allowed | _ | _ | _ | 2.1 |            |
| \ | for software support, does the  | \ | \ | \ | 6(e |            |
| . | gaming operation maintain an    | _ | _ | _ | )(1 |            |
|   | access log that includes:       | \ | \ | \ | )(i |            |
|   | (Inquiry and review supporting  | _ | _ | _ | ii) |            |
|   | documentation)                  | \ | \ | \ |     |            |
|   |                                 | _ | _ | _ |     |            |
|   | Reason for modem access?        |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 4 | If remote dial-up to any        | \ | \ | \ | 5   |            |
| 0 | associated equipment is allowed | _ | _ | _ | 42. |            |
| \ | for software support, does the  | \ | \ | \ | 16( |            |
| . | gaming operation maintain an    | _ | _ | _ | e)( |            |
|   | access log that includes:       | \ | \ | \ | 1)( |            |
|   | (Inquiry and review supporting  | _ | _ | _ | iv) |            |
|   | documentation)                  | \ | \ | \ |     |            |
|   |                                 | _ | _ | _ |     |            |
|   | Description of work performed?  |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 4 | If remote dial-up to any        | \ | \ | \ | 542 |            |
| 1 | associated equipment is allowed | _ | _ | _ | .16 |            |
| \ | for software support, does the  | \ | \ | \ | (e) |            |
| . | gaming operation maintain an    | _ | _ | _ | (1) |            |
|   | access log that includes:       | \ | \ | \ | (v) |            |
|   | (Inquiry and review supporting  | _ | _ | _ |     |            |
|   | documentation)                  | \ | \ | \ |     |            |
|   |                                 | _ | _ | _ |     |            |
|   | Date and time?                  |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 4 | If remote dial-up to any        | \ | \ | \ | 542 |            |
| 2 | associated equipment is allowed | _ | _ | _ | .16 |            |
| \ | for software support, does the  | \ | \ | \ | (e) |            |
| . | gaming operation maintain an    | _ | _ | _ | (1) |            |
|   | access log (computerized or     | \ | \ | \ | (v) |            |
|   | manual) that includes: (Inquiry | _ | _ | _ |     |            |
|   | and review supporting           | \ | \ | \ |     |            |
|   | documentation)                  | _ | _ | _ |     |            |
|   |                                 |   |   |   |     |            |
|   | Duration of access?             |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| * |                                 |   |   |   |     |            |
| * |                                 |   |   |   |     |            |
| ( |                                 |   |   |   |     |            |
| f |                                 |   |   |   |     |            |
| ) |                                 |   |   |   |     |            |
| D |                                 |   |   |   |     |            |
| o |                                 |   |   |   |     |            |
| c |                                 |   |   |   |     |            |
| u |                                 |   |   |   |     |            |
| m |                                 |   |   |   |     |            |
| e |                                 |   |   |   |     |            |
| n |                                 |   |   |   |     |            |
| t |                                 |   |   |   |     |            |
| s |                                 |   |   |   |     |            |
| t |                                 |   |   |   |     |            |
| o |                                 |   |   |   |     |            |
| r |                                 |   |   |   |     |            |
| a |                                 |   |   |   |     |            |
| g |                                 |   |   |   |     |            |
| e |                                 |   |   |   |     |            |
| . |                                 |   |   |   |     |            |
| * |                                 |   |   |   |     |            |
| * |                                 |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 4 | If the gaming operation scans   | \ | \ | \ | 542 |            |
| 3 | or directly stores documents to | _ | _ | _ | .16 |            |
| \ | an unalterable storage medium,  | \ | \ | \ | (f) |            |
| . | are the following conditions    | _ | _ | _ | (1) |            |
|   | met:                            | \ | \ | \ | (i) |            |
|   |                                 | _ | _ | _ |     |            |
|   | Does the storage medium contain | \ | \ | \ |     |            |
|   | the exact duplicate of the      | _ | _ | _ |     |            |
|   | original document? (Review      |   |   |   |     |            |
|   | other- sample current           |   |   |   |     |            |
|   | documents)                      |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 4 | If the gaming operation scans   | \ | \ | \ | 5   |            |
| 4 | or directly stores documents to | _ | _ | _ | 42. |            |
| \ | an unalterable storage medium,  | \ | \ | \ | 16( |            |
| . | are the following conditions    | _ | _ | _ | f)( |            |
|   | met:                            | \ | \ | \ | 1)( |            |
|   |                                 | _ | _ | _ | ii) |            |
|   | Are all documents stored on the | \ | \ | \ |     |            |
|   | storage medium maintained with  | _ | _ | _ |     |            |
|   | a detailed index containing the |   |   |   |     |            |
|   | gaming operation department and |   |   |   |     |            |
|   | date? (Review supporting        |   |   |   |     |            |
|   | documentation)                  |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 4 | If the gaming operation scans   | \ | \ | \ | 5   |            |
| 5 | or directly stores documents to | _ | _ | _ | 42. |            |
| \ | an unalterable storage medium,  | \ | \ | \ | 16( |            |
| . | are the following conditions    | _ | _ | _ | f)( |            |
|   | met:                            | \ | \ | \ | 1)( |            |
|   |                                 | _ | _ | _ | ii) |            |
|   | Is the index available upon     | \ | \ | \ |     |            |
|   | request by the Commission?      | _ | _ | _ |     |            |
|   | (Inquiry)                       |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 4 | If the gaming operation scans   | \ | \ | \ | 54  |            |
| 6 | or directly stores documents to | _ | _ | _ | 2.1 |            |
| \ | an unalterable storage medium,  | \ | \ | \ | 6(f |            |
| . | are the following conditions    | _ | _ | _ | )(1 |            |
|   | met:                            | \ | \ | \ | )(i |            |
|   |                                 | _ | _ | _ | ii) |            |
|   | Upon request and adequate       | \ | \ | \ |     |            |
|   | notice by the Commission, is    | _ | _ | _ |     |            |
|   | hardware (terminal, printer,    |   |   |   |     |            |
|   | etc.) made available in order   |   |   |   |     |            |
|   | to perform auditing procedures? |   |   |   |     |            |
|   | (Inquiry)                       |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 4 | If the gaming operation scans   | \ | \ | \ | 5   |            |
| 7 | or directly stores documents to | _ | _ | _ | 42. |            |
| \ | an unalterable storage medium,  | \ | \ | \ | 16( |            |
| . | are the following conditions    | _ | _ | _ | f)( |            |
|   | met:                            | \ | \ | \ | 1)( |            |
|   |                                 | _ | _ | _ | iv) |            |
|   | Do controls exist to ensure the | \ | \ | \ |     |            |
|   | accurate reproduction of        | _ | _ | _ |     |            |
|   | records up to and including the |   |   |   |     |            |
|   | printing of stored documents    |   |   |   |     |            |
|   | used for auditing purposes?     |   |   |   |     |            |
|   | (Inquiry) (Indicator: periodic  |   |   |   |     |            |
|   | verification of accurate        |   |   |   |     |            |
|   | reproduction of records on      |   |   |   |     |            |
|   | sample basis)                   |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 4 | If the gaming operation scans   | \ | \ | \ | 542 |            |
| 8 | or directly stores documents to | _ | _ | _ | .16 |            |
| \ | an unalterable storage medium,  | \ | \ | \ | (f) |            |
| . | are the following conditions    | _ | _ | _ | (1) |            |
|   | met:                            | \ | \ | \ | (v) |            |
|   |                                 | _ | _ | _ |     |            |
|   | Is the storage medium retained  | \ | \ | \ |     |            |
|   | for a minimum of five years?    | _ | _ | _ |     |            |
|   | (Inquiry and review supporting  |   |   |   |     |            |
|   | documentation, on sample basis) |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+
| 4 | If the gaming operation scans   | \ | \ | \ | 5   |            |
| 9 | or directly stores documents to | _ | _ | _ | 42. |            |
| \ | an unalterable storage medium,  | \ | \ | \ | 16( |            |
| . | are the following conditions    | _ | _ | _ | f)( |            |
|   | met:                            | \ | \ | \ | 1)( |            |
|   |                                 | _ | _ | _ | vi) |            |
|   | Have original documents been    | \ | \ | \ |     |            |
|   | retained until the books and    | _ | _ | _ |     |            |
|   | records have been audited by an |   |   |   |     |            |
|   | independent certified public    |   |   |   |     |            |
|   | accountant? (Inquiry)           |   |   |   |     |            |
+---+---------------------------------+---+---+---+-----+------------+