Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 1 of 64

1/26/2017 Version

§1. What are the minimum internal control standards for keno?

§2. What are the minimum internal control standards for pari-mutuel wagering?

§3. What are the minimum internal control standards for table games?

§4. What are the minimum internal control standards for gaming machines?

§5. What are the minimum internal control standards for gaming promotions and player tracking 

systems?

§6. What are the minimum internal control standards for complimentary services or items?

§7. What are the minimum internal control standards for patron deposit accounts and cashless 

systems?

§8. What are the minimum internal control standards for lines of credit?

§9. What are the minimum internal control standards for the cage, vault, kiosk, cash and cash 

equivalents?

§10. What are the minimum internal control standards for information technology and information 

technology data?

§11. What are the minimum internal control standards for drop and count?

§12. What are the minimum internal control standards for auditing revenue?

§13. What are the minimum internal control standards for audit and accounting?

§14. What are the minimum internal control standards for surveillance?

§15. What are the minimum internal control standards for controlled keys?
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 2 of 64

1/26/2017 Version

§1. What are the minimum internal control standards for keno?

(a) Supervision. Supervision must be provided as needed for keno operations by an agent(s) with 

authority equal to or greater than those being supervised. 

(b) Game play standards. 

(1) The computerized customer ticket must include the date, game number, ticket sequence 

number, station number or writer identification number, and conditioning (including multi-race 

if applicable). 

(2) Concurrently with the generation of the ticket the information on the ticket must be 

recorded in a manner that restricts access. 

(3) Keno personnel must be precluded from having access to the restricted ticket information. 

(4) When it is necessary to void a ticket, the void information must be entered into the 

computer and the computer must document the appropriate information pertaining to the 

voided wager (e.g., void slip is issued or equivalent documentation is generated). 

(5) Controls must exist to prevent the writing and voiding of tickets after a game has been 

closed and after the number selection process for that game has begun. 

(6) The controls in effect for tickets prepared in areas other than the main keno area where bets 

may be placed and tickets paid must be identical to those in effect for the primary keno game. 

(c) Rabbit ear or wheel system. The following standards must apply if a rabbit ear or wheel system is 

utilized: 

(1) Before and after the game, the following must be monitored by a dedicated camera: 

(i) Empty rabbit ears or wheel; 

(ii) Date and time; 

(iii) Game number; and 

(iv) Full rabbit ears or wheel. 

(2) The recording of the rabbit ears or wheel must provide a legible identification of the 

numbers on the balls drawn.

(3) Keno agents must immediately input the numbers on the balls drawn in the computer and 

the computer must document the date, the game number, the time the game was closed, and 

the numbers drawn. 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 3 of 64

1/26/2017 Version

(4) Controls must be established and procedures implemented that prevent unauthorized access 

to keno balls in play. 

(5) Back-up keno ball inventories must be secured in a manner to prevent unauthorized access. 

(6) Controls must be established and procedures implemented to ensure that all eligible objects 

used in the conduct of the keno game are available to be drawn and have not been damaged or 

altered. Verification of physical objects must be performed by two agents before the start of the 

first keno game/session. At least one of the verifying agents must be a supervisory agent or 

independent of the keno games department.. 

(d) Random number generator. If a random number generator is utilized, controls must be established 

and procedures implemented that require the following: 

(1) The numbers selected by the random number generator must be directly relayed to, and 

automatically recorded in, the keno computer system. 

(2) Keno agents must be precluded from access to the random number generator. 

(e) Prize payout.

(1) Controls must be established and procedures implemented that address the following:

(i) Identification of the agent authorized (by position) to make a payout;

(ii) Predetermined payout authorization levels (by position); 

(iii) Documentation procedures ensuring separate control of the cash accountability 

functions; 

(iv) The sequence number of tickets presented for payment must be entered into the 

computer, and the payment amount generated by the computer must be given to the 

customer.

(v)Preclusion of payment of tickets previously presented for payment;

(vi) Unclaimed winning tickets (sleepers) after a specified period of time; 

(vii) Voided tickets; and 

(viii) Tickets that have not been issued yet. 

(ix) All payouts must be supported by the customer (computer-generated) copy of the 

winning ticket (payout amount is indicated on the customer ticket or a payment slip is 

issued). 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 4 of 64

1/26/2017 Version

(x) A manual report or other documentation must be produced and maintained 

documenting any payments made on tickets that are not authorized by the computer. 

(2) Prize payouts over a specified dollar amount, not to exceed $10,000 or a lower threshold as 

authorized by management and approved by the TGRA, must also require the following: 

(i) Approval of management personnel independent of the keno department, evidenced 

by their signature; 

(ii) Review of the video recording and/or digital record of the rabbit ears or wheel to 

verify the legitimacy of the draw and the accuracy of the draw ticket (for rabbit ear or 

wheel systems only); 

(iii) Comparison of the winning customer copy to the computer reports; 

(iv) Regrading of the customer copy using the payout schedule and draw information; 

and 

(v) Documentation and maintenance of the performance of the procedures in this 

paragraph. 

(3) Authorization and signatures. 

(i) At least two agents must authorize, sign, and witness prize payouts above $1,200, or 

a lower threshold as authorized by management and approved by the TGRA.

(ii) Prize payouts above the following threshold, or a lower threshold, as authorized by 

management and approved by TGRA, must require one of the two signatures and 

verifications to be a supervisory or management employee independent of the keno 

operation:

(A) $5,000 for a Tier A facility;

(B) $10,000 at a Tier B facility;

(C) $20,000 for a Tier C facility; or

(D) $50,000 for a Tier C facility with over $100,000,000 in gross gaming 

revenues.

(iii) The predetermined thresholds, whether set at the MICS level or lower, must be 

authorized by management, approved by the TGRA, documented, and maintained.

(f) For each agent station, a cash summary report (count sheet) at the end of each keno shift must be 

prepared that includes: 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 5 of 64

1/26/2017 Version

(1) Computation of net cash proceeds for the shift and the cash turned in, and any variances 

between the cash turn-in and the amount of net cash that the computer system indicates 

should be in each agent station; and 

(2) Signatures of two agents who have verified the net cash proceeds for the shift and the cash 

turned in. 

(g) Cash and cash equivalent controls. 

(1) Cash or cash equivalents exchanged between two persons must be counted independently 

by at least two agents and reconciled to the recorded amounts at the end of each shift or 

session. Unexplained variances must be documented and maintained. Unverified transfers of 

cash or cash equivalents are prohibited.

(2) Procedures must be implemented to control cash or cash equivalents based on the amount 

of the transaction. These procedures must include documentation by shift, session, or other 

relevant time period of the following:

(i) Inventory, including any increases or decreases;

(ii) Transfers;

(iii) Exchanges, including acknowledging signatures or initials; and

(iv) Resulting variances.

(3) Any change to control of accountability, exchange, or transfer requires that the cash or cash 

equivalents be counted and recorded independently by at least two agents and reconciled to 

the recorded amount.

(h) Promotional payouts or awards. If a gaming operation offers promotional payouts or awards, the 

payout form/documentation must include the following information: 

(1) Date and time; 

(2) Dollar amount of payout or description of personal property (e.g., jacket, toaster, car, etc.), 

including fair market value; 

(3) Type of promotion; and 

(4) Signature of at least one employee authorizing and completing the transaction. 

(i) Standards for statistical reports. 

(1) Records must be maintained that include win and write by individual writer for each day. 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 6 of 64

1/26/2017 Version

(2) Records must be maintained for each keno game operated and the total for all keno games 

operated that include win, write, and win-to-write hold percentage for the following: 

(i) Each shift; 

(ii) Each day; 

(iii) Month-to-date; and 

(iv) Year-to-date or fiscal year-to-date as applicable. 

(3) A manager independent of the keno department must review keno statistical data at least on 

a monthly basis and investigate any large or unusual statistical variances. 

(4) At a minimum, investigations must be performed for statistical percentage fluctuations from 

the base level for a month at thresholds established by management and approved by the 

TGRA. The base level must be defined as the gaming operation's win percentage for the 

previous business year or the previous twelve (12) months. 

(5) Such investigations must be documented, maintained for inspection, and provided to the 

Tribal gaming regulatory authority upon request. 

(j) Documentation standards. 

(1) The computer system must generate adequate documentation of all pertinent keno 

information, to include the following:. 

(i) Ticket information (as described in paragraph (b)(1) of this section); 

(ii) Payout information (e.g., date, time, ticket number, amount, etc.); 

(iii) Game information (e.g., number, ball draw, time, etc.); 

(iv) Daily recap information, including: 

(A) Write; 

(B) Payouts; and 

(C) Gross revenue (win); 

(v) System exception information, including: 

(A) Voids; 

(B) Late pays; and 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 7 of 64

1/26/2017 Version

(C) Appropriate system parameter information (e.g., changes in pay tables, ball 

draws, payouts over a predetermined amount, etc.); and 

(vi) Agent access listing, including: 

(A) Agent name or agent identification number; and 

(B) Listing of functions agent can perform or equivalent means of identifying 

same. 

(2) This documentation must be restricted to authorized agents. 

(k) Equipment standards. 

(1) There must be effective maintenance planned to service keno equipment, including 

computer program updates, hardware servicing, and keno ball selection equipment (e.g., service 

contract with lessor). 

(2) Keno equipment maintenance (excluding keno balls) must be independent of the operation 

of the keno game. 

(3) Keno maintenance agents must report irregularities to management independent of the 

keno department. 

(4) If the gaming operation utilizes a barcode or microchip reader in connection with the play of 

keno, the reader must be tested at least annually by agents independent of the keno 

department to determine that it is correctly reading the barcode or microchip. 

(l) Document retention. 

(1) All documents (including computer storage media) discussed in this section must be retained 

for five (5) years, except for the following, which must be retained for at least seven (7) days: 

(i) Video recordings and/or digital records of rabbit ears or wheel;

(ii) All copies of winning keno tickets of less than $1,500.00. 

(m) Multi-race tickets. 

(1) Procedures must be established to notify keno agents immediately of large multi-race 

winners. 

(2) Procedures must be established to ensure that keno agents are aware of multi-race tickets 

still in process at the end of a shift. 

(n) All relevant controls from § 10, Information and Technology will apply.

(o) Revenue Audit. Standards for revenue audit of keno are contained in § 12, Revenue Audit. 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 8 of 64

1/26/2017 Version

(p) Variance. The operation must establish, as approved by the TGRA, the threshold level at which a 

variance must be reviewed to determine the cause. Any such review must be documented.

§2. What are the minimum internal control standards for pari-mutuel wagering?

(a) Supervision. Supervision must be provided as needed for pari-mutuel operations by an agent(s) with 

authority equal to or greater than those being supervised. 

(b) Betting ticket and equipment standards. 

(1) All pari-mutuel wagers must be transacted through the pari-mutuel satellite system. In case 

of computer failure between the pari-mutuel book and the hub, no tickets must be manually 

written. 

(2) Whenever a betting station is opened for wagering or turned over to a new agent, the agent 

must sign on and the computer must document gaming operation name (or identification 

number), station number, the agent identifier, and the date and time. 

(3) A betting ticket must consist of at least two parts: 

(i) An original, which must be transacted and issued through a printer and given to the 

customer; and 

(ii) A copy that must be recorded concurrently with the generation of the original ticket.

(4) Upon accepting a wager, the betting ticket that is created must contain the following: 

(i) A unique transaction identifier; 

(ii) Gaming operation name (or identification number) and station number; 

(iii) Race track, race number, horse identification or event identification, as applicable; 

(iv) Type of bet(s), each bet amount, total number of bets, and total take; and 

(v) Date and time. 

(5) All tickets must be considered final at post time. 

(6) If a gaming operation voids a betting ticket written prior to post time, it must be immediately 

entered into the system. 

(7) Future wagers must be accepted and processed in the same manner as regular wagers. 

(8) The gaming operation must be prohibited from the following;

(i) Accepting from a patron less than full face value of a pari-mutuel wager;
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 9 of 64

1/26/2017 Version

(ii) Agreeing to refund or rebate to a patron any portion or percentage of the value of a 

pari-mutuel wager; or

(iii) Increasing the payoff of, or pay a bonus on, a winning pari-mutuel wager.

(c) Payout standards. 

(1) Prior to making payment on a ticket, the agent must input the ticket for verification and 

payment authorization. 

(2) The computer must be incapable of authorizing payment on a ticket that has been previously 

paid, a voided ticket, a losing ticket, or an unissued ticket. 

(d) Checkout standards. 

(1) Whenever the betting station is closed or the agent is replaced, the agent must sign off and 

the computer must document the gaming operation name (or identification number), station 

number, the agent identifier, the date and time, and cash balance. 

(2) For each agent station a summary report must be completed at the conclusion of each shift 

including: 

(i) Computation of cash turned in for the shift; and 

(ii) Signature of two agents who have independently verified the cash turned in for the 

shift. Unverified transfers of cash and/or cash equivalents are prohibited.

(e) Computer reports standards. 

(1) Adequate documentation of all pertinent pari-mutuel information must be generated by the 

computer system for each day's operation. 

(2) This documentation must be restricted to authorized agents. 

(3) The documentation must include, but is not limited to the following: 

(i) Unique transaction identifier; 

(ii) Date/time of transaction; 

(iii) Type of wager; 

(iv) Animal identification or event identification; 

(v) Amount of wagers (by ticket, agent/kiosk, track/event, and total); 

(vi) Amount of payouts (by ticket, agent/kiosk, track/event, and total); 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 10 of 64

1/26/2017 Version

(vii) Tickets refunded (by ticket, agent, track/event, and total); 

(viii) Unpaid winners/vouchers (“outs”) (by ticket/voucher, track/event, and total); 

(ix) Voucher sales/payments (by ticket, agent/kiosk, and track/event); 

(x) Voids (by ticket, agent, and total); 

(xi) Future wagers (by ticket, date of event, total by day, and total at the time of revenue 

recognition); 

(xii) Results (winners and payout data); 

(xiii) Breakage data (by race and track/event); 

(xiv) Commission data (by race and track/event); and 

(xv) Purged data (by ticket and total). 

(4) The system must generate the following reports: 

(i) A reconciliation report that summarizes totals by track/event, including write, the 

day's winning ticket total, total commission and breakage due the gaming operation, 

and net funds transferred to or from the gaming operation's bank account; 

(ii) An exception report that contains a listing of all system functions and overrides not 

involved in the actual writing or cashing of tickets, including sign-on/off, voids, and 

manually input paid tickets; and 

(iii) A purged ticket report that contains a listing of the unique transaction identifier(s), 

description, ticket cost and value, and date purged. 

(f) All relevant controls from § 10, Information and Technology will apply.

(g) Revenue Audit. Standards for revenue audit of pari-mutuel wagering are contained in § 12, Revenue 

Audit. 

(h) Variance. The operation must establish, as approved by the TGRA, the threshold level at which a 

variance must be reviewed to determine the cause. Any such review must be documented.

§3. What are the minimum internal control standards for table games?

(a) Supervision. Supervision must be provided as needed for table games operations by an agent(s) with 

authority equal to or greater than those being supervised.

(b) Fill and credit standards. 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 11 of 64

1/26/2017 Version

(1) Fill slips and credit slips must be in at least triplicate form, and in a continuous, prenumbered series. Such slips must be concurrently numbered in a form utilizing the alphabet and 

only in one series at a time. The alphabet need not be used if the numerical series is not 

repeated during the business year. 

(2) Unissued and issued fill/credit slips must be safeguarded and adequate procedures must be 

employed in their distribution, use, and control. Agents from the cashier or pit departments 

must have no access to the secured (control) copies of the fill/credit slips. 

(3) When a fill/credit slip is voided, the cashier agent must clearly mark “void” across the face of 

the original and first copy, the cashier and one other agent independent of the transactions 

must sign both the original and first copy, and must submit them to the accounting department 

for retention and accountability. 

(4) Fill transactions must be authorized by pit supervisory agents before the issuance of fill slips 

and transfer of chips, tokens, or cash equivalents. The fill request must be communicated to the 

cage where the fill slip is prepared. 

(5) At least three parts of each fill slip must be utilized as follows: 

(i) One part must be transported to the pit with the fill and, after the appropriate 

signatures are obtained, deposited in the table game drop box; 

(ii) One part must be retained in the cage for reconciliation of the cashier bank; and 

(iii) For computer systems, one part must be retained in a secure manner to insure that 

only authorized agents may gain access to it. For manual systems, one part must be 

retained in a secure manner in a continuous unbroken form. 

(6) The table number, shift, and amount of fill by denomination and in total must be noted on all 

copies of the fill slip. The correct date and time must be indicated on at least two copies. 

(7) All fills must be carried from the cashier's cage by an agent who is independent of the cage 

or pit. 

(8) The fill slip must be signed by at least the following agents (as an indication that each has 

counted the amount of the fill and the amount agrees with the fill slip): 

(i) Cashier who prepared the fill slip and issued the chips, tokens, or cash equivalent; 

(ii) Runner who carried the chips, tokens, or cash equivalents from the cage to the pit; 

(iii) Dealer or boxperson who received the chips, tokens, or cash equivalents at the 

gaming table; and 

(iv) Pit supervisory agent who supervised the fill transaction. 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 12 of 64

1/26/2017 Version

(9) Fills must be broken down and verified by the dealer or boxperson in public view before the 

dealer or boxperson places the fill in the table tray. 

(10) A copy of the fill slip must then be deposited into the drop box on the table by the dealer, 

where it must appear in the soft count room with the cash receipts for the shift. 

(11) Table credit transactions must be authorized by a pit supervisor before the issuance of 

credit slips and transfer of chips, tokens, or other cash equivalent. The credit request must be 

communicated to the cage where the credit slip is prepared. 

(12) At least three parts of each credit slip must be utilized as follows: 

(i) Two parts of the credit slip must be transported by the runner to the pit. After 

signatures of the runner, dealer, and pit supervisor are obtained, one copy must be 

deposited in the table game drop box and the original must accompany transport of the 

chips, tokens, markers, or cash equivalents from the pit to the cage for verification and 

signature of the cashier. 

(ii) For computer systems, one part must be retained in a secure manner to insure that 

only authorized agents may gain access to it. For manual systems, one part must be 

retained in a secure manner in a continuous unbroken form. 

(13) The table number, shift, and the amount of credit by denomination and in total must be 

noted on all copies of the credit slip. The correct date and time must be indicated on at least 

two copies. 

(14) Chips, tokens, and/or cash equivalents must be removed from the table tray by the dealer 

or boxperson and must be broken down and verified by the dealer or boxperson in public view 

prior to placing them in racks for transfer to the cage. 

(15) All chips, tokens, and cash equivalents removed from the tables and markers removed from 

the pit must be carried to the cashier's cage by an agent who is independent of the cage or pit. 

(16) The credit slip must be signed by at least the following agents (as an indication that each 

has counted or, in the case of markers, reviewed the items transferred): 

(i) Cashier who received the items transferred from the pit and prepared the credit slip; 

(ii) Runner who carried the items transferred from the pit to the cage; 

(iii) Dealer who had custody of the items prior to transfer to the cage; and 

(iv) Pit supervisory agent who supervised the credit transaction. 

(17) The credit slip must be inserted in the drop box by the dealer. 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 13 of 64

1/26/2017 Version

(18) Chips, tokens, or other cash equivalents must be deposited on or removed from gaming 

tables only when accompanied by the appropriate fill/credit or marker transfer forms. 

(19) Cross fills (the transfer of chips between table games) and even cash exchanges are 

prohibited in the pit. 

(c) Table inventory forms. 

(1) At the close of each shift, for those table banks that were opened during that shift: 

(i) The table's chip, token, coin, and marker inventory must be counted and recorded on 

a table inventory form; or 

(ii) If the table banks are maintained on an imprest basis, a final fill or credit must be 

made to bring the bank back to par. 

(2) If final fills are not made, beginning and ending inventories must be recorded on the master 

game sheet for shift win calculation purposes. 

(3) The accuracy of inventory forms prepared at shift end must be verified by the outgoing pit 

supervisor and the dealer. Alternatively, if the dealer is not available, such verification may be 

provided by another pit supervisor or another supervisor from another gaming department. 

Verifications must be evidenced by signature on the inventory form. 

(4) If inventory forms are placed in the drop box, such action must be performed by an agent 

other than a pit supervisor. 

(d) Table games computer generated documentation standards. 

(1) The computer system must be capable of generating adequate documentation of all 

information recorded on the source documents and transaction detail (e.g., fill/credit slips, 

markers, etc.). 

(2) This documentation must be restricted to authorized agents. 

(3) The documentation must include, at a minimum: 

(i) System exception information (e.g., appropriate system parameter information, 

corrections, voids, etc.); and 

(ii) Agent access listing, which includes, at a minimum: 

(A) Agent name or agent identification number (if applicable); and 

(B) Listing of functions agents can perform or equivalent means of identifying 

the same. 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 14 of 64

1/26/2017 Version

(e) Standards for playing cards and dice. 

(1) Playing cards and dice must be maintained in a secure location to prevent unauthorized 

access and to reduce the possibility of tampering. 

(2) Used cards and dice must be maintained in a secure location until marked, scored, or 

destroyed, in a manner as approved by the Tribal gaming regulatory authority, to prevent 

unauthorized access and reduce the possibility of tampering. 

(3) Controls must be established and procedures implemented that establish a reasonable time 

period, within which to mark, cancel, or destroy cards and dice from play. 

(i) This standard must not apply where playing cards or dice are retained for an

investigation. 

(4) A card control log must be maintained that documents when cards and dice are received on 

site, distributed to and returned from tables and removed from play by the gaming operation. 

(f) Plastic cards. If a gaming operation uses plastic cards (not plastic-coated cards), the cards may be 

used for up to three (3) months if the plastic cards are routinely inspected, and washed or cleaned in a 

manner and time frame approved by the Tribal gaming regulatory authority. 

(g) Analysis of table game performance standards. 

(1) Records must be maintained by day and shift indicating any single-deck blackjack games that 

were dealt for an entire shift. 

(2) Records reflecting hold percentage by table and type of game must be maintained by shift, 

by day, cumulative month-to-date, and cumulative year-to-date. 

(3) This information must be presented to and reviewed by management independent of the pit 

department on at least a monthly basis. 

(4) The management in paragraph (g)(3) of this section must investigate any unusual 

fluctuations in hold percentage with pit supervisory agents.

(5) The results of such investigations must be documented, maintained for inspection, and 

provided to the Tribal gaming regulatory authority upon request. 

(h) Marker credit play. 

(1) If a gaming operation allows marker credit play (exclusive of rim credit and call bets), the 

following standards must apply: 

(i) A marker system must allow for credit to be both issued and repaid in the pit. 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 15 of 64

1/26/2017 Version

(ii) Prior to the issuance of gaming credit to a player, the agent extending the credit 

must contact an independent source to determine if the player's credit limit has been 

properly established and there is sufficient remaining credit available for the advance. 

(iii) Proper authorization of credit extension in excess of the previously established limit 

must be documented. 

(iv) The amount of credit extended must be communicated to the independent source 

and the amount documented within a reasonable time subsequent to each issuance. 

(v) The marker form must be prepared in at least triplicate form with a preprinted or 

concurrently printed marker number, and utilized in numerical sequence. (This 

requirement must not preclude the distribution of batches of markers to various pits.) 

(vi) At least three parts of each separately numbered marker form must be utilized as 

follows: 

(A) Original must be maintained in the pit until settled or transferred to the 

cage; 

(B) Payment slip must be maintained in the pit until the marker is settled or 

transferred to the cage. If paid in the pit, the slip must be inserted in the table 

game drop box. If not paid in the pit, the slip must be transferred to the cage 

with the original; 

(C) Issue slip must be inserted into the appropriate table game drop box when 

credit is extended or when the player has signed the original. 

(vii) When marker documentation (e.g., issue slip and payment slip) is inserted in the 

drop box, such action must be performed by the dealer or boxperson at the table. 

(viii) A record must be maintained that details the following (e.g., master credit record 

retained at the pit podium): 

(A) The signature or initials of the agent(s) approving the extension of credit 

(unless such information is contained elsewhere for each issuance); 

(B) The legible name of the person receiving the credit; 

(C) The date and shift of granting the credit; 

(D) The table on which the credit was extended; 

(E) The amount of credit issued; 

(F) The marker number; 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 16 of 64

1/26/2017 Version

(G) The amount of credit remaining after each issuance or the total credit 

available for all issuances; 

(H) The amount of payment received and nature of settlement (e.g., credit slip 

number, cash, chips, etc.); and 

(I) The signature or initials of the agent receiving payment/settlement. 

(ix) The forms required in paragraphs (h)(1)(v), (vi), and (viii) of this section must be 

safeguarded, and adequate procedures must be employed to control the distribution, 

use, and access to these forms.

(x) All credit extensions must be initially evidenced by lammer buttons, which must be 

displayed on the table in public view and placed there by supervisory agents. 

(xi) Marker preparation must be initiated and other records updated within 

approximately one hand of play following the initial issuance of credit to the player. 

(xii) Lammer buttons must be removed only by the dealer or boxperson employed at the 

table upon completion of a marker transaction.

(xiii) The original marker must contain at least the following information: 

(A) Marker number; 

(B) Player's name and signature; 

(C) Date; and 

(D) Amount of credit issued. 

(xiv) The issue slip or stub must include the same marker number as the original, the 

table number, date and time of issuance, and amount of credit issued. The issue slip or 

stub must also include the signature of the agent extending the credit, and the signature 

or initials of the dealer or boxperson at the applicable table, unless this information is 

included on another document verifying the issued marker. 

(xv) The payment slip must include the same marker number as the original. When the 

marker is paid in full in the pit, it must also include the table number where paid, date 

and time of payment, nature of settlement (cash, chips, etc.), and amount of payment. 

The payment slip must also include the signature of pit supervisory agent acknowledging 

payment, and the signature or initials of the dealer or boxperson receiving payment, 

unless this information is included on another document verifying the payment of the 

marker. 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 17 of 64

1/26/2017 Version

(xvi) When partial payments are made in the pit, a new marker must be completed 

reflecting the remaining balance and the marker number of the marker originally issued. 

(xvii) When partial payments are made in the pit, the payment slip of the marker that 

was originally issued must be properly cross-referenced to the new marker number, 

completed with all information required by paragraph (h)(1)(xv) of this section, and 

inserted into the drop box.

(xviii) The independent source must be notified when payments (full or partial) are 

made in the pit so that cage records can be updated for such transactions. Notification 

must be made no later than when the customer's play is completed or at shift end, 

whichever is earlier. 

(xix) All portions of markers, both issued and unissued, must be safeguarded and 

procedures must be employed to control the distribution, use and access to the forms. 

(xx) An investigation must be performed to determine the cause and responsibility for 

loss whenever marker forms, or any part thereof, are missing. These investigations must 

be documented, maintained for inspection, and provided to the Tribal gaming 

regulatory authority upon request. 

(xxi) When markers are transferred to the cage, marker transfer forms or marker credit 

slips (or similar documentation) must be utilized and such documents must include, at a 

minimum, the date, time, shift, marker number(s), table number(s), amount of each 

marker, the total amount transferred, signature of pit supervisory agent releasing 

instruments from the pit, and the signature of agent verifying receipt of instruments at 

the cage. 

(xxii) All markers must be transferred to the cage within twenty-four (24) hours of 

issuance. 

(xxiii) Markers must be transported to the cashier's cage by an agent who is 

independent of the marker issuance and payment functions (pit clerks may perform this 

function). 

(i) Name credit instruments accepted in the pit. 

(1) For the purposes of this paragraph, name credit instruments means personal checks, payroll 

checks, counter checks, hold checks, traveler's checks, or other similar instruments that are 

accepted in the pit as a form of credit issuance to a player with an approved credit limit. 

(2) The following standards must apply if name credit instruments are accepted in the pit: 

(i) A name credit system must allow for the issuance of credit without using markers; 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 18 of 64

1/26/2017 Version

(ii) Prior to accepting a name credit instrument, the employee extending the credit must 

contact the cashier or another independent source to determine if the player's credit 

limit has been properly established and the remaining credit available is sufficient for 

the advance; 

(iii) All name credit instruments must be transferred to the cashier's cage (utilizing a 

two-part order for credit) immediately following the acceptance of the instrument and 

issuance of chips (if name credit instruments are transported accompanied by a credit 

slip, an order for credit is not required); 

(iv) The order for credit (if applicable) and the credit slip must include the customer's 

name, amount of the credit instrument, the date, time, shift, table number, signature of 

pit supervisory agent releasing instrument from pit, and the signature of the agent 

verifying receipt of instrument at the cage; 

(v) The procedures for transacting table credits at standards in paragraphs (b)(11) 

through (18) of this section must be strictly adhered to; and 

(vi) The acceptance of payments in the pit for name credit instruments must be 

prohibited. 

(j) Call bets. 

(1) The following standards must apply if call bets are accepted in the pit: 

(i) A call bet must be evidenced by the placement of a lammer button, chips, or other 

identifiable designation in an amount equal to that of the wager in a specific location on 

the table; 

(ii) The placement of the lammer button, chips, or other identifiable designation must 

be performed by supervisory/boxperson agents. The placement may be performed by a 

dealer only if the supervisor physically observes and gives specific authorization; 

(iii) The call bet must be settled at the end of each hand of play by the preparation of a 

marker, repayment of the credit extended, or the payoff of the winning wager. Call bets 

extending beyond one hand of play must be prohibited; and 

(iv) The removal of the lammer button, chips, or other identifiable designation must be 

performed by the dealer/ boxperson upon completion of the call bet transaction. 

(k) Rim credit. 

(1) The following standards must apply if rim credit is extended in the pit: 

(i) Rim credit must be evidenced by the issuance of chips to be placed in a neutral zone 

on the table and then extended to the customer for the customer to wager, or to the 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 19 of 64

1/26/2017 Version

dealer to wager for the customer, and by the placement of a lammer button or other 

identifiable designation in an amount equal to that of the chips extended; and 

(ii) Rim credit must be recorded on player cards, or similarly used documents, which 

must be: 

(A) Prenumbered or concurrently numbered and accounted for by a department 

independent of the pit; 

(B) For all extensions and subsequent repayments, evidenced by the initials or 

signatures of a supervisor and the dealer attesting to the validity of each credit 

extension and repayment; 

(C) An indication of the settlement method (e.g., serial number of marker 

issued, chips, cash); 

(D) Settled no later than when the customer leaves the table at which the card is 

prepared; 

(E) Transferred to the accounting department on a daily basis; and 

(F) Reconciled with other forms utilized to control the issuance of pit credit (e.g., 

master credit records, table cards). 

(l) The following standards must apply if foreign currency is accepted in the pit: 

(1) Foreign currency transactions must be authorized by a pit supervisor/ boxperson who 

completes a foreign currency exchange form before the exchange for chips or tokens; 

(2) Foreign currency exchange forms include the country of origin, total face value, 

amount of chips/token extended (i.e., conversion amount), signature of 

supervisor/boxperson, and the dealer completing the transaction; 

(3) Foreign currency exchange forms and the foreign currency must be inserted in the 

drop box by the dealer; and 

(4) Alternate procedures specific to the use of foreign valued gaming chips must be 

developed by the Tribal gaming regulatory authority, or the gaming operation as 

approved by the Tribal gaming regulatory authority. 

(m) All relevant controls from § 10, Information and Technology will apply.

(n) Revenue Audit. Standards for revenue audit of table games are contained in § 12, Revenue Audit. 

(o) Variance. The operation must establish, as approved by the TGRA, the threshold level at which a 

variance must be reviewed to determine the cause. Any such review must be documented.
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 20 of 64

1/26/2017 Version

§4. What are the minimum internal control standards for gaming machines?

(a) Supervision. Supervision must be provided as needed for table games operations by an agent(s) with 

authority equal to or greater than those being supervised.

(b) Standards for gaming machines. 

(1) For this section only, credit or customer credit means a unit of value equivalent to cash or 

cash equivalents deposited, wagered, won, lost, or redeemed by a customer. 

(2) Coins shall include tokens. 

(3) For all computerized gaming machine systems, an agent access listing shall be maintained, 

which includes at a minimum: 

(i) Agent name or agent identification number (or equivalent); and 

(ii) Listing of functions agents can perform or equivalent means of identifying same. 

(c) Prize payout and fills. Controls must be established and procedures implemented for prize payout 

and fills that address the following:

(1) Identification of the agent authorized (by position) to make a payout;

(2) Predetermined payout authorization levels (by position); 

(3) Computerized jackpot/fill systems shall be restricted so as to prevent unauthorized 

access and fraudulent payouts by one person. 

(4) Payout forms shall be controlled and routed in a manner that precludes any one 

person from producing a fraudulent payout by forging signatures or by altering the 

amount paid out after the payout and misappropriating the funds; and

(5) Documentation procedures ensuring separate control of the cash accountability 

functions. Documentation at minimum must include the following information: 

(i) Date and time; 

(ii) Machine number; 

(iii) Dollar amount of cash payout or gaming machine fill (both alpha and 

numeric) or description of personal property awarded, including fair market 

value. Alpha is optional if another unalterable method is used for evidencing the 

amount of the payout; 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 21 of 64

1/26/2017 Version

(iv) Game outcome (including reel symbols, card values, suits, etc.) for jackpot 

payouts. Game outcome is not required if a computerized jackpot/fill system is 

used; and

(v) Preprinted or concurrently printed sequential number.

(6) Verification.

(i) For payouts, at least two agents must verify that the winning pattern has 

been achieved prior to the payment of a prize. The system may serve as one of 

the verifiers.

(ii) For automated payouts, the system may serve as the sole verifier that a 

winning pattern has been achieved.

(7) Authorization and signatures.

(i) At least two agents must authorize, sign, and witness all manual prize 

payouts above $1,200, or a lower threshold as authorized by management and 

approved by the TGRA.

(ii) Manual prize payouts above the following threshold (or a lower threshold, as 

authorized by management and approved by TGRA) must require one of the 

two signatures and verifications to be a supervisory or management agent 

independent of gaming machine operations:

(A) $5,000 for a Tier A facility;

(B) $10,000 at a Tier B facility;

(C) $20,000 for a Tier C facility; or

(D) $50,000 for a Tier C facility with over $100,000,000 in gross gaming 

revenues.

(iii) The predetermined thresholds, whether set at the MICS level or lower, must be 

authorized by management, approved by the TGRA, documented, and maintained.

(iv) A gaming system may substitute for one authorization/signature verifying or 

authorizing a win, but may not substitute for a supervisory or management 

authorization/signature.

(8) Payout records, including manual payout records, must include the following 

information:

(i) Date and time;
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 22 of 64

1/26/2017 Version

(ii) Amount of the payout (alpha & numeric for player interface payouts); and

(iii) Machine identifier.

(iv) Signature of all, but not less than two, agents involved in the transaction;

(v) For override transactions, verification by a supervisory or management agent 

independent of the transaction; and

(vi) Any other information necessary to substantiate the payout.

(d) Cash and cash equivalent controls. 

(1) Cash or cash equivalents exchanged between two persons must be counted independently 

by at least two agents and reconciled to the recorded amounts at the end of each shift or 

session. Unexplained variances must be documented and maintained. Unverified transfers of 

cash or cash equivalents are prohibited.

(2) Procedures must be implemented to control cash or cash equivalents based on the amount 

of the transaction. These procedures must include documentation by shift or other relevant 

time period of the following:

(i) Transfers;

(ii) Exchanges, including acknowledging signatures or initials; and

(iii) Resulting variances.

(3) Any change to control of accountability, exchange, or transfer requires that the cash or cash 

equivalents be counted and recorded independently by at least two agents and reconciled to 

the recorded amount.

(4) The gaming machine booths and change banks that are active during the shift shall be 

counted down and reconciled each shift by two agents utilizing appropriate accountability 

documentation. 

(5) The wrapping of loose gaming machine booth and cage cashier coin shall be performed at a 

time or location that does not interfere with the hard count/wrap process or the accountability 

of that process. 

(6) A record shall be maintained evidencing the transfers of wrapped and unwrapped coins and 

retained for seven (7) days. 

(e) Gaming machine components. Controls must be established and procedures implemented to 

safeguard the integrity of gaming machine components during installations, operations, modifications, 

removal and retirements. Such procedures must include the following:
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 23 of 64

1/26/2017 Version

(1) Shipping and receiving.

(i) A communication procedure must be established between the supplier, the gaming 

operation, and the TGRA to properly control the shipping and receiving of all software 

and hardware components. Such procedures must include:

(A) Notification of pending shipments must be provided to the TGRA by the 

gaming operation;

(B) Certification by an independent test lab;

(C) Notification from the supplier to the TGRA, or the gaming operation as 

approved by the TGRA, of the shipping date and expected date of delivery. The 

shipping notification must include:

(1) Name and address of the supplier;

(2) Description of shipment;

(3) Gaming machine serial number;

(4) For software: software version and description of software;

(5) Method of shipment; and

(6) Expected date of delivery.

(ii) Procedures must be implemented for the gaming machine system components for 

maintenance and replacement.

(iii) Gaming machine components must be shipped in a secure manner to deter 

unauthorized access.

(iv) The TGRA, or its designee, must receive all gaming machine system components and 

game play software packages, and verify the contents against the shipping notification.

(2) Access credential control methods.

(i) Controls must be established to restrict access to gaming machine system 

components.

(3) Recordkeeping and audit processes.

(i) The gaming operation must maintain the following records, as applicable, related to 

installed gaming machine system components:

(A) Date placed into service;
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 24 of 64

1/26/2017 Version

(B) Date made available for play;

(C) Supplier;

(D) Software version;

(E) Serial number;

(F) Game title;

(G) Asset and/or location number;

(H) Seal number; and

(I) Initial meter reading.

(ii) Procedures must be implemented for auditing such records in accordance with §13, 

Audit and Accounting.

(4) System software signature verification.

(i) Procedures must be implemented for system software verifications. These 

procedures must include comparing signatures generated by the verification programs 

to the signatures provided in the independent test laboratory letter for that software 

version.

(ii) An agent independent of the gaming machine operation must perform system 

software signature verification(s) to verify that only approved software is installed.

(iii) Procedures must be implemented for investigating and resolving any software 

verification variances.

(iv) Internal audits must be conducted as set forth in §13, Audit and Accounting. Such 

audits must be documented.

(5) Game program or other equivalent game software media control standards. 

(i) At least annually, procedures shall be performed to insure the integrity of a sample of 

gaming machine game program or other equivalent game software media, by personnel 

independent of the gaming machine department or the machines being tested. 

(ii) The TGRA, or the gaming operation subject to the approval of the TGRA, shall 

develop and implement procedures for the following: 

(1) Removal of game program or other equivalent game software media, from 

devices, the verification of the existence of errors as applicable, and the 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 25 of 64

1/26/2017 Version

correction via duplication from the master game program or other equivalent

game software media; 

(2) Copying one gaming device program to another approved program; 

(3) Verification of duplicated game program or other equivalent game software 

media before being offered for play; 

(4) Receipt and destruction of game program or other equivalent game software 

media; and 

(5) Securing game program or other equivalent game software media and 

duplicator from unrestricted access. 

(iii) The master game program number, par percentage, and the pay table shall be 

verified to the par sheet when initially received from the manufacturer. 

(iv) Gaming machines shall have the game software circuit boards locked or physically 

sealed. The lock or seal shall necessitate the presence of a person independent of the 

gaming machine department to access the device game program or other equivalent 

game software media. If a seal is used to secure the board to the frame of the gaming 

device, it shall be pre-numbered. 

(6) Installation testing.

(i) Testing must be completed during the installation process to verify that the gaming 

machine component has been properly installed. This must include testing of the 

following, as applicable:

(A) Communication with the gaming system;

(B) Communication with the accounting system;

(C) Communication with the player tracking system;

(D) Currency and vouchers to bill acceptor;

(E) Voucher printing;

(F) Meter incrimination;

(G) Pay table, for verification;

(H) Gaming machine denomination, for verification;

(I) All buttons, to ensure that all are operational and programmed appropriately;

(J) System components, to ensure that they are safely installed at location; and
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 26 of 64

1/26/2017 Version

(K) Locks, to ensure that they are secure and functioning.

(7) Display of rules and necessary disclaimers. The TGRA or the operation must verify that all 

game rules and disclaimers are displayed at all times or made readily available to the player 

upon request;

(8) TGRA approval of all gaming machines before they are offered for play; and

(9) Dispute resolution.

(f) Operations. 

(1) Malfunctions. Procedures must be implemented to investigate, document and resolve 

malfunctions. Such procedures must address the following:

(i) Determination of the event causing the malfunction;

(ii) Review of relevant records, game recall, reports, logs, surveillance records;

(iii) Repair or replacement of the gaming component;

(iv) Verification of the integrity of the gaming component before restoring it to 

operation; and

(2) Removal, retirement and/or destruction. Procedures must be implemented to retire or 

remove any or all associated components of a gaming system from operation. Procedures must 

include the following:

(i) For gaming machines and components that accept cash or cash equivalents:

(A) Coordinate with the drop team to perform a final drop;

(B) Collect final accounting information such as meter readings, drop and 

payouts;

(C) Remove and/or secure any or all associated equipment such as locks, card 

reader, or ticket printer from the retired or removed component; and

(D) Document removal, retirement, and/or destruction.

(ii) For removal of software components:

(A) Purge and/or return the software to the license holder; and

(B) Document the removal.

(iii) For all components:
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 27 of 64

1/26/2017 Version

(A) Verify that unique identifiers, and descriptions of removed/retired 

components are recorded as part of the retirement documentation; and

(B) Coordinate with the accounting department to properly retire the 

component in the system records.

(v) Where the TGRA authorizes destruction of any gaming system components, 

procedures must be developed to destroy such components. Such procedures must 

include the following:

(A) Methods of destruction;

(B) Witness or surveillance of destruction;

(C) Documentation of all components destroyed; and

(D) Signatures of agent(s) destroying components attesting to destruction.

(f) Vouchers.

(1) Controls must be established and procedures implemented to:

(i) Verify the authenticity of each voucher redeemed.

(ii) If the voucher is valid, verify that the patron is paid the appropriate amount.

(iii) Document the payment of a claim on a voucher that is not physically available or a 

voucher that cannot be validated such as a mutilated, expired, lost, or stolen voucher.

(iv) Retain payment documentation for reconciliation purposes.

(v) For manual payment of a voucher in an amount established by management and 

approved by the TGRA, require a supervisory agent to verify the validity of the voucher 

prior to payment.

(2) Vouchers paid during a period while the voucher system is temporarily out of operation must 

be marked “paid” by the cashier.

(3) Vouchers redeemed while the voucher system was temporarily out of operation must be 

validated as expeditiously as possible upon restored operation of the voucher system.

(4) Paid vouchers must be maintained in the cashier's accountability for reconciliation purposes.

(5) Unredeemed vouchers can only be voided in the voucher system by supervisory agents. The 

accounting department will maintain the voided voucher, if available.

(g) Standards for evaluating theoretical and actual hold percentages.
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 28 of 64

1/26/2017 Version

(1) Accurate and current theoretical hold worksheets shall be maintained for each gaming 

machine.

(2) For multi-game/multi-denominational machines, an employee or department independent 

of the gaming machine department shall:

(i) Weekly, record the total coin-in meter;

(ii) Quarterly, record the coin-in meters for each paytable contained in the machine; and

(iii) On an annual basis, adjust the theoretical hold percentage in the gaming machine 

statistical report to a weighted average based upon the ratio of coin-in for each game 

paytable.

(3) For those gaming operations that are unable to perform the weighted average calculation as 

required by paragraph (g)(2) of this section, the following procedures shall apply:

(i) On at least an annual basis, calculate the actual hold percentage for each gaming 

machine;

(ii) On at least an annual basis, adjust the theoretical hold percentage in the gaming 

machine statistical report for each gaming machine to the previously calculated actual 

hold percentage; and

(iii) The adjusted theoretical hold percentage shall be within the spread between the 

minimum and maximum theoretical payback percentages.

(4) The adjusted theoretical hold percentage for multi-game/multi-denominational machines 

may be combined for machines with exactly the same game mix throughout the year.

(5) The theoretical hold percentages used in the gaming machine analysis reports should be 

within the performance standards set by the manufacturer.

(6) Records shall be maintained for each machine indicating the dates and type of changes made 

and the recalculation of theoretical hold as a result of the changes.

(7) Records shall be maintained for each machine that indicate the date the machine was placed 

into service, the date the machine was removed from operation, the date the machine was 

placed back into operation, and any changes in machine numbers and designations.

(8) All of the gaming machines shall contain functioning meters that shall record coin-in or 

credit-in, or on-line gaming machine monitoring system that captures similar data.

(9) All gaming machines with bill acceptors shall contain functioning billing meters that record 

the dollar amounts or number of bills accepted by denomination.
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 29 of 64

1/26/2017 Version

(10) Gaming machine in-meter readings shall be recorded at least weekly (monthly for Tier A 

and Tier B gaming operations) immediately prior to or subsequent to a gaming machine drop. 

On-line gaming machine monitoring systems can satisfy this requirement. However, the time 

between readings may extend beyond one week in order for a reading to coincide with the end 

of an accounting period only if such extension is for no longer than six (6) days.

(11) The agent who records the in-meter reading shall either be independent of the count team 

or shall be assigned on a rotating basis, unless the in-meter readings are randomly verified 

quarterly for all gaming machines and bill acceptors by an agent other than the regular in-meter 

reader.

(12) Upon receipt of the meter reading summary, the accounting department shall review all 

meter readings for reasonableness using pre-established parameters.

(13) Prior to final preparation of statistical reports, meter readings that do not appear 

reasonable shall be reviewed with gaming machine department agents or other appropriate 

designees, and exceptions documented, so that meters can be repaired or clerical errors in the 

recording of meter readings can be corrected.

(14) A report shall be produced at least monthly showing month-to-date, year-to-date (previous 

twelve (12) months data preferred), and if practicable, life-to-date actual hold percentage 

computations for individual machines and a comparison to each machine's theoretical hold 

percentage previously discussed.

(15) Each change to a gaming machine's theoretical hold percentage, including progressive 

percentage contributions, shall result in that machine being treated as a new machine in the 

statistical reports (i.e., not commingling various hold percentages), except for adjustments made 

in accordance with paragraph (h)(2) of this section.

(16) If promotional payouts or awards are included on the gaming machine statistical reports, it 

shall be in a manner that prevents distorting the actual hold percentages of the affected 

machines.

(17) The statistical reports shall be reviewed by both gaming machine department management 

and management agents independent of the gaming machine department on at least a monthly 

basis.

(18) For those gaming machines that have experienced a level of wagering transactions (as 

established by the gaming operations and approved by the TGRA), large variances between 

theoretical hold and actual hold shall be investigated and resolved by a department 

independent of the gaming machine department. The threshold for the variance as established 

by the gaming operations and approved by the TGRA.
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 30 of 64

1/26/2017 Version

(19) Maintenance of the on-line gaming machine monitoring system data files shall be 

performed by a department independent of the gaming machine department. Alternatively, 

maintenance may be performed by gaming machine supervisory agents if sufficient 

documentation is generated and it is randomly verified on a monthly basis by agents 

independent of the gaming machine department.

(20) Updates to the on-line gaming machine monitoring system to reflect additions, deletions, or 

movements of gaming machines shall be made at least weekly prior to in-meter readings and 

the weigh process.

(h) Gaming machine drop and hopper contents standards. 

(1) When machines are temporarily removed from the floor, gaming machine drop and hopper 

contents shall be protected to preclude the misappropriation of stored funds. 

(2) When machines are permanently removed from the floor, the gaming machine drop and 

hopper contents shall be counted and recorded by at least two employees with appropriate 

documentation being routed to the accounting department for proper recording and accounting 

for initial hopper loads. 

(i) In-house progressive gaming machine standards. 

(1) A meter that shows the amount of the progressive jackpot shall be conspicuously displayed 

at or near the machines to which the jackpot applies. 

(2) At least once each day, each gaming operation shall record the amount shown on each 

progressive jackpot meter at the gaming operation except for those jackpots that can be paid 

directly from the gaming machine; 

(3) Explanations for meter reading decreases shall be maintained with the progressive meter 

reading sheets, and where the payment of a jackpot is the explanation for a decrease, the 

gaming operation shall record the jackpot payout number on the sheet or have the number 

reasonably available; and 

(4) Each gaming operation shall record the base amount of each progressive jackpot the gaming 

operation offers. 

(5) Controls and procedures specific to the transfer of progressive amounts in excess of the base 

amount to other gaming machines must be approved by the TGRA. Such procedures may also 

include other methods of distribution that accrue to the benefit of the gaming public via an 

award or prize. 

(j) Wide area progressive gaming machine standards. 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 31 of 64

1/26/2017 Version

(1) A meter that shows the amount of the progressive jackpot shall be conspicuously displayed 

at or near the machines to which the jackpot applies. 

(2) As applicable to participating gaming operations, the wide area progressive gaming machine 

system shall be adequately restricted to prevent unauthorized access. 

(3) The TGRA shall approve procedures for the wide area progressive system that: 

(i) Reconcile meters and jackpot payouts; 

(ii) Collect/drop gaming machine funds; 

(iii) Verify jackpot, payment, and billing to gaming operations on pro-rata basis; 

(iv) System maintenance; 

(v) System accuracy; and 

(vi) System security. 

(4) Reports, where applicable, adequately documenting the procedures required in paragraph 

(j)(3) of this section shall be generated and retained.

(k) All relevant controls from § 10, Information and Technology will apply.

(l) Revenue Audit. Standards for revenue audit of gaming machines are contained in § 12, Revenue 

Audit. 

(m) Variance. The operation must establish, as approved by the TGRA, the threshold level at which a 

variance must be reviewed to determine the cause. Any such review must be documented.

§5. What are the minimum internal control standards for gaming promotions and player tracking 

systems? 

(a) Supervision. Supervision must be provided as needed for gaming promotions and player tracking by 

an agent(s) with authority equal to or greater than those being supervised. 

(b) Gaming promotions. The rules of the gaming promotion must be displayed or made readily available 

to patron upon request. Gaming promotions rules require TGRA approval and must include the 

following: 

(1) The rules of play; 

(2) The nature and value of the associated prize(s) or cash award(s); 

(3) Any restrictions or limitations on participant eligibility; 

(4) The date(s), time(s), and location(s) for the associated promotional activity or activities; 

(5) Any other restrictions or limitations, including any related to the claim of prizes or cash 

awards; 

(6) The announcement date(s), time(s), and location(s) for the winning entry or entries; and 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 32 of 64

1/26/2017 Version

(7) Rules governing promotions offered across multiple gaming operations, third party 

sponsored promotions, and joint promotions involving third parties. 

(c) Player tracking systems and gaming promotions. 

(1) Changes to the player tracking systems, promotion and external bonusing system 

parameters, which control features such as the awarding of bonuses, the issuance of cashable 

credits, non-cashable credits, coupons and vouchers, must be performed under the authority of 

supervisory agents, independent of the department initiating the change. Alternatively, the 

changes may be performed by supervisory agents of the department initiating the change if 

sufficient documentation is generated and the propriety of the changes are randomly verified by 

supervisory agents independent of the department initiating the change on a monthly basis. 

(2) All other changes to the player tracking system must be appropriately documented. 

(d) Variances. The operation must establish, as approved by the TGRA, the threshold level at which a 

variance must be reviewed to determine the cause. Any such review must be documented.

§6. What are the minimum internal control standards for complimentary services or items? 

(a) Supervision. Supervision must be provided as needed for approval of complimentary services by an 

agent(s) with authority equal to or greater than those being supervised. 

(b) Complimentary services or items. Controls must be established and procedures implemented for 

complimentary services or items that address the following: 

(1) Agents authorized to approve the issuance of complimentary services or items, including 

levels of authorization; 

(2) Limits and conditions on the approval and issuance of complimentary services or items; 

(3) Making and documenting changes to conditions or limits on the approval and issuance of 

complimentary services or items; 

(4) Documenting and recording the authorization, issuance, and redemption of complimentary 

services or items, including cash and non-cash gifts; 

(i) Records must include the following for all complimentary items and services equal to 

or exceeding an amount established by the gaming operation and approved by the 

TGRA: 

(A) Name of patron who received the complimentary service or item; 

(B) Name(s) of issuer(s) of the complimentary service or item; 

(C) The actual cash value of the complimentary service or item; 

(D) The type of complimentary service or item (i.e., food, beverage); and 

(E) Date the complimentary service or item was issued. 

(c) Complimentary services and items records must be summarized and reviewed for proper 

authorization and compliance with established authorization thresholds. 

(1) A detailed reporting of complimentary services or items transactions that meet an 

established threshold approved by the TGRA must be prepared at least monthly. 

(2) The detailed report must be forwarded to management for review. 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 33 of 64

1/26/2017 Version

(d) Variances. The operation must establish, as approved by the TGRA, the threshold level at which a 

variance must be reviewed to determine the cause. Any such review must be documented.

§7. What are the minimum internal control standards for patron deposit accounts and cashless 

systems? 

(a) Supervision. Supervision must be provided as needed for patron deposit accounts and cashless 

systems by an agent(s) with authority equal to or greater than those being supervised. 

(b) Patron deposit accounts and cashless systems. 

(1) Smart cards cannot maintain the only source of account data. 

(2) Establishment of patron deposit accounts. The following standards apply when a patron 

establishes an account:

(i) The patron must appear at the gaming operation in person, at a designated area of 

accountability, and present valid government issued picture identification; and 

(ii) An agent must examine the patron's identification and record the following 

information: 

(A) Type, number, and expiration date of the identification; 

(B) Patron's name; 

(C) A unique account identifier; 

(D) Date the account was opened; and 

(E) The agent's name. 

(3) The patron must sign the account documentation before the agent may activate the account. 

(4) The agent or cashless system must provide the patron deposit account holder with a secure 

method of access. 

(c) Patron deposits, withdrawals and adjustments. 

(1) Prior to the patron making a deposit or withdrawal from a patron deposit account, the agent 

or cashless system must verify the patron deposit account, the patron identity, and availability 

of funds. A personal identification number (PIN) is an acceptable form of verifying identification. 

(2) Adjustments made to the patron deposit accounts must be performed by an agent. 

(3) When a deposit, withdrawal, or adjustment is processed by an agent, a transaction record 

must be created containing the following information: 

(i) Same document number on all copies; 

(ii) Type of transaction, (deposit, withdrawal, or adjustment); 

(iii) Name or other identifier of the patron; 

(iv) The unique account identifier; 

(v) Patron signature for withdrawals, unless a secured method of access is utilized; 

(vi) For adjustments to the account, the reason for the adjustment; 

(vii) Date and time of transaction; 

(viii) Amount of transaction; 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 34 of 64

1/26/2017 Version

(ix) Nature of deposit, withdrawal, or adjustment (cash, check, chips); and 

(x) Signature of the agent processing the transaction. 

(4) When a patron deposits or withdraws funds from a patron deposit account electronically, 

the following must be recorded: 

(i) Date and time of transaction; 

(ii) Location (gaming machine, kiosk); 

(iii) Type of transaction (deposit, withdrawal); 

(iv) Amount of transaction; and 

(v) The unique account identifier. 

(5) Patron deposit account transaction records must be available to the patron upon reasonable 

request. 

(6) If electronic funds transfers are made to or from a gaming operation bank account for patron 

deposit account funds, the bank account must be dedicated and may not be used for any other 

types of transactions. 

(d) Variances. The operation must establish, as approved by the TGRA, the threshold level at which a 

variance must be reviewed to determine the cause. Any such review must be documented.

§8. What are the minimum internal control standards for lines of credit? 

(a) Supervision. Supervision must be provided as needed for lines of credit by an agent(s) with authority 

equal to or greater than those being supervised. 

(b) Establishment of lines of credit policy. 

(1) If a gaming operation extends lines of credit, controls must be established and procedures 

implemented to safeguard the assets of the gaming operation. Such controls must include a 

lines of credit policy including the following: 

(i) A process for the patron to apply for, modify, and/or re-establish lines of credit, to 

include required documentation and credit line limit; 

(ii) Authorization levels of credit issuer(s); 

(iii) Identification of agents authorized to issue lines of credit; 

(iv) A process for verifying an applicant's credit worthiness; 

(v) A system for recording patron information, to include: 

(A) Name, current address, and signature; 

(B) Identification credential; 

(C) Authorized credit line limit; 

(D) Documented approval by an agent authorized to approve credit line limits; 

(E) Date, time and amount of credit issuances and payments; and 

(F) Amount of available credit. 

(vi) A process for issuing lines of credit to: 

(A) Verify the patron's identity; 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 35 of 64

1/26/2017 Version

(B) Notify the patron of the lines of credit terms, including obtaining patron's written 

acknowledgment of the terms by signature; 

(C) Complete a uniquely identified, multi-part, lines of credit issuance form, such as a 

marker or counter check, which includes the terms of the lines of credit transaction; 

(D) Obtain required signatures; 

(E) Determine the amount of the patron's available lines of credit; 

(F) Update the credit balance record at the time of each transaction to ensure that lines 

of credit issued are within the established limit and balance for that patron; and 

(G) Require the agent issuing the lines of credit to be independent of the agent who 

authorized the lines of credit. 

(vii) A policy establishing credit line limit exceptions to include the following: 

(A) Identification of the agent(s) authorized to permit a credit line limit to be exceeded; 

(B) Authorization thresholds; and 

(C) Required documentation. 

(viii) A policy governing increases and decreases to a patron's lines of credit account balances to 

include the following: 

(A) Documentation and record keeping requirements; 

(B) Independence between the department that receives the payment and the 

department that maintains custody of the credit balance for payments made by mail; 

(C) Collections; 

(D) Periodic audits and confirmation of balances; and 

(E) If a collection agency is used, a process to ensure documentation of increases and 

decreases to the lines of credit account balances. 

(ix) A policy governing write-offs and settlements to include: 

(A) Identification of agent(s) authorized to approve write-offs and settlements; 

(B) Authorization levels for write-offs and settlements of lines of credit instruments; 

(C) Required documentation for write-offs and settlements; 

(D) Independence between the agent who established the lines of credit and the agent 

writing off or settling the lines of credit instrument; and 

(E) Necessary documentation for the approval of write-offs and settlements and 

transmittal to the appropriate department for recording and deductibility. 

(c) Variances. The operation must establish, as approved by the TGRA, the threshold level at which a 

variance must be reviewed to determine the cause. Any such review must be documented.

§9. What are the minimum internal control standards for the cage, vault, kiosk, cash and cash 

equivalents? 

(a) Supervision. Supervision must be provided as needed for cage, vault, kiosk, and other operations 

using cash or cash equivalents by an agent(s) with authority equal to or greater than those being 

supervised. 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 36 of 64

1/26/2017 Version

(b) Check cashing. 

(1) If checks are cashed at the cage, the controls must provide for security and integrity. For 

each check cashing transaction, the agent(s) conducting the transaction must: 

(i) Verify the patron's identity; 

(ii) Examine the check to ensure it includes the patron's name, current address, and 

signature; 

(iii) For personal checks, verify the patron's check cashing authority and record the 

source and results in accordance with management policy; however 

(iv) If a check guarantee service is used to guarantee the transaction and the procedures 

required by the check guarantee service are followed, then the above requirements do 

not apply. 

(2) When counter checks are issued, the following must be included on the check: 

(i) The patron's name and signature; 

(ii) The dollar amount of the counter check; 

(iii) Patron's bank name, bank routing, and account numbers; 

(iv) Date of issuance; and 

(v) Signature of the agent approving the counter check transaction. 

(3) Checks that are not deposited in the normal course of business, as established by 

management, (held checks) are subject to §8 lines of credit standards. 

(4) When traveler's checks or other guaranteed drafts, such as cashier's checks, are presented, 

the cashier must comply with the examination and documentation procedures as required by 

the issuer. 

(5) If a third party check cashing or guarantee service is used, the examination and 

documentation procedures required by the service provider apply, unless otherwise provided by 

tribal law or regulation. 

(c) Cage and vault accountability. 

(1) All transactions that flow through the cage must be summarized for each work shift of the 

cage and must be supported by documentation. 

(2) Increases and decreases to the total cage inventory must be verified, supported by 

documentation, and recorded. Documentation must include the date and shift, the purpose of 

the increase/decrease, the agent(s) completing the transaction, and the person or department 

receiving the cage funds (for decreases only). 

(3) The cage and vault inventories (including coin rooms) must be counted independently by at 

least two agents, attested to by signature, and recorded in ink or other permanent form at the 

end of each shift during which the activity took place. These agents must make individual counts 

to compare for accuracy and maintain individual accountability. All variances must be 

documented and investigated. 

(4) The gaming operation must establish and comply with a minimum bankroll formula to ensure 

the gaming operation maintains cash or cash equivalents (on hand and in the bank, if readily 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 37 of 64

1/26/2017 Version

accessible) in an amount sufficient to satisfy obligations to the gaming operation's patrons as 

they are incurred. 

(d) Kiosks. 

(1) Kiosks must be maintained on the cage accountability and must be counted independently 

by at least two agents, documented, and reconciled for each increase or decrease to the kiosk 

inventory. 

(2) Currency cassettes must be counted and filled by an agent and verified independently by at 

least one agent, all of whom must sign each cassette. 

(3) Currency cassettes must be secured with a lock or tamper resistant seal and, if not placed 

inside a kiosk, must be stored in a secured area of the cage/vault. 

(4) The TGRA or the gaming operation, subject to the approval of the TGRA, must develop and 

implement physical security controls over the kiosks. Controls should address the following: 

forced entry, evidence of any entry, and protection of circuit boards containing programs. 

(5) With regard to cashless systems, the TGRA or the gaming operation, subject to the approval 

of the TGRA, must develop and implement procedures to ensure that communications between 

the kiosk and system are secure and functioning. 

(6) The following reconciliation reports must be available upon demand for each day, shift, and 

drop cycle (this is not required if the system does not track the information, but system 

limitation(s) must be noted): 

(i) Starting balance dollar amount per financial instrument; 

(ii) Starting balance number of items per financial instrument; 

(iii) Dollar amount per financial instrument issued; 

(iv) Number of items per financial instrument issued; 

(v) Dollar amount per financial instrument issued; 

(vi) Number of items per financial instrument redeemed; 

(vii) Dollar amount per financial instrument increases; 

(viii) Number of items per financial instrument increases; 

(ix) Dollar amount per financial instrument decreases; 

(x) Number of items per financial instrument decreases; 

(xi) Ending balance dollar amount per financial instrument; and 

(xii) Ending balance number of items per financial instrument. 

(e) Patron deposited funds. If a gaming operation permits a patron to deposit funds with the gaming 

operation at the cage, and when transfers of patron deposited funds are transferred to a gaming area 

for wagering purposes, the following standards apply: 

(1) The receipt or withdrawal of a patron deposit must be documented, with a copy given to the

patron and a copy remaining in the cage. 

(2) Both copies of the document of receipt or withdrawal must contain the following 

information: 

(i) Same receipt number on each copy; 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 38 of 64

1/26/2017 Version

(ii) Patron's name and signature; 

(iii) Date of receipt and withdrawal; 

(iv) Dollar amount of deposit/withdrawal (for foreign currency transactions include the 

US dollar equivalent, the name of the foreign country, and the amount of the foreign 

currency by denomination); 

(v) Nature of deposit/withdrawal; and 

(vi) Name and signature of the agent who conducted the transaction. 

(3) Procedures must be established and complied with for front money deposits to: 

(i) Maintain a detailed record by patron name and date of all funds on deposit; 

(ii) Maintain a current balance of all patron deposits that are in the cage/vault inventory 

or accountability; and 

(iii) Reconcile the current balance with the deposits and withdrawals at least daily. 

(f) Promotional payments, drawings, and giveaway programs. The following procedures must apply to 

any payment resulting from a promotional payment, drawing, or giveaway program disbursed by the 

cage department or any other department. This section does not apply to payouts for table game 

promotional pots and/or pools.

(1) All payments must be documented to support the cage accountability. 

(2) Payments above $600 (or lesser amount as approved by TGRA) must be documented at the 

time of the payment, and documentation must include the following: 

(i) Date and time; 

(ii) Dollar amount of payment or description of personal property; 

(iii) Reason for payment; and 

(iv) Patron's name and confirmation that identity was verified (drawings only). 

(v) Signature(s) of at least two agents verifying, authorizing, and completing the 

promotional payment with the patron. For computerized systems that validate and print 

the dollar amount of the payment on a computer generated form, only one signature is 

required. 

(g) Chip(s) and token(s). Controls must be established and procedures implemented to ensure 

accountability of chip and token inventory. Such controls must include, but are not limited to, the 

following: 

(1) Purchase; 

(2) Receipt; 

(3) Inventory; 

(4) Storage; and 

(5) Destruction. 

(h) Vouchers. 

(1) Controls must be established and procedures implemented to: 

(i) Verify the authenticity of each voucher redeemed. 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 39 of 64

1/26/2017 Version

(ii) If the voucher is valid, verify that the patron is paid the appropriate amount. 

(iii) Document the payment of a claim on a voucher that is not physically available or a 

voucher that cannot be validated such as a mutilated, expired, lost, or stolen voucher. 

(iv) Retain payment documentation for reconciliation purposes. 

(v) For manual payment of a voucher in an amount established by management and 

approved by the TGRA, require a supervisory employee to verify the validity of the 

voucher prior to payment. 

(2) Vouchers paid during a period while the voucher system is temporarily out of operation must 

be marked “paid” by the cashier. 

(3) Vouchers redeemed while the voucher system was temporarily out of operation must be 

validated as expeditiously as possible upon restored operation of the voucher system. 

(4) Paid vouchers must be maintained in the cashier's accountability for reconciliation purposes. 

(5) Unredeemed vouchers can only be voided in the voucher system by supervisory employees. 

The accounting department will maintain the voided voucher, if available. 

(i) Cage and vault access. Controls must be established and procedures implemented to: 

(1) Restrict physical access to the cage to cage agents, designated staff, and other authorized 

persons; and 

(2) Limit transportation of extraneous items such as personal belongings, tool boxes, beverage 

containers, etc., into and out of the cage. 

(j) Variances. The operation must establish, as approved by the TGRA, the threshold level at which a 

variance must be reviewed to determine the cause. Any such review must be documented.

§10. What are the minimum internal control standards for information technology and information 

technology data? 

(a) Supervision. 

(1) Controls must identify the supervisory agent in the department or area responsible for 

ensuring that the department or area is operating in accordance with established policies and 

procedures. 

(2) The supervisory agent must be independent of the operation of the gaming activity. 

(3) Controls must ensure that duties are adequately segregated and monitored to detect 

procedural errors and to prevent the concealment of fraud. 

(4) Information technology agents having access to gaming systems may not have signatory 

authority over financial instruments and payout forms and must be independent of and 

restricted from access to: 

(i) Financial instruments; 

(ii) Accounting, audit, and ledger entries; and 

(iii) Payout forms. 

(b) As used in this section only, a system is any computerized system that is integral to the gaming 

environment. This includes, but is not limited to, the server and peripherals for gaming system, 

accounting, surveillance, essential phone system, and door access and warning systems. 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 40 of 64

1/26/2017 Version

(c) Gaming systems' logical and physical controls. Controls must be established and procedures 

implemented to ensure adequate: 

(1) Control of physical and logical access to the information technology environment, including 

accounting, voucher, cashless and player tracking systems, among others used in conjunction 

with gaming; 

(2) Physical and logical protection of storage media and its contents, including recovery 

procedures; 

(3) Access credential control methods; 

(4) Record keeping and audit processes; and 

(5) Departmental independence, including, but not limited to, means to restrict agents that have 

access to information technology from having access to financial instruments. 

(d) Physical security. 

(1) The information technology environment and infrastructure must be maintained in a secured 

physical location such that access is restricted to authorized agents only. 

(2) Access devices to the systems' secured physical location, such as keys, cards, or fobs, must 

be controlled by an independent agent. 

(3) Access to the systems' secured physical location must be restricted to agents in accordance 

with established policies and procedures, which must include maintaining and updating a record 

of agents granted access privileges. 

(4) Network Communication Equipment must be physically secured from unauthorized access. 

(e) Logical security. 

(1) Controls must be established and procedures implemented to protect all systems and to 

ensure that access to the following is restricted and secured: 

(i) Systems' software and application programs; 

(ii) Data associated with gaming; and 

(iii) Communications facilities, systems, and information transmissions associated with 

gaming systems. 

(2) Unused services and non-essential ports must be disabled whenever possible. 

(3) Procedures must be implemented to ensure that all activity performed on systems is 

restricted and secured from unauthorized access, and logged. 

(4) Communications to and from systems via Network Communication Equipment must be 

logically secured from unauthorized access. 

(f) User controls. 

(1) Systems, including application software, must be secured with passwords or other means for 

authorizing access. 

(2) Management personnel or agents independent of the department being controlled must 

assign and control access to system functions. 

(3) Access credentials such as passwords, PINs, or cards must be controlled as follows: 

(i) Each user must have his or her own individual access credential; 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 41 of 64

1/26/2017 Version

(ii) Access credentials must be changed at an established interval approved by the TGRA; 

and 

(iii) Access credential records must be maintained either manually or by systems that 

automatically record access changes and force access credential changes, including the 

following information for each user: 

(A) User's name; 

(B) Date the user was given access and/or password change; and 

(C) Description of the access rights assigned to user. 

(4) Lost or compromised access credentials must be deactivated, secured or destroyed within an 

established time period approved by the TGRA. 

(5) Access credentials of terminated users must be deactivated within an established time 

period approved by the TGRA. 

(6) Only authorized agents may have access to inactive or closed accounts of other users, such 

as player tracking accounts and terminated user accounts. 

(g) Installations and/or modifications. 

(1) Only TGRA authorized or approved systems and modifications may be installed. 

(2) Records must be kept of all new installations and/or modifications to gaming systems. These 

records must include, at a minimum: 

(i) The date of the installation or modification; 

(ii) The nature of the installation or change such as new software, server repair, 

significant configuration modifications; 

(iii) Evidence of verification that the installation or the modifications are approved; and 

(iv) The identity of the agent(s) performing the installation/modification. 

(3) Documentation must be maintained, such as manuals and user guides, describing the 

systems in use and the operation, including hardware. 

(h) Remote access. 

(1) Agents may be granted remote access for system support, provided that each access session 

is documented and maintained at the place of authorization. The documentation must include: 

(i) Name of agent authorizing the access; 

(ii) Name of agent accessing the system; 

(iii) Verification of the agent's authorization; 

(iv) Reason for remote access; 

(v) Description of work to be performed; 

(vi) Date and time of start of end-user remote access session; and 

(vii) Date and time of conclusion of end-user remote access session. 

(2) All remote access must be performed via a secured method. 

(i) Incident monitoring and reporting. 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 42 of 64

1/26/2017 Version

(1) Procedures must be implemented for responding to, monitoring, investigating, resolving, 

documenting, and reporting security incidents associated with information technology systems. 

(2) All security incidents must be responded to within an established time period approved by 

the TGRA and formally documented. 

(j) Data backups. 

(1) Controls must include adequate backup, including, but not limited to, the following: 

(i) Daily data backup of critical information technology systems; 

(ii) Data backup of critical programs or the ability to reinstall the exact programs as 

needed; 

(iii) Secured storage of all backup data files and programs, or other adequate protection; 

(iv) Mirrored or redundant data source; and 

(v) Redundant and/or backup hardware. 

(2) Controls must include recovery procedures, including, but not limited to, the following: 

(i) Data backup restoration; 

(ii) Program restoration; and 

(iii) Redundant or backup hardware restoration. 

(3) Recovery procedures must be tested on a sample basis at specified intervals at least 

annually. Results must be documented. 

(4) Backup data files and recovery components must be managed with at least the same level of 

security and access controls as the system for which they are designed to support. 

(k) Software downloads. Downloads, either automatic or manual, must be performed in accordance with 

approved TGRA procedures. 

(l) Verifying downloads. Following download of any gaming system software, the gaming operation must 

verify the downloaded software using a software signature verification method. Using any method it 

deems appropriate, the TGRA must confirm the verification.

§11. What are the minimum internal control standards for drop and count?

(a) Supervision. Supervision must be provided for drop and count as needed by an agent(s) with 

authority equal to or greater than those being supervised.

(b) Count room access. Controls must be established and procedures implemented to limit physical 

access to the count room to count team agents, designated staff, and other authorized persons. Such 

controls must include the following:

(1) Count team agents may not exit or enter the count room during the count except for 

emergencies or scheduled breaks.

(2) Surveillance must be notified whenever count room agents exit or enter the count room 

during the count.
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 43 of 64

1/26/2017 Version

(3) The count team policy, at a minimum, must address the transportation of extraneous items 

such as personal belongings, tool boxes, beverage containers, etc., into or out of the count 

room.

(c) Count team. Controls must be established and procedures implemented to ensure security of the 

count and the count room to prevent unauthorized access, misappropriation of funds, forgery, theft, or 

fraud. Such controls must include the following:

(1) For Tier A and B operations, all counts must be performed by at least two agents. For Tier C 

operations, all counts must be performed by at least three agents.

(2) For Tier A and B operations, at no time during the count can there be fewer than two count 

team agents in the count room until the drop proceeds have been accepted into cage/vault 

accountability. For Tier C operations, at no time during the count can there be fewer than three 

count team agents in the count room until the drop proceeds have been accepted into 

cage/vault accountability.

(3) For Tier A and B operations, count team agents must be rotated on a routine basis such that 

the count team is not consistently the same two agents more than four days per week. This 

standard does not apply to gaming operations that utilize a count team of more than two 

agents. For Tier C operations, count team agents must be rotated on a routine basis such that 

the count team is not consistently the same three agents more than four days per week. This 

standard does not apply to gaming operations that utilize a count team of more than three 

agents.

(4) Functions performed by count team agents must be rotated on a routine basis.

(5) Count team agents must be independent of the department being counted. A cage/vault 

agent may be used if they are not the sole recorder of the count and do not participate in the 

transfer of drop proceeds to the cage/vault. An accounting agent may be used if there is an 

independent audit of all count documentation.

(d) Table game drop standards. Controls must be established and procedures implemented to ensure 

security of the drop process. Such controls must include the following:

(1) Surveillance must be notified when the drop is to begin so that surveillance may monitor the 

activities.

(2) At least two agents must be involved in the removal of the drop box, at least one of whom is 

independent of the table games department.

(3) Once the drop is started, it must continue until finished.

(4) All drop boxes may be removed only at the time previously designated by the gaming 

operation and reported to the TGRA. If an emergency drop is required, surveillance must be 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 44 of 64

1/26/2017 Version

notified before the drop is conducted and the TGRA must be informed within a timeframe 

approved by the TGRA.

(5) All locked table game drop boxes must be removed from the tables by an agent independent 

of the table game shift being dropped;

(6) For any tables opened during the shift, a separate drop box must be placed on each table, or 

a gaming operation may utilize a single drop box with separate openings and compartments for 

each shift; and

(7) Table game drop boxes must be transported directly to the count room or other equivalently 

secure area by a minimum of two agents, at least one of whom is independent of the table 

game department, until the count takes place.

(8) All tables that were not open during a shift and therefore not part of the drop must be 

documented.

(9) All table game drop boxes must be posted with a number corresponding to a permanent 

number on the gaming table and marked to indicate game, table number, and shift, if 

applicable.

(e) Gaming machine and financial instrument storage component drop standards. 

(1) Surveillance must be notified when the drop is to begin so that surveillance may monitor the 

activities.

(2) At least two agents must be involved in the removal of the gaming machine and financial 

instrument storage component drop, at least one of whom is independent of the gaming 

machine department.

(3) All financial instrument storage components may be removed only at the time previously 

designated by the gaming operation and reported to the TGRA. If an emergency drop is 

required, surveillance must be notified before the drop is conducted and the TGRA must be 

informed within a timeframe approved by the TGRA.

(4) The financial instrument storage components must be removed by an agent independent of 

the gaming machine department, then transported directly to the count room or other 

equivalently secure area with comparable controls and locked in a secure manner until the 

count takes place.

(i) Security must be provided for the financial instrument storage components removed 

from gaming machines and awaiting transport to the count room.
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 45 of 64

1/26/2017 Version

(ii) Transportation of financial instrument storage components must be performed by a 

minimum of two agents, at least one of whom is independent of the gaming machine 

department.

(5) All financial instrument storage components must be posted with a number corresponding to 

a permanent number on the gaming machine.

(f) Table game count standards. 

(1) Access to stored, full table game drop boxes must be restricted to:

(i) Authorized members of the drop and count teams; and

(ii) In an emergency, authorized persons for the resolution of a problem.

(2) The table game count must be performed in a count room or other equivalently secure area 

with comparable controls.

(3) Access to the count room during the count must be restricted to members of the drop and 

count teams, with the exception of authorized observers, supervisors for resolution of 

problems, and authorized maintenance personnel.

(4) If counts from various revenue centers occur simultaneously in the count room, procedures 

must be in effect to prevent the commingling of funds from different revenue centers.

(5) Count equipment and systems must be tested, with the results documented, before the first 

count begins, to ensure the accuracy of the equipment.

(6) The table game drop boxes must be individually emptied and counted so as to prevent the 

commingling of funds between boxes until the count of the box has been recorded.

(i) The count of each box must be recorded in ink or other permanent form of 

recordation.

(ii) For counts that do not utilize a currency counter, a second count must be performed 

by a member of the count team who did not perform the initial count. Separate counts 

of chips and tokens must always be performed by members of the count team.

(iii) Coupons or other promotional items not included in gross revenue must be 

recorded on a supplemental document by either the count team members or 

accounting personnel. All single-use coupons must be cancelled daily by an authorized 

agent to prevent improper recirculation.

(iv) If a currency counter interface is used:

(A) It must be adequately restricted to prevent unauthorized access; and
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 46 of 64

1/26/2017 Version

(B) The currency drop figures must be transferred via direct communications 

line or computer storage media to the accounting department.

(7) If currency counters are utilized, a count team member must observe the loading and 

unloading of all currency at the currency counter, including rejected currency.

(8) Two counts of the currency rejected by the currency counter must be recorded per table, as 

well as in total. Posting rejected currency to a nonexistent table is prohibited.

(9) Table game drop boxes, when empty, must be shown to another member of the count team, 

to another agent observing the count, or to surveillance, provided that the count is monitored in 

its entirety by an agent independent of the count.

(10) Procedures must be implemented to ensure that any corrections to the count 

documentation are permanent and identifiable, and that the original, corrected information 

remains legible. Corrections must be verified by two count team agents.

(11) The count sheet must be reconciled to the total drop by a count team member who may 

not function as the sole recorder, and variances must be reconciled and documented.

(12) All count team agents must sign the count sheet attesting to their participation in the 

count.

(13) A final verification of the total drop proceeds, before transfer to cage/vault, must be 

performed by at least two agents, one of whom is a supervisory count team member, and the 

other a count team agent.

(i) Final verification must include a comparison of currency counted totals against the 

currency counter/system report, if any counter/system is used.

(ii) Any unresolved variances must be documented, and the documentation must 

remain part of the final count record forwarded to accounting.

(iii) This verification does not require a complete recount of the drop proceeds, but does 

require a review sufficient to verify the total drop proceeds being transferred.

(iv) The two agents must sign the report attesting to the accuracy of the total drop 

proceeds verified.

(v) All drop proceeds and cash equivalents that were counted must be submitted to the 

cage or vault agent (who must be independent of the count team), or to an agent 

independent of the revenue generation source and the count process, for verification. 

The agent must certify, by signature, the amount of the drop proceeds delivered and 

received. Any unresolved variances must be reconciled, documented, and/or 

investigated by accounting/revenue audit.
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 47 of 64

1/26/2017 Version

(14) After verification by the agent receiving the funds, the drop proceeds must be transferred 

to the cage/vault.

(i) The count documentation and records must not be transferred to the cage/vault with 

the drop proceeds.

(ii) The cage/vault agent must not have knowledge or record of the drop proceeds total 

before it is verified.

(iii) All count records must be forwarded to accounting or secured and accessible only by 

accounting agents.

(iv) The cage/vault agent receiving the transferred drop proceeds must sign the count 

sheet attesting to the verification of the total received, and thereby assume 

accountability of the drop proceeds, ending the count.

(v) Any unresolved variances between total drop proceeds recorded on the count sheet

and the cage/vault final verification during transfer must be documented and 

investigated.

(15) The count sheet, with all supporting documents, must be delivered to the accounting 

department by a count team member or an agent independent of the cage/vault. Alternatively, 

it may be secured so that it is only accessible only by the accounting department.

(g) Gaming machine financial instrument count standards. 

(1) Access to stored full financial instrument storage components must be restricted to:

(i) Authorized members of the drop and count teams; and

(ii) In an emergency, authorized persons for the resolution of a problem.

(2) The gaming machine financial instrument count must be performed in a count room or other 

equivalently secure area with comparable controls.

(3) Access to the count room during the count must be restricted to members of the drop and 

count teams, with the exception of authorized observers, supervisors for resolution of 

problems, and authorized maintenance personnel.

(4) If counts from various revenue centers occur simultaneously in the count room, procedures 

must be in effect that prevent the commingling of funds from different revenue centers.

(5) The count team must not have access to amount-in or bill-in meter amounts until after the 

count is completed and the drop proceeds are accepted into the cage/vault accountability.

(6) Count equipment and systems must be tested, and the results documented, before the first 

count begins, to ensure the accuracy of the equipment.
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 48 of 64

1/26/2017 Version

(7) If a currency counter interface is used:

(i) It must be adequately restricted to prevent unauthorized access; and

(ii) The currency drop figures must be transferred via direct communications line or 

computer storage media to the accounting department.

(8) The financial instrument storage components must be individually emptied and counted so 

as to prevent the commingling of funds between storage components until the count of the 

storage component has been recorded.

(i) The count of each storage component must be recorded in ink or other permanent 

form of recordation.

(ii) Coupons or other promotional items not included in gross revenue may be recorded 

on a supplemental document by the count team members or accounting personnel. All 

single-use coupons must be cancelled daily by an authorized agent to prevent improper 

recirculation.

(9) If currency counters are utilized, a count team member must observe the loading and 

unloading of all currency at the currency counter, including rejected currency.

(10) Two counts of the currency rejected by the currency counter must be recorded per 

interface terminal as well as in total. Rejected currency must be posted to the gaming machine 

from which it was collected.

(11) Storage components, when empty, must be shown to another member of the count team, 

to another agent observing the count, or to surveillance, provided that the count is monitored in 

its entirety by an agent independent of the count.

(12) Procedures must be implemented to ensure that any corrections to the count 

documentation are permanent, identifiable and the original, corrected information remains 

legible. Corrections must be verified by two count team agents.

(13) The count sheet must be reconciled to the total drop by a count team member who may 

not function as the sole recorder, and variances must be reconciled and documented. This 

standard does not apply to vouchers removed from the financial instrument storage 

components.

(14) All count team agents must sign the report attesting to their participation in the count.

(15) A final verification of the total drop proceeds, before transfer to cage/vault, must be 

performed by the at least two agents, one of whom is a supervisory count team member and 

the other a count team agent.
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 49 of 64

1/26/2017 Version

(i) Final verification must include a comparison of currency counted totals against the 

currency counter/system report, if a counter/system is used.

(ii) Any unresolved variances must be documented and the documentation must remain 

a part of the final count record forwarded to accounting.

(iii) This verification does not require a complete recount of the drop proceeds but does 

require a review sufficient to verify the total drop proceeds being transferred.

(iv) The two agents must sign the report attesting to the accuracy of the total drop 

proceeds verified.

(v) All drop proceeds and cash equivalents that were counted must be turned over to 

the cage or vault cashier (who must be independent of the count team) or to an agent 

independent of the revenue generation and the count process for verification. Such 

cashier or agent must certify, by signature, the amount of the drop proceeds delivered 

and received. Any unresolved variances must be reconciled, documented, and/or 

investigated by accounting/revenue audit.

(16) After certification by the agent receiving the funds, the drop proceeds must be transferred 

to the cage/vault.

(i) The count documentation and records must not be transferred to the cage/vault with 

the drop proceeds.

(ii) The cage/vault agent must not have knowledge or record of the drop proceeds total 

before it is verified.

(iii) All count records must be forwarded to accounting secured and accessible only by 

accounting agents.

(iv) The cage/vault agent receiving the transferred drop proceeds must sign the count 

sheet attesting to the verification of the total received, and thereby assuming 

accountability of the drop proceeds, and ending the count.

(v) Any unresolved variances between total drop proceeds recorded on the count room 

report and the cage/vault final verification during transfer must be documented and 

investigated.

(17) The count sheet, with all supporting documents, must be delivered to the accounting 

department by a count team member or agent independent of the cage/vault. Alternatively, it 

may be adequately secured and accessible only by the accounting department.

(h) Collecting currency cassettes and financial instrument storage components from kiosks. Controls 

must be established and procedures implemented to ensure that currency cassettes and financial 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 50 of 64

1/26/2017 Version

instrument storage components are securely removed from kiosks. Such controls must include the 

following:

(1) Surveillance must be notified prior to the financial instrument storage components or 

currency cassettes being accessed in a kiosk.

(2) At least two agents must be involved in the collection of currency cassettes and/or financial 

instrument storage components from kiosks and at least one agent should be independent of 

kiosk accountability.

(3) Currency cassettes and financial instrument storage components must be secured in a 

manner that restricts access to only authorized agents.

(4) Redeemed vouchers collected from the kiosk must be secured and delivered to the 

appropriate department (cage or accounting) for reconciliation.

(5) Controls must be established and procedures implemented to ensure that currency cassettes 

contain the correct denominations and have been properly installed.

(i) Kiosk count standards. 

(1) Access to stored full kiosk financial instrument storage components and currency cassettes 

must be restricted to:

(i) Authorized agents; and

(ii) In an emergency, authorized persons for the resolution of a problem.

(2) The kiosk count must be performed in a secure area, such as the cage or count room.

(3) If counts from various revenue centers and kiosks occur simultaneously in the count room, 

procedures must be in effect that prevent the commingling of funds from the kiosks with any 

revenue centers.

(4) The kiosk financial instrument storage components and currency cassettes must be 

individually emptied and counted so as to prevent the commingling of funds between kiosks 

until the count of the kiosk contents has been recorded.

(i) The count of kiosk financial instrument storage components and currency cassettes 

must be recorded in ink or other permanent form of recordation.

(ii) Coupons or other promotional items not included in gross revenue (if any) may be 

recorded on a supplemental document. All single-use coupons must be cancelled daily 

by an authorized agent to prevent improper recirculation.
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 51 of 64

1/26/2017 Version

(5) Procedures must be implemented to ensure that any corrections to the count 

documentation are permanent, identifiable, and the original, corrected information remains 

legible. Corrections must be verified by two agents.

(j) Variances. The operation must establish, as approved by the TGRA, the threshold level at which a 

variance must be reviewed to determine the cause. Any such review must be documented.

§12. What are the minimum internal control standards for auditing revenue?

(a) Supervision. Supervision must be provided as needed for bingo operations by an agent(s) with 

authority equal to or greater than those being supervised.

(b) Independence. Audits must be performed by agent(s) independent of the transactions being audited.

(c) Documentation. The performance of revenue audit procedures, the exceptions noted, and the 

follow-up of all revenue audit exceptions must be documented and maintained.

(d) Controls must be established and procedures implemented to audit of each of the following 

operational areas:

(1) Keno.

(i) At least annually, foot the write on the restricted copy of the keno transaction report 

for a minimum of one shift and compare the total to the total as documented by the 

computer. 

(ii) For at least one shift every other month, perform the following: 

(A) Foot the customer copy of the payouts and trace the total to the payout 

report; and 

(B) Regrade at least 1% of the winning tickets using the payout schedule and 

draw ticket. 

(iii) For a minimum of five games per week, compare the video recording and/or digital 

record of the rabbit ears or wheel to the computer transaction summary; 

(iv) Daily, compare net cash proceeds to the audited win/loss by shift and investigate 

any large cash overages or shortages (i.e., in excess of $25.00); 

(v) Daily, review and regrade all winning tickets greater than or equal to $1,500, 

including all forms that document that proper authorizations and verifications were 

obtained and performed; 

(vi) Daily, review the documentation for payout adjustments made outside the 

computer and investigate large and frequent payments; 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 52 of 64

1/26/2017 Version

(vii) Weekly, review personnel access listing for inappropriate functions an agent can 

perform; 

(viii) Review system exception information on a daily basis for propriety of transactions 

and unusual occurrences including changes to the personnel access listing; 

(ix) If a random number generator is used, then at least weekly review the numerical 

frequency distribution for potential patterns; and 

(x) Investigate and document results of all noted improper transactions or unusual 

occurrences. 

(xi) When the keno game is operated by one person: 

(A) The customer copies of all winning tickets in excess of $100 and at least 5% 

of all other winning tickets shall be regraded and traced to the computer payout 

report; 

(B) The video recording and/or digital record of rabbit ears or wheel shall be 

randomly compared to the computer game information report for at least 10% 

of the games during the shift; and 

(C) Review winning tickets for proper authorization. 

(xii) In the event any person performs the writer and deskman functions on the same 

shift, the procedures described in paragraphs (4)(xi)(A) and (B) of this section (using the 

sample sizes indicated) shall be performed on tickets written by that person. 

(xiii) Documentation (e.g., a log, checklist, etc.) that evidences the performance of all 

keno audit procedures shall be maintained. 

(2) Pari-mutuel.

(i) Review handle, commission, and breakage for each day's play and recalculate the net 

amount due to or from the systems operator on a weekly basis. 

(ii) Verify actual cash/cash equivalents turned in daily to the system's summary report 

for each cashier's drawer (Beginning balance, ( + ) fills (draws), ( + ) net write (sold less 

voids), (−) payouts (net of IRS withholding), (−) cashbacks (paids), (=) cash turn-in). 

(iii) Produce a gross revenue recap report to calculate gross revenue for each day's play 

and for a month-to-date basis, including the following totals: 

(A) Commission; 

(B) Positive breakage; 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 53 of 64

1/26/2017 Version

(C) Negative breakage; 

(D) Track/event fees; 

(E) Track/event fee rebates; and 

(F) Purged tickets. 

(iv) All winning tickets and vouchers shall be physically removed from the kiosk for each 

day's play. 

(v) In the event a kiosk does not balance for a day's play, the auditor shall perform the 

following procedures: 

(A) Foot the winning tickets and vouchers deposited and trace to the totals of 

kiosk activity produced by the system; 

(B) Foot the listing of cashed vouchers and trace to the totals produced by the 

system; 

(C) Review all exceptions for propriety of transactions and unusual occurrences; 

(D) Review all voids for propriety; 

(E) Verify the results as produced by the system to the results provided by an 

independent source; 

(F) Regrade 1% of paid (cashed) tickets to ensure accuracy and propriety; and 

(G) When applicable, reconcile the totals of future tickets written to the totals 

produced by the system for both earned and unearned take, and review the 

reports to ascertain that future wagers are properly included on the day of the 

event. 

(vi) At least annually, foot the wagers for one day and trace to the total produced by the 

system. 

(vii) At least one day per quarter, recalculate and verify the change in the unpaid 

winners to the total purged tickets. 

(iv) At least monthly, review statistical reports for any deviations exceeding a specified 

threshold, as defined by the TGRA. Investigate and document any large and unusual 

fluctuations noted.

(3) Table games.
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 54 of 64

1/26/2017 Version

(i) If a table game has the capability to determine drop (e.g., bill-in/coin-drop meters, 

bill acceptor, computerized record, etc.) the dollar amount of the drop shall be 

reconciled to the actual drop by shift. 

(ii) Accounting/auditing agents shall review exception reports for all computerized table 

games systems at least monthly for propriety of transactions and unusual occurrences. 

(iii) All noted improper transactions or unusual occurrences shall be investigated with 

the results documented. 

(iv) A daily recap shall be prepared for the day and month-to-date, which shall include 

the following information: 

(A) Drop; 

(B) Win; and 

(C) Gross revenue.

(4) Gaming Machines.

(i) For on-line gaming machine monitoring systems, procedures shall be performed at 

least monthly to verify that the system is transmitting and receiving data from the 

gaming machines properly and to verify the continuing accuracy of the coin-in meter 

readings as recorded in the gaming machine statistical report. 

(ii) For weigh scale and currency interface systems, for at least one drop period per 

month accounting/auditing employees shall make such comparisons as necessary to the 

system generated count as recorded in the gaming machine statistical report. 

Discrepancies shall be resolved prior to generation/distribution of gaming machine 

reports. 

(iii) For each drop period, accounting/auditing personnel shall compare the coin-to-drop

meter reading to the actual drop amount. Discrepancies should be resolved prior to 

generation/distribution of on-line gaming machine monitoring system statistical reports. 

(iv) For each drop period, accounting/auditing employees shall compare the bill-in 

meter reading to the total bill acceptor drop amount for the period. Discrepancies shall 

be resolved before the generation/distribution of gaming machine statistical reports. 

(v) At least monthly, review statistical reports for any deviations from the mathematical 

expectations exceeding a threshold established by the TGRA. 

(vi) At least monthly, take a random sample, foot the vouchers redeemed and trace the 

totals to the totals recorded in the voucher system and to the amount recorded in the 

applicable cashier's accountability document.
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 55 of 64

1/26/2017 Version

(vii) At least annually, accounting/auditing agents shall randomly verify that equivalent 

game software media changes are properly reflected in the gaming machine analysis 

reports. 

(viii) Review exception reports for all computerized gaming machine systems on a daily 

basis for propriety of transactions and unusual occurrences.

(5) Drop and count.

(i) At least quarterly, unannounced currency counter and currency counter interface (if 

applicable) tests must be performed, and the test results documented and maintained. 

All denominations of currency and all types of cash out tickets counted by the currency 

counter must be tested. This test may be performed by internal audit or the TGRA. The 

result of these tests must be documented and signed by the agent(s) performing the 

test.

(ii) At least quarterly, unannounced weigh scale and weigh scale interface (if applicable) 

tests must be performed, and the test results documented and maintained. This test 

may be performed by internal audit or the TGRA. The result of these tests must be 

documented and signed by the agent(s) performing the test.

(iii) For computerized key security systems controlling access to drop and count keys, 

perform the following procedures:

(A) At least quarterly, review the report generated by the computerized key 

security system indicating the transactions performed by the individual(s) that 

adds, deletes, and changes users' access within the system (i.e., system 

administrator). Determine whether the transactions completed by the system 

administrator provide adequate control over the access to the drop and count 

keys. Also, determine whether any drop and count key(s) removed or returned 

to the key cabinet by the system administrator was properly authorized;

(B) At least quarterly, review the report generated by the computerized key 

security system indicating all transactions performed to determine whether any 

unusual drop and count key removals or key returns occurred; and

(C) At least quarterly, review a sample of users that are assigned access to the 

drop and count keys to determine that their access to the assigned keys is 

appropriate relative to their job position.

(iv) At least quarterly, an inventory of all controlled keys must be performed and reconciled to 

records of keys made, issued, and destroyed. Investigations must be performed for all keys 

unaccounted for, and the investigation documented.
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 56 of 64

1/26/2017 Version

§13. What are the minimum internal control standards for audit and accounting?

(a) Conflicts of standards. When establishing SICS, the gaming operation should review, and consider 

incorporating, other external standards such as GAAP, GAAS, and standards promulgated by GASB and 

FASB. In the event of a conflict between the MICS and the incorporated external standards, the external 

standards prevail.

(b) Accounting. Controls must be established and procedures implemented to safeguard assets and 

ensure each gaming operation:

(1) Prepares accurate, complete, legible, and permanent records of all transactions pertaining to 

gaming revenue and activities for operational accountability.

(2) Prepares general accounting records on a double-entry system of accounting, maintaining 

detailed, supporting, subsidiary records, and performs the following activities:

(i) Record gaming activity transactions in an accounting system to identify and track all 

revenues, expenses, assets, liabilities, and equity;

(ii) Record all markers, IOU's, returned checks, held checks, or other similar credit 

instruments;

(iii) Record journal entries prepared by the gaming operation and by any independent 

accountants used;

(iv) Prepare income statements and balance sheets;

(v) Prepare appropriate subsidiary ledgers to support the balance sheet;

(vi) Prepare, review, and maintain accurate financial statements;

(vii) Prepare transactions in accordance with the appropriate authorization, as provided 

by management;

(viii) Record transactions to facilitate proper recording of gaming revenue and fees, and 

to maintain accountability of assets;

(ix) Compare recorded accountability for assets to actual assets at periodic intervals, and 

take appropriate action with respect to any variances;

(x) Segregate functions, duties, and responsibilities;

(xi) Prepare minimum bankroll calculations; and

(xii) Maintain and preserve all financial records and relevant supporting documentation.

(c) Internal audit. Controls must be established and procedures implemented to ensure that:
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 57 of 64

1/26/2017 Version

(1) Internal auditor(s) perform audits of each department of a gaming operation, at least 

annually, to review compliance with TICS, SICS, and these MICS, which include at least the 

following areas:

(i) Keno, including supervision, game play standards, rabbit ear or wheel system, 

random number generator, prize payout, cash and cash equivalents, promotional 

payouts or awards, statistical reports, system security, documentation, equipment, 

document retention, multi-race tickets, and manual keno;

(ii) Pari-mutual, including, supervision, exemptions, betting ticket and equipment 

standards, payout standards, check-out standards, and computer report standards;

(iii) Table games, including supervision, fill and credit procedures, table inventory forms, 

standards for playing cards and dice, plastic cards, analysis of table game performance, 

marker credit play, name credit instruments, call bets, rim credit, and foreign currency;

(iv) Gaming machines, including supervision, access listing, prize payout and fills, cash 

and cash equivalent controls, gaming machine components, operations, vouchers, 

standards for evaluating theoretical and actual hold percentages, gaming machine drop 

and hopper contents standards, in-house progressive gaming machine standards, widearea progressive gaming machine standards, and account access cards;

(v) Gaming promotions and player tracking procedures, including supervision, gaming 

promotion rules and player tracking systems;

(vi) Complimentary services or items, including procedures for issuing, authorizing, 

redeeming, and reporting complimentary service items;

(vii) Patron deposit accounts and cashless systems procedures, including supervision, 

patron deposit accounts and cashless systems, as well as patron deposits, withdrawals 

and adjustments;

(viii) Lines of credit procedures, including establishment of lines of credit policy;

(ix) Drop and count standards, including supervision, count room access, count team, 

table game drop standards, gaming machine and financial instrument drop standards, 

table game count standards, gaming machine financial instrument count standards, 

collecting currency cassettes and financial instrument storage components from kiosks, 

kiosk count standards, and controlled keys;

(x) Cage, vault, cash and cash equivalent procedures, including supervision, cash and 

cash equivalents, personal checks, cashier's checks, traveler's checks, payroll checks, 

and counter checks, cage and vault accountability, kiosks, patron deposited funds, 

promotional payouts, drawings, and giveaway programs, chip and token standards, and 

cage and vault access;
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 58 of 64

1/26/2017 Version

(xi) Information technology, including supervision, systems' logical and physical controls, 

independence, physical security, logical security, user controls, installations and/or 

modifications, remote access, incident monitoring and reporting, data back-ups, 

software downloads, and verifying downloads; and

(xii) Accounting standards, including accounting records, maintenance and preservation 

of financial records and relevant supporting documentation.

(2) Internal auditor(s) are independent of gaming operations with respect to the departments 

subject to audit (auditors internal to the operation, officers of the TGRA, or outside CPA firm 

may perform this function).

(3) Internal auditor(s) report directly to the Tribe, TGRA, audit committee, or other entity 

designated by the Tribe.

(4) Documentation such as checklists, programs, reports, etc. is prepared to evidence all internal 

audit work and follow-up performed as it relates to compliance with TICS, SICS, and these MICS, 

including all instances of noncompliance.

(5) Audit reports are maintained and made available to the Commission upon request and must 

include the following information:

(i) Audit objectives;

(ii) Audit procedures and scope;

(iii) Findings and conclusions;

(iv) Recommendations, if applicable; and

(v) Management's response.

(6) All material exceptions identified by internal audit work are investigated and resolved and 

the results are documented.

(7) Internal audit findings are reported to management, responded to by management stating 

corrective measures to be taken, and included in the report delivered to management, the 

Tribe, TGRA, audit committee, or other entity designated by the Tribe for corrective action.

(8) Follow-up observations and examinations is performed to verify that corrective action has 

been taken regarding all instances of non-compliance. The verification is performed within six 

(6) months following the date of notification of non-compliance.

(d) Annual requirements. 

(1) Agreed upon procedures. A CPA must be engaged to perform an assessment to verify 

whether the gaming operation is in compliance with these MICS, and/or the TICS or SICS if they 
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 59 of 64

1/26/2017 Version

provide at least the same level of controls as the MICS. The assessment must be performed in 

accordance with agreed upon procedures and the most recent versions of the Statements on 

Standards for Attestation Engagements and Agreed-Upon Procedures Engagements (collectively 

“SSAEs”), issued by the American Institute of Certified Public Accountants.

(2) The tribe must submit two copies of the agreed-upon procedures report to the Commission 

within 120 days of the gaming operation's fiscal year end in conjunction with the submission of 

the annual financial audit report required pursuant to 25 CFR part 571.

(3) Review of internal audit.

(i) The CPA must determine compliance by the gaming operation with the internal audit 

requirements in this paragraph (d) by:

(A) Completing the internal audit checklist;

(B) Ensuring that the internal auditor completed checklists for each gaming 

department of the operation;

(C) Verifying that any areas of non-compliance have been identified;

(D) Ensuring that audit reports are completed and include responses from 

management; and

(E) Verifying that appropriate follow-up on audit findings has been conducted 

and necessary corrective measures have been taken to effectively mitigate the 

noted risks.

(ii) If the CPA determines that the internal audit procedures performed during the fiscal 

year have been properly completed, the CPA may rely on the work of the internal audit 

for the completion of the MICS checklists as they relate to the standards covered by this 

part.

(4) Report format. The SSAEs are applicable to agreed-upon procedures engagements required 

in this part. All noted instances of noncompliance with the MICS and/or the TICS or SICS, if they 

provide the same level of controls as the MICS, must be documented in the report with a 

narrative description, the number of exceptions and sample size tested.

§14. What are the minimum internal control standards for surveillance?

(a) Supervision. Supervision must be provided as needed for surveillance by an agent(s) with authority 

equal to or greater than those being supervised.

(b) Surveillance equipment and control room(s). Controls must be established and procedures 

implemented that include the following:
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 60 of 64

1/26/2017 Version

(1) For Tier A, the surveillance system must be maintained and operated from a secured 

location, such as a locked cabinet. For Tiers B and C, the surveillance system must be maintained 

and operated from a staffed surveillance operation room(s).

(2) The surveillance operation room(s) must be secured to prevent unauthorized entry.

(3) Access to the surveillance operation room(s) must be limited to surveillance agents and 

other authorized persons.

(4) Surveillance operation room(s) access logs must be maintained.

(5) Surveillance operation room equipment must have total override capability over all other 

satellite surveillance equipment.

(6) Power loss to the surveillance system:

(i) For Tier A, in the event of power loss to the surveillance system, alternative security 

procedures, such as additional supervisory or security agents, must be implemented 

immediately.

(ii) For Tier B and C, in the event of power loss to the surveillance system, an auxiliary or 

backup power source must be available and capable of providing immediate restoration 

of power to the surveillance system to ensure that surveillance agents can observe all 

areas covered by dedicated cameras.

(7) The surveillance system must record an accurate date and time stamp on recorded events. 

The displayed date and time must not significantly obstruct the recorded view.

(8) All surveillance agents must be trained in the use of the equipment, games, and house rules.

(9) Each camera required by the standards in this section must be installed in a manner that will 

prevent it from being readily obstructed, tampered with, or disabled.

(10) The surveillance system must:

(i) Have the capability to display all camera views on a monitor;

(ii) Include sufficient numbers of recording devices to record the views of all cameras 

required by this section;

(iii) Record all camera views; and

(iv) For Tier B and C only, include sufficient numbers of monitors to simultaneously 

display gaming and count room activities.
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 61 of 64

1/26/2017 Version

(11) A periodic inspection of the surveillance systems must be conducted. When a malfunction 

of the surveillance system is discovered, the malfunction and necessary repairs must be 

documented and repairs initiated within seventy-two (72) hours.

(i) If a dedicated camera malfunctions, alternative security procedures, such as 

additional supervisory or security agents, must be implemented immediately.

(ii) The TGRA must be notified of any surveillance system and/or camera(s) that have 

malfunctioned for more than twenty-four (24) hours and the alternative security 

measures being implemented.

(c) Additional surveillance requirements. With regard to the following functions, controls must also 

include:

(1) Surveillance of the progressive prize meters for gaming systems at the following thresholds:

(i) Wide area progressives with a reset amount of $1 million; and

(ii) In-house progressives with a reset amount of $250,000.

(2) Gaming machines:

(i) Except as otherwise provided in paragraphs (c)(1) of this section, gaming machines 

offering a payout of more than $250,000 shall be monitored and recorded by a 

dedicated camera(s) to provide coverage of:

(A) All customers and employees at the gaming machine, and

(B) The face of the gaming machine, with sufficient clarity to identify the payout 

line(s) of the gaming machine.

(3) Pari-mutuel:

(i) Monitor and record general activities in the pari-mutuel area, to include the ticket 

writer and cashier areas, with sufficient clarity to identify the agents performing the 

different functions.

(4) Table games:

(i) Except for table game tournaments, a dedicated camera(s) with sufficient clarity must 

be used to provide:

(A) An overview of the activities on each table surface, including card faces and 

cash and/or cash equivalents; and

(B) An overview of table game activities, including patrons and dealers.
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 62 of 64

1/26/2017 Version

(ii) For table game tournaments, a dedicated camera(s) must be used to provide an 

overview of tournament activities, and any area where cash or cash equivalents are 

exchanged.

(5) Keno:

(i) Monitor the keno ball-drawing device or random number generator, which shall be 

recorded during the course of the draw by a dedicated camera with sufficient clarity to 

identify the balls drawn or numbers selected.

(ii) Monitor and record general activities in each keno game area with sufficient clarity 

to identify the agents performing the different functions.

(6) Cage and vault:

(i) The surveillance system must monitor and record a general overview of activities 

occurring in each cage and vault area with sufficient clarity to identify individuals within 

the cage and patrons and staff members at the counter areas and to confirm the 

amount of each cash transaction;

(ii) Each cashier station must be equipped with one (1) dedicated overhead camera 

covering the transaction area; and

(iii) The cage or vault area in which exchange and transfer transactions occur must be 

monitored and recorded by a dedicated camera or motion activated dedicated camera 

that provides coverage with sufficient clarity to identify the chip values and the amounts 

on the exchange and transfer documentation. Controls provided by a computerized 

exchange and transfer system constitute an adequate alternative to viewing the 

amounts on the exchange and transfer documentation.

(7) Count rooms:

(i) The surveillance system must monitor and record with sufficient clarity a general 

overview of all areas where cash or cash equivalents may be stored or counted; and

(ii) The surveillance system must provide coverage of count equipment with sufficient 

clarity to view any attempted manipulation of the recorded data.

(8) Kiosks: The surveillance system must monitor and record a general overview of activities 

occurring at each kiosk with sufficient clarity to identify the activity and the individuals 

performing it, including maintenance, drops or fills, and redemption of wagering vouchers or 

credits.

(d) Reporting requirements. TGRA-approved procedures must be implemented for reporting suspected 

crimes and suspicious activity.
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 63 of 64

1/26/2017 Version

(e) Recording retention. Controls must be established and procedures implemented that include the 

following:

(1) All recordings required by this section must be retained for a minimum of seven days; and

(2) Suspected crimes, suspicious activity, or detentions by security agents discovered within the 

initial retention period must be copied and retained for a time period, not less than one year.

(f) Logs. Logs must be maintained and demonstrate the following:

(1) Compliance with the storage, identification, and retention standards required in this section;

(2) Each malfunction and repair of the surveillance system as defined in this section; and

(3) Activities performed by surveillance agents as required by the controls in this section.

§15. What are the minimum internal control standards for controlled keys?

(a) Supervision. Supervision must be provided over controlled keys as needed by an agent(s) with 

authority equal to or greater than those being supervised.

(b) Custody of all keys involved in the drop and count must be maintained by a department independent 

of the count and the drop agents as well as those departments being dropped and counted.

(c) Controls must be established and procedures implemented to safeguard the use, access, and security 

of keys in accordance with the following:

(1) Each of the following requires a separate and unique key lock or alternative secure access 

method:

(i) Drop cabinet;

(ii) Drop box/storage component release;

(iii) Drop box/storage component content; 

(iv) Storage racks and carts;

(v) Kiosk release; and

(vi) Kiosk contents.

(2) Access to and return of keys or equivalents must be documented with the date, time, and 

signature or other unique identifier of the agent accessing or returning the key(s).

(i) For Tier A and B operations, at least two (2) drop team agents are required to be 

present to access and return keys. For Tier C operations, at least three (3) drop team 

agents are required to be present to access and return keys.
Class III Minimum Internal Controls DRAFT Guidance

For Tribal Consultation 

Page 64 of 64

1/26/2017 Version

(ii) For Tier A and B operations, at least two (2) count team agents are required to be 

present at the time count room and other count keys are issued for the count. For Tier C 

operations, at least three (two for table game drop box keys in operations with three 

tables or fewer) count team agents are required to be present at the time count room 

and other count keys are issued for the count.

(3) Documentation of all keys, including duplicates, must be maintained, including: 

(i) Unique identifier for each individual key;

(ii) Key storage location;

(iii) Number of keys made, duplicated, and destroyed; and

(iv) Authorization and access.

(4) Other than the count team, no agent may have access to the drop box/storage component 

content keys while in possession of storage rack keys and/or release keys.

(5) Other than the count team, only agents authorized to remove drop boxes/storage 

component are allowed access to drop box/storage component release keys.

(6) Any use of keys at times other than the scheduled drop and count must be properly 

authorized and documented.

(7) Emergency manual keys, such as an override key, for computerized, electronic, and 

alternative key systems must be maintained in accordance with the following:

(i) Access to the emergency manual key(s) used to access the box containing the player 

interface drop and count keys requires the physical involvement of at least three agents 

from separate departments, including management. The date, time, and reason for 

access, must be documented with the signatures of all participating persons signing 

out/in the emergency manual key(s);

(ii) The custody of the emergency manual keys requires the presence of two agents from

separate departments from the time of their issuance until the time of their return; and

(iii) Routine physical maintenance that requires access to the emergency manual key(s), 

and does not involve accessing the player interface drop and count keys, only requires 

the presence of two agents from separate departments. The date, time, and reason for 

access must be documented with the signatures of all participating agents signing out/in 

the emergency manual key(s).