§543.22 What are the minimum internal control standards for internal audit for Tier A 

gaming operations? 

(a) Internal audit personnel. (1) For Tier A gaming operations, a separate internal audit 

department shall be maintained. Alternatively, designating personnel (who are 

independent with respect to the departments/procedures being examined) to perform 

internal audit work satisfies the requirements of this paragraph. 

(2) The internal audit personnel shall report directly to the Tribe, Tribal gaming 

regulatory authority, audit committee, or other entity designated by the Tribe in 

accordance with the definition of internal audit in §543.2. 

(b) Audits. Internal audit personnel shall perform audits of the gaming operation. 

(1) The following areas shall be reviewed at least annually: 

Revised proposal as a result of written comment to (b) (3) below. 

(1) The following areas shall be reviewed audited at least annually:

(i) Pull tabs, including but not limited to, computer applications, pull tab inventory, 

access, transfers, winning pull tabs, accountability form, statistical reports, and electronic 

equipment; 

Written Comment (March): What about bingo/counter games? 

Response: Bingo is included in (b) (3) 

(ii) Card games, including but not limited to, computer applications, supervision, playing 

cards, shills, reconciliation of card room bank, promotional progressive pots and pools, 

card room contests and tournaments, computerized player tracking systems and 

accounting/audit standards; 

7-8-10 Version 

Page 1 of 5 
(iii) Cage procedures, including but not limited to, computer applications, personal 

checks, cashier's checks, traveler’s checks, payroll checks, and counter checks, patron 

deposited funds, safe deposit boxes, cage/vault accountability, chip and token standards, 

promotional payouts, drawings, and giveaway programs, accounting/auditing standards 

and extraneous items; 

(iv) Credit procedures, including but not limited to, computer applications, credit 

standards, payment standards, access to credit documentation, maintenance of credit 

documentation, write off and settlement, collection agencies, and accounting/ auditing 

standards; 

(v) Information technology, including but not limited to, physical security, unauthorized 

individuals, user controls, back-up and recovery, access records, and remote access; 

(vi) Complimentary services or items, including but not limited to, procedures whereby 

complimentary service items are issued, authorized, redeemed and reported; 

(vii) Accounting standards, including but not limited to, accounting records, GAAP 

requirements, administrative and accounting procedures, gross gaming revenue 

computations, currency controls, periodic payment plans, voucher deductibility, unpaid 

credit instrument deductibility, allowable and non-allowable deductions from gross 

revenue, and maintenance and preservation of books, records and documents; 

(viii) Drop and count standards, including but not limited to, computer applications, card 

game drop, soft count room personnel, card game soft count, player interface financial 

instrument storage component drop, player interface financial instrument storage 

component count, player interface coin drop, hard count room personnel, player interface 

coin count and wrap, count room inventory security, transfers of currency and coin 

7-8-10 Version 

Page 2 of 5 
during the count, key controls-general, player interface drop key controls, card game drop 

box key controls, card game drop box release keys, player interface financial instrument 

storage component release keys, card game drop box storage rack keys, player interface 

financial instrument storage component storage rack keys, card game drop box contents 

keys, player interface financial instrument storage component contents keys, player 

interface computerized key security systems, card game computerized key security 

systems, emergency drop procedures and player interface count equipment; and 

(ix) Any other internal audits as required by the Tribe, Tribal gaming regulatory 

authority, audit committee, or other entity designated by the Tribe. 

(2) In addition to the observation and examinations performed under paragraph (b)(1) of 

this section, follow-up observations and examinations shall be performed to verify that 

corrective action has been taken regarding all instances of noncompliance cited by 

internal audit, the independent accountant, and/or the Commission. The verification shall 

be performed within six (6) months following the date of notification. 

(3) The following area shall be reviewed at least semi-annually: 

Written Comment (March): If the intent of this section is the same as (b), then 

we ask then the NIGC ensure that the term “reviewed” is consistent with the term 

“audit”. If that is not the intent, then we ask the NIGC to clarify the purpose, 

scope and intent of the term “reviewed” in this section 

Response: Although NIGC believes that the introductory sentence in (b) makes it 

clear that “audits” of the specified areas are required, in the interest of clarity, we 

agree to replace “reviewed” with “audited” in (b) (1) and (b) (3). 

Revised proposal as a result of written comment: 

(3) The following area shall be reviewed audited at least semi-annually: 

7-8-10 Version 

Page 3 of 5 
(i) Bingo, including but not limited to, bingo cards, bingo draw, manual payouts and short 

pays, operational controls, gaming equipment, voucher systems, patron accounts and 

cashless systems, promotions, and accounting/auditing standards. 

(ii) [Reserved] 

(4) Whenever possible, internal audit observations shall be performed on an unannounced 

basis (i.e., without personnel being forewarned that their activities will be observed). 

Additionally, if the independent accountant also performs the internal audit function, the 

accountant shall perform separate observations of the player interface drops and counts to 

satisfy the internal audit observation requirements and independent accountant tests of 

controls as required by the American Institute of Certified Public Accountants guide. 

(c) Documentation. (1) Documentation (e.g., checklists, programs, reports, etc.) shall be 

prepared to evidence all internal audit work performed as it relates to the requirements in 

this section, including all instances of noncompliance. 

(2) The internal audit department shall operate with audit programs, which, at a 

minimum, address the MICS. Additionally, the department shall properly document the 

work performed, the conclusions reached, and the resolution of all exceptions. Institute 

of Internal Auditors standards are recommended but not required. 

(d) Reports. (1) Reports documenting audits performed shall be maintained and made 

available to the Commission upon request. 

(2) Such audit reports shall include the following information: 

(i) Audit objectives; 

(ii) Audit procedures and scope; 

(iii) Findings and conclusions; 

7-8-10 Version 

Page 4 of 5 
(iv) Recommendations, if applicable; and 

(v) Management's response. 

(e) Material exceptions. All material exceptions resulting from internal audit work shall 

be investigated and resolved with the results of such being documented and retained for 

five years. 

(f) Role of management. (1) Internal audit findings shall be reported to management. 

(2) Management shall be required to respond to internal audit findings stating corrective 

measures to be taken to avoid recurrence of the audit exception. 

(3) Such management responses shall be included in the internal audit report that will be 

delivered to management, the Tribe, Tribal gaming regulatory authority, audit committee, 

or other entity designated by the Tribe. 

(g) Internal Audit Guidelines. In connection with the internal audit testing pursuant to 

paragraph (b) (1) and (b) (3) of this section, the Commission shall develop recommended 

Internal Audit Guidelines, which shall be available upon request. 

7-8-10 Version 

Page 5 of 5