Sample Audit Checklist for the NIGC CHRI MOU 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 1 of 5 

 MOU with the NIGC regarding CHRI 

1. Based on inquiry and observation, did the TGRA 

modify its fingerprint operating systems to meet 

CSP requirements and NIGC’s connectivity 

requirements? 

If no, did the TGRA request and receive 

approval, prior to implementation of any 

exceptions, from the NIGC ISO? 

If yes, please attach the request and approval 

correspondence. 

Does the TGRA process fingerprints through the 

NIGC via hard card submissions? 

If yes, they are exempt from this requirement. 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

CHRI MOU 

V. B. 1 

CHRI MOU 

V. B. 1 

CHRI MOU 

V. B. 1 

2. Based on record examination, has the TGRA 

made reasonable efforts to ensure personally 

identifiable information (PII) is relevant, 

accurate, timely and complete before submitting 

it to the NIGC? 

____ ____ ____ CHRI MOU 

V. B. 2 

3. Based on record examination, does the TGRA 

have written processes in place to notify the 

NIGC when it is made aware of inaccuracies in 

PII received from the NIGC that would impact 

the TGRA’s ability to assess employment or 

licensing eligibility? 

____ ____ ____ CHRI MOU 

V. B. 3 

4. Prior to taking applicants’ fingerprints, does the 

TGRA provide applicants a copy of the NonCriminal Justice Applicant’s Privacy Rights 

notice, in writing1

? 

If yes, was the notice identical to the version 

provided by the FBI?2

 

____ 

____ 

____ 

____ 

____ 

____ 

CHRI MOU 

V. B. 4 

CHRI MOU 

V. B. 4 

5. Prior to taking applicants’ fingerprints, does the 

TGRA provide applicants a copy of the FBI’s 

Privacy Act Statement, in writing? 

If yes, was the notice identical to the version 

provided by the FBI?3

____ 

____ 

____ 

____ 

____ 

____ 

CHRI MOU 

V. B. 4 

CHRI MOU 

V. B. 4 

 

1

 Written notification includes electronic notification, but excludes oral notification. 

2 https://www.fbi.gov/services/cjis/compact-council/guiding-principles-noncriminal-justice-applicants-privacy-rights 3 https://www.fbi.gov/services/cjis/compact-council/privacy-act-statement
Sample Audit Checklist for the NIGC CHRI MOU 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 2 of 5 

6. Based on record examination, are written TGRA 

policies and procedures in place to, at minimum, 

provide applicants an opportunity to complete or 

challenge the accuracy of the information in their 

FBI criminal history record, including: 

a. Advising applicants in writing of the 

procedure for obtaining a change, correction, 

or update to the record as set forth in 28 

C.F.R. § 16.34; 

b. Affording applicants a reasonable time to 

correct or complete the record (unless they 

explicitly decline to do so) before denying 

their gaming license or employment based 

upon the information in the record; 

c. Choosing to develop written procedures for 

providing applicants copies of their records 

for review and possible challenge, correction, 

or update that require: 

(i) Verification of the applicant’s identity 

prior to dissemination of the copy to the 

applicant or an attorney working on their 

behalf; 

(ii) Documenting the release of the copy; and 

(iii)Marking the copy in some manner to 

distinguish it as the applicant’s copy4

, not 

the original. (e.g., watermark). 

d. Or, instead of sub-section (c) above, electing 

not to provide applicants copies of their FBI 

criminal history records by developing a 

written policy prohibiting the release of the 

records for such purpose and directing 

applicants to the FBI’s process for obtaining a 

copy5. 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

CHRI MOU 

V. B. 5(a) 

CHRI MOU 

V. B. 5(b) 

CHRI MOU 

V. B. 5(c)(i) 

CHRI MOU 

V. B. 5(c)(ii) 

CHRI MOU 

V. B. 5(c)(iii) 

CHRI MOU 

V. B. 5(d) 

 

 

4

 The copy must not be reused for any other purpose. 

5 http://www.fbi.gov/about-us/cjis/background-checks
Sample Audit Checklist for the NIGC CHRI MOU 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 3 of 5 

7. Based on inquiry and record examination, is FBI 

CHRI received from the NIGC used for IGRA 

and NIGC regulatory purposes6

? 

Such purposes are backgrounding and licensing 

key employees and primary management 

officials. 

Based on inquiry, observation and record 

examination, is FBI CHRI received from the 

NIGC used for any other purpose? 

____ 

____ 

____ 

____ 

____ 

____ 

CHRI MOU 

V. B. 6 

CHRI MOU 

V. B. 7 

8. Based on inquiry and record examination, has the 

TGRA established procedures to comply with the 

Next Generation Identification7 (NGI) Re-use 

standard8

? 

Does the TGRA comply with such procedures? 

____ 

____ 

____ 

____ 

____ 

____ 

CHRI MOU 

V. B. 7 

CSP 5.1.1.1 

9. Based on inquiry and record examination, has the 

TGRA established procedures and controls to 

comply with the NGI Residual Access standard9? 

Does the TGRA comply with such procedures? 

____ 

____ 

____ 

____ 

____ 

____ 

CHRI MOU 

V. B. 8 

CSP 5.1.1.1 

10. Based on inquiry and record examination, does 

the TGRA set forth on the Notice of Results 

(NOR), the job title or position of the KE or 

PMO so the NIGC may confirm the job 

title/position comes within the perimeters for the 

NIGC to request CHRI from the FBI? 

____ ____ ____ CHRI MOU 

V. B. 9 

 

 

6

 Pursuant to the FBI-NIGC Memorandum of Understanding re: noncriminal justice fingerprint submissions 

(January 17, 2020) (hereinafter FBI-NIGC MOU), provision I, the NIGC will accept fingerprint submissions that are 

properly and adequately completed for purposes of 25 C.F.R. §§ 502.14(a) – (c) and 502.19(a) – (c). If the NIGC 

amends its regulations to permit the fingerprinting of new or additional categories of primary management officials 

and/or key employees, this MOU will apply to the NIGC’s acceptance of their fingerprints and the resulting CHRI 

upon the regulations’ effective date. 

7

 NGI Audit, Noncriminal Justice Access to CHRI, Policy Reference Guide (April 6, 2020). 

8

 This standard prohibits sharing it with applicant’s spouse, household, other family members, tribal leadership, 

tribal agencies not involved in employing or licensing KEs or PMOs, human resource departments, potential 

employers, and state gaming or licensing agencies. Even if the use of CHRI may be necessary to satisfy state 

licensing requirements, CHRI from the NIGC cannot be used for such purpose – a new record request to the FBI 

through a non-NIGC process must be made in such instance. 

9

 This standard limits residual access to CHRI “to only the minimum level necessary to accomplish oversight 

responsibilities” by a state gaming agency (such as access to CHRI as part of an audit or review of licensing during a 

regulatory inspection) or by an inspector general’s office. 
Sample Audit Checklist for the NIGC CHRI MOU 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 4 of 5 

11. Has the TGRA provided the NIGC representative 

access to CHRI that was obtained through this 

MOU for purposes of inspection and/or audit to 

ensure compliance with it? 

Is this Tribe self-regulated? 

If yes, does the TGRA provide NIGC 

representatives access to its Class II background 

investigation and licensing files for which CHRI 

was obtained through the MOU? 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

CHRI MOU 

V. B. 10 

CHRI MOU 

V. B. 11 

CHRI MOU 

V. B. 11 

12. Has the TGRA cooperated to schedule and 

conduct the NIGC audits of CHRI compliance? ____ ____ ____ CHRI MOU V. B. 12 

13. Based on inquiry and record examination, does 

the TGRA have an auditable process to notify the 

NIGC, on a monthly basis, of the following 

licensing information associated with the 

dissemination of CHRI for a fingerprinted 

applicant that does not result in the submission of 

a NOR: 

a) the reason for the fingerprint submission and 

b) if the submission was in error, the steps taken 

to correct the process that created the error. 

____ 

____ 

____ 

____ 

____ 

____ 

CHRI MOU 

V. B. 13 

CHRI MOU 

V. B. 13 

14. Based on record review, does the TGRA’s 

processes, procedures and controls comply with 

the CSP10 and all annual updates to it? 

____ ____ ____ CHRI MOU 

V. B. 14 

15. Based on record review, does the TGRA comply 

with the NGI11 requirements and all annual 

updates to it? 

____ ____ ____ CHRI MOU 

V. B. 15 

16. Has the Tribe or TGRA designated someone as 

the Local Agency Security Officer (LASO)? ____ ____ ____ CSP 3.2.2(2)(e) 

 

 

10 https://www.fbi.gov/services/cjis/cjis-security-policy-resourcecenter 11 https://www.nigc.gov/images/uploads/NGI-audit-policy-reference-noncriminal-justice-access-CHRI-031021.pdf
Sample Audit Checklist for the NIGC CHRI MOU 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 5 of 5 

17. Based on inquiry and record examination, does 

the TGRA have an auditable process to ensure 

that if and when the TGRA’s LASO changes, the 

new LASO will review a copy of the MOU 

within ten business days of assuming the position 

as well as notify the NIGC Information Security 

Officer (ISO) (iso@nigc.gov) of their name and 

contact information within that timeframe? 

____ ____ ____ CHRI MOU 

V. B. 16 

18. Based on record review, does the TGRA comply 

with the MOU as to new or additional categories 

of primary management officials and/or key 

employees that were added to NIGC regulations? 

If NIGC regulations have not been modified to 

add new categories of primary management 

officials or key employees, please disregard this 

question. 

____ ____ ____ CHRI MOU 

V. B. 17