§542.22 What are the minimum internal control standards for internal audit for Tier A 

gaming operations? 

(a) Internal audit personnel. (1) For Tier A gaming operations, a separate internal audit 

department must be maintained. Alternatively, designating personnel (who are 

independent with respect to the departments/procedures being examined) to perform 

internal audit work satisfies the requirements of this paragraph. 

(2) The internal audit personnel shall report directly to the Tribe, Tribal gaming 

regulatory authority, audit committee, or other entity designated by the Tribe in 

accordance with the definition of internal audit in §542.2. 

Note: (b) (1) and (2) have been updated for consistency with final proposals. 

(b) Audits. (1) Internal audit personnel shall perform audits of all major gaming areas of 

the gaming operation. The following shall be reviewed at least annually: 

Comment (July): Replace “all areas” with “gaming areas”. 

Response: Agree to strike “all areas” as overly inclusive. Disagree to replace 

with “gaming areas” as audit standards for areas that could be classified as nongaming are included in this subsection, including cage, credit, information 

technology, and accounting. 

Comment (July): Replace with “Internal audit personnel shall perform audits of 

the following areas at least annually.” 

Response: Agree. However, recommend modification of (b), (b) (1), and (b) (2) 

to reduce repetition and incorporate the comment into the standards. 

(b) Audits. Internal audit personnel shall perform audits of all major gaming areas of 

the gaming operation. 

(1) The following areas shall be reviewed at least annually: 

Revised proposal as a result of written comment to (b) (3) below. 

6-30-10 Version 

Page 1 of 10 
(1) The following areas shall be reviewed audited at least annually: 

(i) Bingo, including but not limited to, computer applications, game play standards, 

promotional payouts or awards, accountability form, bingo equipment, statistical 

reports, electronic equipment, linked games, host requirements, remote 

requirements, player accounts; bingo card control, payout procedures, and cash 

reconciliation process;

(ii) Pull tabs, including but not limited to, computer applications, pull tab inventory, 

access, transfers, winning pull tabs, accountability form, statistical reports, and 

electronic equipment; winner verification, perpetual inventory, and accountability 

of sales versus inventory; 

(iii) Card games, including but not limited to, computer applications, drop and count, 

supervision, playing cards, shills, reconciliation of card room bank promotional 

progressive pots, card room contests and tournaments computerized player tracking 

systems and accounting/audit standards; card games operation, cash exchange 

procedures, shill transactions, and count procedures;

Comment (October): Strike paragraphs (i) – (iii). Class II games, Part 542 not 

applicable. 

Response: Agree, with the exception of Pull tabs, which are considered Class III 

games unless played in the same location as bingo. After striking paragraphs (i) 

and (iii), paragraphs (ii) – (xii) become (i) – (x).

Revised Response: Agree, with the exception of Pull tabs, which are considered 

Class III games unless played in the same location as bingo and card games, 

which according to NIGC’s Office of General Counsel, may be classified as Class 

II or Class III games. After striking paragraphs (i), paragraphs (ii) – (xii) become 

(i) – (xi). 

6-30-10 Version 

Page 2 of 10 
(i) Bingo, including but not limited to, computer applications, game play standards, 

promotional payouts or awards, accountability form, bingo equipment, statistical 

reports, electronic equipment, linked games, host requirements, remote 

requirements, player accounts; 

(i) (ii) Pull tabs, including but not limited to, computer applications, pull tab 

inventory, access, transfers, winning pull tabs, accountability form, statistical 

reports, and electronic equipment; winner verification, perpetual inventory, and 

accountability of sales versus inventory; 

(ii) (iii) Card games, including but not limited to, computer applications, supervision, 

playing cards, shills, reconciliation of card room bank promotional progressive pots, 

card room contests and tournaments computerized player tracking systems and 

accounting/audit standards; card games operation, cash exchange procedures, shill 

transactions, and count procedures;

(iii) (iv) Keno, including but not limited to, computer applications, game play 

standards, rabbit ear or wheel system, random number generator, winning tickets, 

check out standards, promotional payouts, statistical records, system security,

documentation, audit standards, access, keno equipment, document retention and 

multi-race tickets; game write and payout procedures, sensitive key location and 

control, and a review of keno auditing procedures;

(iv) (v)Pari-mutuel wagering, including but not limited to, exemptions, computer 

applications, betting ticket and equipment standards, payout standards, checkout 

standards, employee wagering, computer reports, and accounting and auditing;

write and payout procedures, and pari-mutual auditing procedures;

6-30-10 Version 

Page 3 of 10 
(vi) Table games, including but not limited to, fill and credit procedures, pit credit 

play procedures, rim credit procedures, soft drop/count procedures and the 

subsequent transfer of funds, unannounced testing of count room currency counters 

and/or currency interface, location and control over sensitive keys, the tracing of 

source documents to summarized documentation and accounting records, and 

reconciliation to restricted copies;

(vii) Gaming machines, including but not limited to, jackpot payout and gaming 

machine fill procedures, gaming machine drop/count and bill acceptor drop/count 

and subsequent transfer of funds, unannounced testing of weigh scale and weigh 

scale interface, unannounced testing of count room currency counters and/or 

currency interface, gaming machine drop cabinet access, tracing of source 

documents to summarized documentation and accounting records, reconciliation to 

restricted copies, location and control over sensitive keys, compliance with EPROM 

duplication procedures, and compliance with MICS procedures for gaming 

machines that accept currency or coin(s) and issue cash-out tickets or gaming 

machines that do not accept currency or coin(s) and do not return currency or 

coin(s);

(v) (viii) Cage procedures, including but not limited to, personal checks, cashier's 

checks, payroll checks, and counter checks, customer deposited funds, cage/vault 

accountability, chip and token standards, and accounting/auditing standards; 

Note: Subsequent review revealed inconsistencies between the cage procedures 

listed above and the subsections of proposed cage section 542.14. 

Revised proposal: 

6-30-10 Version 

Page 4 of 10 
(v) (viii) Cage procedures, including but not limited to, computer applications, 

personal checks, cashier's checks, traveler’s checks, payroll checks, and counter 

checks, customer deposited funds, safe deposit boxes, cage/vault accountability, chip 

and token standards, promotional payouts, drawings, and giveaway programs, 

accounting/auditing standards and extraneous items; 

(vi) (ix) Credit procedures, including but not limited to, computer applications, 

credit standards, payment standards, access to credit documentation, maintenance 

of credit documentation, write off and settlement, collection agencies, and 

accounting/ auditing standards; , all cage, credit, and collection procedures, and the 

reconciliation of trial balances to physical instruments on a sample basis. Cage 

accountability shall be reconciled to the general ledger;

(vii) (x) Information technology, including but not limited to, general controls for 

hardware and software, independence of IT personnel, gaming program changes, 

security logs, remote dial-up and document storage; functions, including review for 

compliance with information technology standards;

(viii)(xi) Complimentary services or items, including but not limited to, procedures 

whereby complimentary service items are issued, authorized, and redeemed and 

reported; and

(ix) Accounting standards, including but not limited to, accounting records, GAAP 

requirements, administrative and accounting procedures, gross gaming revenue 

computations, and maintenance and preservation of books;

Comment (July): Strike “administrative and”. Could be interpreted as including 

non-gaming administrative procedures. 

6-30-10 Version 

Page 5 of 10 
Response: Disagree. The scope of the paragraph is limited to standards 

contained in section 542.19, and the reference is specific to subsection 542.19(c). 

Note: Subsequent review revealed inconsistencies between the accounting 

standards listed above and the subsections of proposed accounting section 542.19. 

Revised proposal: 

(ix) Accounting standards, including but not limited to, accounting records, GAAP 

requirements, administrative and accounting procedures, gross gaming revenue 

computations, currency controls, periodic payment plans, cash out ticket 

deductibility, credit instrument deductibility, allowable and non-allowable 

deductions from gross revenue, and maintenance and preservation of books;

(x) Drop and count standards, including but not limited to, computer applications, 

table games drop, soft count room personnel, table games count, gaming machine 

bill acceptor drop, gaming machine bill acceptor count, gaming machine coin drop 

standards, hard count room personnel, gaming machine coin count and wrap 

standards, count room inventory security, transfers of currency and coin during the 

count, key controls-general, gaming machine drop key control standards, table 

games drop key control standards, table game drop box release keys, bill acceptor 

canister release keys, table game drop box storage rack keys, bill acceptor canister 

storage rack keys, table game drop box contents keys, bill acceptor canister contents 

keys, gaming machine computerized key security systems and table game 

computerized key security systems, emergency drop procedures and gaming 

machine count equipment; and

Comment (July): Inclusion of computerized key control standards could be 

interpreted as a requiring the use of a computerized key control system. 

Response: Disagree. The scope of the paragraph is limited to standards 

contained in section 542.41, and the reference is specific to subsection 542.41(t), 

which has no such requirement. 

6-30-10 Version 

Page 6 of 10 
(xi) Any other internal audits as required by the Tribe, Tribal gaming regulatory 

authority, audit committee, or other entity designated by the Tribe. 

(2) The following areas shall be reviewed at least semi-annually: 

(i) Table games, including but not limited to, computer applications, fill and credit 

procedures, table inventory forms, computer generated documentation, playing 

cards and dice, plastic cards, supervision, table game analysis, accounting/auditing, 

marker credit play, named credit instruments, call bets, rim credit and foreign 

currency; and

(ii) Gaming machines, including but not limited to, standards for gaming machines, 

computer applications, jackpot payouts, gaming machine fills, short pays and 

accumulated credit payouts, promotional payouts, department funds, EPROM’s, 

theoretical and actual hold, hopper content standards, player tracking, in-house 

progressives, wide area progressives, accounting/auditing, cash-out tickets, account 

access cards and smart cards. 

(3) In addition to the observation and examinations performed under paragraph (b)(1) of 

this section, follow-up observations and examinations shall be performed to verify that 

corrective action has been taken regarding all instances of noncompliance cited by 

internal audit, the independent accountant, and/or the Commission. The verification shall 

be performed within six (6) months following the date of notification. 

Comment (July): Add a statement that semi-annual testing satisfies the 6 month 

follow up requirement. 

Response: Disagree. The 6 month follow up requirement is applicable only to 

the areas with required annual testing in paragraph (b) (1). 

6-30-10 Version 

Page 7 of 10 
Comment (October): Replace “date of notification” with “end date of the half 

year during which the audit was performed”. 

Comment (October): Add “or the end date of the half year during which the 

audit was performed” as an alternative to “date of notification”. 

Response: Disagree. The half year concept as described by the commenter is 

difficult to define in a way that will be readily understood. Six months from 

notification provides sufficient time for performance of follow-up procedures, and 

for design and implementation of compliant procedures by management.

However, staff remains receptive to suggestions of the committee. 

 

Comment (October): Move (b) (3) to follow (b) (1). 

Response: Agree. (b)(2) then becomes (b) (3). 

(2) (3) In addition to the observation and examinations performed under paragraph (b)(1) 

of this section, follow-up observations and examinations shall be performed to verify that 

corrective action has been taken regarding all instances of noncompliance cited by 

internal audit, the independent accountant, and/or the Commission. The verification shall 

be performed within six (6) months following the date of notification. 

(3) (2) The following areas shall be reviewed at least semi-annually: 

Written Comment (March): If the intent of this section is the same as (1), then 

we ask then the NIGC ensure that the term “reviewed” is consistent with the term 

“audit”. If that is not the intent, then we ask the NIGC to clarify the purpose, 

scope and intent of the term “reviewed” in this section. 

Response: Although NIGC believes that the introductory sentence in (b) makes it 

clear that “audits” of the specified areas are required, in the interest of clarity, we 

agree to replace “reviewed” with “audited” in (b) (1) and (b) (3). 

Revised proposal as a result of written comment: 

(3) (2) The following areas shall be reviewed audited at least semi-annually: 

6-30-10 Version 

Page 8 of 10 
(i) Table games, including but not limited to, fill and credit procedures, table 

inventory forms, playing cards and dice, table game analysis, accounting/auditing,

marker credit, named credit instruments, call bets, and foreign currency; and

(ii) Gaming machines, including but not limited to, jackpot payout and gaming 

machine fills, promotional payouts, department funds, EPROM’s, theoretical and 

actual hold, hopper content standards, player tracking, in-house progressives, wide 

area progressives, accounting/auditing, cash-out tickets and account access cards. 

(4) Whenever possible, internal audit observations shall be performed on an unannounced 

basis (i.e., without the employees being forewarned that their activities will be observed). 

Additionally, if the independent accountant also performs the internal audit function, the 

accountant shall perform separate observations of the table games/gaming machine drops 

and counts to satisfy the internal audit observation requirements and independent 

accountant tests of controls as required by the American Institute of Certified Public 

Accountants guide. 

(c) Documentation. (1) Documentation (e.g., checklists, programs, reports, etc.) shall be 

prepared to evidence all internal audit work performed as it relates to the requirements in 

this section, including all instances of noncompliance. 

(2) The internal audit department shall operate with audit programs, which, at a 

minimum, address the MICS. Additionally, the department shall properly document the 

work performed, the conclusions reached, and the resolution of all exceptions. Institute 

of Internal Auditors standards are recommended but not required. 

6-30-10 Version 

Page 9 of 10 
(d) Reports. (1) Reports documenting audits performed shall be maintained and made 

available to the Commission upon request. 

(2) Such audit reports shall include the following information: 

(i) Audit objectives; 

(ii) Audit procedures and scope; 

(iii) Findings and conclusions; 

(iv) Recommendations, if applicable; and 

(v) Management's response. 

(e) Material exceptions. All material exceptions resulting from internal audit work shall 

be investigated and resolved with the results of such being documented and retained for 

five years. 

(f) Role of management. (1) Internal audit findings shall be reported to management. 

(2) Management shall be required to respond to internal audit findings stating corrective 

measures to be taken to avoid recurrence of the audit exception. 

(3) Such management responses shall be included in the internal audit report that will be 

delivered to management, the Tribe, Tribal gaming regulatory authority, audit committee, 

or other entity designated by the Tribe. 

(g) Internal Audit Guidelines. In connection with the internal audit testing pursuant to 

paragraph (b) (1) and (b) (3) of this section, the Commission shall develop recommended 

Internal Audit Guidelines, which shall be available upon request. 

6-30-10 Version 

Page 10 of 10