Bulletin No. 2018-3

Date: August 14, 2018

Subject: Guidance on the Class III Minimum Internal Control Standards

The purpose of this bulletin is to provide updated, non-binding Minimum Internal Control 

Standards (MICS) for Class III Gaming. Additional revisions are anticipated as the NIGC seeks 

to refine its regulations to keep pace with changes in the gaming industry; particularly those 

concerning technological advances.

The NIGC Class III MICS were promulgated in 1999 and last substantively revised in 2005. In 

2006, the D.C. Circuit Court of Appeals1 held that NIGC lacked authority to enforce or 

promulgate Class III MICS. Since that time, the Class III MICS have remained untouched. 

Technology has advanced rapidly, though, making some standards obsolete and introducing new 

areas of risk not contemplated by the outdated standards. And yet, tribal-state compacts—even 

those entered into since 2006—continue to adopt NIGC Class III MICS by reference. 

Recognizing the industry’s need for updated standards, the NIGC sought comment on whether to 

draft updated, non-binding guidance for Class III MICS, and what to do with the outdated 

standards still lingering in the regulations. Between 2015 and 2016, the Commission sought 

feedback from tribes and over forty tribes provided comment overwhelmingly supporting the 

NIGC proposal for non-binding guidance. In 2017, the Commission circulated draft guidance for 

tribal consultation and sent letters inviting comments from state gaming regulators. Over 20 

tribes and one state provided detailed comments on the guidance. 

In light of these comments the Commission has developed non-binding guidance for Class III 

MICS and suspended the existing 542 regulations. Doing so will leave the existing regulations 

 1 Colorado River Indian Tribes v. Nat'l Indian Gaming Comm'n, 466 F.3d 134 (D.C. Cir. 2006).
No. 2018-3 

Guidance on the Class III Minimum Internal Control Standards

Page | 2

“on the books,” but with an editorial note stating that they are not enforceable. This guidance is 

not intended to modify or amend any terms in a state compact.

Because the document will be guidance instead of regulations, NIGC will be able to keep it 

updated and adapt much more quickly to changes in the industry.

Although the guidance document is not a regulation requiring formal notice and comment, the 

Commission recognizes the value of tribal and public comment and offers a summary of 

comments and responses below.

Comments

Several commenters expressed concern over how and whether this new guidance might affect 

compact provisions, particularly in instances where the compact may conflict with the guidance.

Response: The Commission approached these updates with the same concerns and has 

done its best to follow the CRIT decision and maintain the spirit of the agreements 

reached by Tribes and States in their compacts. To that end, the Commission stresses that 

the following standards are non-binding guidance. 

Further, although the Commission believes that the guidance is written broadly enough to 

avoid conflict with tribal-state compacts, the tribal-state compact is the definitive 

authority on internal control standards for Class III gaming. Tribes are free to adopt any 

of the NIGC guidance they find useful, but the tribal-state compact must be followed in 

any conflicts. 

Some commenters also expressed concern over the degree to which this guidance will be applied 

when auditing a facility that offers both Class II and Class III gaming.

Response: Unless a tribe has agreed to be bound to NIGC’s Class III guidance standards, 

they do not apply—even if a tribe offers Class II gaming. Nevertheless, for those tribes 

who choose to adopt the guidance and have both Class II and III gaming, the Commission 

has minimized conflict by using the Class II regulations as a starting point for the Class 

III guidance. The Class III MICS cover only those areas not already addressed by the 

Class II MICS regulation.
No. 2018-3 

Guidance on the Class III Minimum Internal Control Standards

Page | 3

Several commenters pointed to language in their compacts that requires standards at least as 

stringent as those appearing in 25 C.F.R. part 542 and asked whether NIGC considers this 

guidance as stringent.

Response: The Commission does consider this new guidance as stringent as part 542, but 

notes that questions of compact interpretation should be resolved in the manner 

prescribed in the compact itself.

One commenter suggested eliminating the provision directing AUPs to be sent to NIGC.

Response: The Commission disagrees. These standards are guidance only, but NIGC 

welcomes the voluntary submission of AUP reports as an important tool for providing 

training and technical assistance. 

One commenter suggested that the provisions allowing for alternate standards be included in the 

Class III MICS; as they are for the Class II.

Response: The Commission understands the intent, particularly for Tribes who have 

agreed to be bound by the Class III MICS, but the Commission respects the ruling in 

CRIT and leaves any approvals of alternate standards to be worked out in the manner 

prescribed in the tribal-state compact.

Several commenters recommended use of a Tribal Advisory Committee (TAC) to create these 

guidelines.

Response: The Commission acknowledges that the Class III MICS are technical in nature 

and benefit from comments and advice from the experts conducting and regulating 

gaming on a daily basis. We have been and will remain open to receiving ongoing 

comments and recommendations regarding this non-binding guidance, including 

feedback from any tribal or industry created committees or working groups that wish to 

submit comments. In the opinion of the Commission, though, a TAC is not the best 

method to achieve the Commission’s goals for the Class III MICS. Agency experts 

drafted and thoroughly reviewed the MICS guidance. And, as we are discussing in this 

section, we sought out and considered comments from the industry, including state 

regulatory agencies working under a compact, on a draft version of the Class III MICS.

Those comments have been incorporated in many instances, further demonstrating the 

value the Commission places on industry feedback. Although the formality and 

procedural nature of a TAC may be appropriate in other instances, this on-going open 

dialogue between the NIGC and the industry is the best way to meet the Commission’s 
No. 2018-3 

Guidance on the Class III Minimum Internal Control Standards

Page | 4

goals of developing guidance that can be quickly adapted to the needs of an everchanging industry. 

 

Several commenters stressed the need for a definitions section. 

Response: The Commission agrees and has included one in the guidance.

Several commenters noted the use of “financial instrument storage component”, which is a term 

used for Class II gaming devices and requested it be changed to something that is strictly for 

Class III use.

Response: The Commission agrees that the Class II MICS (part 543) define financial 

instrument storage component (fisc) by specifically referencing its use in Class II 

gaming. The reference to Class II gaming in the Class II definition was made to avoid 

implying jurisdiction over Class III devices. In general, however, fisc is a broad term for 

a component that can be used with any class of gaming. For purposes of this guidance, 

fisc is defined generally with no reference to player interfaces. Therefore, the 

Commission believes the issue is resolved.

One state commenter recommended maintaining existing requirements for various standards (e.g.

3% variance threshold, software labeling, comp reporting, etc.).

Response: The Commission appreciates the state’s viewpoint. When the Commission 

revised the Class II MICS in 2012, it wrestled with the same questions of how stringent 

and detailed the standards should be. Ultimately, the Commission concluded that tribal 

gaming has become a mature industry with experienced regulators who have the expertise 

to set appropriate thresholds.

One commenter recommended raising the threshold requiring two agents to authorize and 

witness keno prize payouts from $1200 to $1500 to be consistent with IRS gaming tax law.

Response: The Commission has confirmed and agrees.

One commenter noted references to independent test labs in the Gaming Machines section and 

recommended a provision requiring tribes to create technical standards.

Response: The Commission agrees that without technical standards, the references to 

independent test lab certification are meaningless. Rather than require all tribes to create 
No. 2018-3 

Guidance on the Class III Minimum Internal Control Standards

Page | 5

Class III tech standards, the Commission added a note that test lab certification is 

required “if technical standards apply through tribal law or compact.” 

One commenter suggested adding standards to the Auditing Revenue Section for the following: 

Gaming promotions and player tracking; Complimentary services or items; Patron deposit 

accounts; Lines of credit; Cage, vault, cash, cash equivalents; and Inventory.

Response: Commission agrees and has done so.

One commenter suggested that not all discrepancies between the bill-in meter and the total bill 

acceptor drop need to be resolved (§ 13(d)(4)(iv) Auditing Revenue), only those that are greater 

than the TGRA determined variance.

Response: The Commission believes this is stated in §12(j) and understood in the 

Auditing Revenue section that follows.

One commenter suggested that language should be added to require cashiers to send invalidated 

vouchers to revenue audit if the validation system is not available prior to the end of the shift.

Response: The Commission recognizes that some casinos use other departments to 

process vouchers and declines to specify a department in the MICS. The TICS should 

include the specific procedures for validating vouchers after they are paid. 

Two commenters suggested revisions to the provisions requiring calculations of the theoretical 

hold percentage (§5(g)(2 & 3)).

Response: The Commission declines to revise the provisions, as they are consistent with 

industry standards.

One commenter suggested that the Surveillance section should include provisions for 

Progressive table games and coverage of the progressive table meters.

Response: The Commission agrees and has added the provisions.

Several commenters recommended reviving the term “Jackpot Payout” rather than trying to fit it 

into a more general “Prize payout” definition, more commonly used for Class II games.

Response: The Commission agrees and has made the change.
No. 2018-3 

Guidance on the Class III Minimum Internal Control Standards

Page | 6

One commenter recommended more stringent standards for accessing the circuit boards of 

gaming machines.

Response: The Commission has reconsidered and agrees that the more stringent standards 

are needed. Rather than complicate the matter by adding criteria for exceptions, the 

standard now requires the presence of a person independent of the gaming machines 

department to access any gaming machine circuit board, not just those with payouts 

above $100,000.

Several commenters made red-line edits to correct various typographical and organizational 

errors, including inadvertent references to Class II player interfaces.

Response: Although these comments are not identified individually, such feedback is 

invaluable to creating a clear usable product and the Commission greatly appreciates their 

time, effort, and attention to detail.

The Commission thanks everyone who took the time to provide comments on this 

complex and ever-changing subject matter. 

The Commission understands that this industry is always changing, both in its technology 

and the types of gaming being offered. Going forward, the Commission expects the guidance 

will need regular updates and adjustments. Many have already inquired about guidance for 

sportsbook and internet gaming and the Commission anticipates updates in those areas as they 

take shape in law and the industry. Please send any comments or suggestions on updating and 

adjusting the guidance to info@nigc.gov with “Class III Guidance” in the subject line. In 

addition to regular review of the email comments, the Commission expects to host annual 

listening sessions to address concerns and needs for future updates. 

Internally, the Commission is committed to keeping its staff up to date on current 

guidance standards so that they continue to provide valuable assistance as tribes consider 

implementing these changes.

If you have any questions or concerns about how the guidance may be applied to a 

particular gaming operation, please contact your nearest NIGC Region Office.
Class III Minimum Internal Controls Guidance

Page 1 of 81

2018

§1. What are the definitions for this part?

§2. What are the minimum internal control standards for keno?

§3. What are the minimum internal control standards for pari-mutuel wagering?

§4. What are the minimum internal control standards for table games?

§5. What are the minimum internal control standards for gaming machines?

§6. What are the minimum internal control standards for gaming promotions and player tracking 

systems?

§7. What are the minimum internal control standards for complimentary services or items?

§8. What are the minimum internal control standards for patron deposit accounts and cashless 

systems?

§9. What are the minimum internal control standards for lines of credit?

§10. What are the minimum internal control standards for the cage, vault, kiosk, cash and cash 

equivalents?

§11. What are the minimum internal control standards for information technology and information 

technology data?

§12. What are the minimum internal control standards for drop and count?

§13. What are the minimum internal control standards for auditing revenue?

§14. What are the minimum internal control standards for audit and accounting?

§15. What are the minimum internal control standards for surveillance?

§16. What are the minimum internal control standards for controlled keys?
Class III Minimum Internal Controls Guidance

Page 2 of 81

2018

§1. What are the definitions for this part? 

The definitions in this section apply to all sections of this part unless otherwise noted. 

Account access card. An instrument used to access customer accounts for wagering at a gaming 

machine. Account access cards are used in connection with a computerized account database. Account 

access cards are not “smart cards”. 

Accountability. All financial instruments, receivables, and patron deposits constituting the total amount 

for which the bankroll custodian is responsible at a given time. 

Actual hold percentage. The percentage calculated by dividing the win by the drop or coin-in (number of 

credits wagered). Can be calculated for individual tables or gaming machines, type of table games, or 

gaming machines on a per day or cumulative basis.

Agent. A person authorized by the gaming operation, as approved by the TGRA, to make decisions or 

perform assigned tasks or actions on behalf of the gaming operation.

Automated payout. A payment issued by a machine.

Betting station. The area designated in a pari-mutuel area that accepts wagers and pays winning bets.

Betting ticket. A printed, serially numbered form used to record the event upon which a wager is made, 

the amount and date of the wager, and sometimes the line or spread (odds).

Bill acceptor. The device that accepts and reads cash by denomination in order to accurately register 

customer credits.

Bill acceptor canister. The box attached to the bill acceptor used to contain cash received by bill 

acceptors.

Bill acceptor canister content key. The key used to open the bill acceptor canisters.

Bill acceptor canister release key. The key used to release the bill acceptor canister from the bill 

acceptor device.

Bill acceptor drop. Cash contained in bill acceptor canisters.

Bill-in meter. A meter included on a gaming machine accepting cash that tracks the number of bills put 

in the machine.

Boxperson. The first-level supervisor who is responsible for directly participating in and supervising the 

operation and conduct of a craps game.
Class III Minimum Internal Controls Guidance

Page 3 of 81

2018

Breakage. The difference between actual bet amounts paid out by a racetrack to bettors and amounts 

won due to bet payments being rounded up or down. For example, a winning bet that should pay $4.25 

may be actually paid at $4.20 due to rounding.

Cage. A secure work area within the gaming operation for cashiers, which may include a storage area for 

the gaming operation bankroll. 

Cage accountability form. An itemized list of the components that make up the cage accountability.

Call bets. A wager made without cash or chips, reserved for a known customer and includes marked bets 

(which are supplemental bets made during a hand of play). For the purpose of settling a call bet, a hand 

of play in craps is defined as a natural winner (e.g., seven or eleven on the come-out roll), a natural loser 

(e.g., a two, three or twelve on the come-out roll), a seven-out, or the player making his point, 

whichever comes first.

Cash equivalents. Documents, financial instruments other than cash, or anything else of representative 

value to which the gaming operation has assigned a monetary value. A cash equivalent includes, but is 

not limited to, tokens, chips, coupons, vouchers, payout slips and tickets, and other items to which a 

gaming operation has assigned an exchange value.

Cashless system. A system that performs cashless transactions and maintains records of those cashless 

transactions.

Cashless transaction. A movement of funds electronically from one component to another, such as to or 

from a patron deposit account.

Chips. Cash substitutes, in various denominations, issued by a gaming operation and used for wagering.

Coin-in meter. The meter that displays the total amount wagered in a gaming machine that includes 

coins-in and credits played.

Coin room. An area where coins and tokens are stored.

Commission. The National Indian Gaming Commission.

Complimentary services and items. Services and items provided to a patron at the discretion of an agent 

on behalf of the gaming operation or by a third party on behalf of the gaming operation. Services and 

items may include, but are not limited to, travel, lodging, food, beverages, or entertainment expenses. 

Count. The act of counting and recording the drop and/or other funds. Also, the total funds counted for 

a particular game, player interface, shift, or other period.

Count room. A secured room where the count is performed in which the cash and cash equivalents are

counted. 
Class III Minimum Internal Controls Guidance

Page 4 of 81

2018

Count team. Personnel that perform either the count of the gaming machine drop and/or the table 

game drop.

Counter check. A form provided by the gaming operation for the customer to use in lieu of a personal 

check.

Coupon. A financial instrument of fixed wagering value that can only be used to acquire non-cashable 

credits through interaction with a voucher system. This does not include instruments such as printed 

advertising material that cannot be validated directly by a voucher system.

Credit. The right granted by a gaming operation to a customer to defer payment of debt or to incur debt 

and defer its payment.

Credit limit. The maximum dollar amount of credit assigned to a customer by the gaming operation.

Credit slip. A form used to record either:

(1) The return of chips from a gaming table to the cage; or

(2) The transfer of IOUs, markers, or negotiable checks from a gaming table to a cage or bankroll.

Dealer. An employee who operates a game, individually or as a part of a crew, administering house rules 

and making payoffs.

Dedicated camera. A video camera that continuously records a specific activity. 

Deskman. A person who authorizes payment of winning tickets and verifies payouts for keno games.

Draw ticket. A blank keno ticket whose numbers are punched out when balls are drawn for the game 

that is used to verify winning tickets.

Drop (for gaming machines). The total amount of cash, cash-out tickets, coupons, coins, and tokens 

removed from drop buckets and/or bill acceptor canisters.

Drop (for table games). The total amount of cash, chips, and tokens removed from drop boxes, plus the 

amount of credit issued at the tables.

Drop box. A locked container affixed to the gaming table into which the drop is placed. The game type, 

table number, and shift are indicated on the box.

Drop box contents keys. The key used to open drop boxes.

Drop box release keys. The key used to release drop boxes from tables.
Class III Minimum Internal Controls Guidance

Page 5 of 81

2018

Drop cabinet. The wooden or metal base of the gaming machine that contains the gaming machine drop 

bucket.

Drop period. The period of time that occurs between sequential drops.

Drop proceeds. The total amount of financial instruments removed from drop boxes and bill acceptor 

canisters. 

Earned and unearned take. Race bets taken on present and future race events. Earned take means bets 

received on current or present events. Unearned take means bets taken on future race events.

Exception report. A listing of occurrences, transactions or items that fall outside a predetermined range 

of acceptability.

Financial Accounting Standards Board (FASB). Generally accepted accounting principles used by private 

and for-profit corporations that are not considered governmental entities. See GASB below for tribal 

governmental entities. 

Fill. A transaction whereby a supply of chips, coins, or tokens is transferred from a bankroll to a table 

game or gaming machine.

Fill slip. A document evidencing a fill.

Financial instrument. Any tangible item of value tendered in game play, including, but not limited to 

bills, coins, vouchers, and coupons.

Financial instrument storage component. Any component that stores financial instruments, such as a 

drop box.

Future wagers. Bets on races to be run in the future (e.g., Kentucky Derby).

Gaming machine. An electronic or electromechanical machine that allows a player to play games of 

chance, some of which may be affected by skill, which contains a microprocessor with random number 

generator capability for outcome selection or computer terminal that accesses an outcome that is 

subsequently and randomly selected in drawings that are electronically conducted by central computer 

or other such methods of chance selection, whether mechanical or electronic. The machine is activated 

by the insertion of cash or cash equivalents and which awards cash, cash equivalents, merchandise, or a 

written statement of the player's accumulated credits, which written statements may be redeemable for 

cash. 

Gaming machine analysis report. A report prepared that compares theoretical to actual hold by a 

gaming machine on a monthly or other periodic basis.
Class III Minimum Internal Controls Guidance

Page 6 of 81

2018

Gaming machine booths and change banks. A booth or small cage in the gaming machine area used to 

provide change to players, store change aprons and extra coin, and account for jackpot and other 

payouts.

Gaming promotion. Any promotional activity or award that requires game play as a condition of 

eligibility.

Generally Accepted Accounting Principles (GAAP). A widely accepted set of rules, conventions, 

standards, and procedures for reporting financial information, as established by the Financial 

Accounting Standards Board (FASB), including, but not limited to, the standards for casino accounting 

published by the American Institute of Certified Public Accountants (AICPA).

Generally Accepted Auditing Standards (GAAS). A widely accepted set of standards that provide a 

measure of audit quality and the objectives to be achieved in an audit, as established by the Auditing 

Standards Board of the American Institute of Certified Public Accountants (AICPA).

Governmental Accounting Standards Board (GASB). Generally accepted accounting principles used by 

state and local governments.

Gross gaming revenue. The win from gaming activities, which is the difference between gaming wins and 

losses before deducting costs and expenses (See Win). Annual total amount of cash wagered on class II 

and class III games and admission fees (including table or card fees), less any amounts paid out as prizes 

or paid for prizes awarded.

Hold. The relationship of win to coin-in for gaming machines and win to drop for table games.

Hub. The person or entity that is licensed to provide the operator of a pari-mutuel wagering operation 

information related to horse racing that is used to determine winners of races or payoffs on wagers 

accepted by the pari-mutuel wagering operation.

Independent. The separation of functions to ensure that the agent or process monitoring, reviewing, or 

authorizing the controlled activity, function, or transaction is separate from the agents or process 

performing the controlled activity, function, or transaction.

Internal audit. Persons who perform an audit function of a gaming operation that are independent of 

the department subject to audit. Independence is obtained through the organizational reporting 

relationship, as the internal audit department shall not report to management of the gaming operation. 

Internal audit activities should be conducted in a manner that permits objective evaluation of areas 

examined. Internal audit personnel may provide audit coverage to more than one operation within a 

Tribe's gaming operation holdings.

Issue slip. A copy of a credit instrument that is retained for numerical sequence control purposes.
Class III Minimum Internal Controls Guidance

Page 7 of 81

2018

Jackpot prize payout. The portion of a jackpot paid by gaming machine personnel. The amount is usually 

determined as the difference between the total posted jackpot amount and the amount paid out by the 

machine. May also be the total amount of the jackpot.

Kiosk. A device capable of redeeming vouchers and/or wagering credits or initiating electronic transfers 

of money to or from a patron deposit account.

Lammer button. A type of chip that is placed on a gaming table to indicate that the amount of chips 

designated thereon has been given to the customer for wagering on credit before completion of the 

credit instrument. Lammer button may also mean a type of chip used to evidence transfers between 

table banks and card room banks.

Lines of credit. The privilege granted by a gaming operation to a patron to:

(1) Defer payment of debt; or 

(2) Incur debt and defer its payment under specific terms and conditions.

Manual payout. Any non-automated payout.

Marker. A document, signed by the customer, evidencing an extension of credit to him by the gaming 

operation.

Marker transfer form. A form used to document transfers of markers from the pit to the cage.

Master game program. The game program number listed on a gaming machine EPROM.

Master game sheet. A form used to record, by shift and day, each table game's winnings and losses. This 

form reflects the opening and closing table inventories, the fills and credits, and the drop and win.

Meter. An electronic (soft) or mechanical (hard) apparatus in a gaming machine. May record the 

number of coins wagered, the number of coins dropped, the number of times the handle was pulled, or 

the number of coins paid out to winning players.

MICS. Minimum internal control standards. 

Motion activated dedicated camera. A video camera that, upon its detection of activity or motion in a 

specific area, begins to record the activity or area.

Multi-game machine. A gaming machine that includes more than one type of game option.

Multi-race ticket. A keno ticket that is played in multiple games.
Class III Minimum Internal Controls Guidance

Page 8 of 81

2018

Network communication equipment. A device or collection of devices that controls data communication 

in a system including, but not limited to, cables, switches, hubs, routers, wireless access points, landline 

telephones and cellular telephones.

On-line gaming machine monitoring system. A system used by a gaming operation to monitor gaming 

machine meter readings and/or other activities on an on-line basis.

Order for credit. A form that is used to request the transfer of chips or markers from a table to the cage. 

The order precedes the actual transfer transaction that is documented on a credit slip.

Par percentage. The percentage of each dollar wagered that the house wins (i.e., gaming operation 

advantage).

Par sheet. A specification sheet for a gaming machine that provides machine hold percentage, model 

number, hit frequency, reel combination, number of reels, number of coins that can be accepted, and 

reel strip listing.

Pari-mutuel wagering. A system of wagering on horse races, jai-alai, greyhound, and harness racing, 

where the winners divide the total amount wagered, net of commissions and operating expenses, 

proportionate to the individual amount wagered.

Patron. A person who is a customer or guest of the gaming operation and may interact with a Class III 

game. Also may be referred to as a “player.”

Patron deposit account. An account maintained on behalf of a patron, for the deposit and withdrawal of 

funds for the primary purpose of interacting with a gaming activity.

Payment slip. Part of a marker form on which customer payments are recorded.

Prize payout. A payment to a player associated with a winning or qualifying event.

PIN. The personal identification number used to access a patron deposit account. 

Pit podium. A stand located in the middle of the tables used by gaming operation supervisory personnel 

as a workspace and a record storage area.

Pit supervisor. The employee who supervises all games in a pit.

Player tracking system A system typically used in gaming machine departments that can record the 

gaming machine play of individual customers.

Post time. The time when a pari-mutuel track stops accepting bets in accordance with rules and 

regulations of the applicable jurisdiction.
Class III Minimum Internal Controls Guidance

Page 9 of 81

2018

Progressive gaming machine A gaming machine, with a payoff indicator, in which the payoff increases as 

it is played (i.e., deferred payout). The payoff amount is accumulated, displayed on a machine, and will 

remain until a player lines up the jackpot symbols that result in the progressive amount being paid.

Progressive jackpot The deferred payout from a progressive gaming machine.

Progressive table game. Table games that offer progressive jackpots.

Promotional payout. Merchandise or awards given to players by the gaming operation based on a 

wagering activity.

Rabbit ears. A device, generally V-shaped, that holds the numbered balls selected during a keno or bingo 

game so that the numbers are visible to players and employees.

Random number generator. A device that generates numbers in the absence of a pattern. May be used 

to determine numbers selected in various games such as keno and bingo. Also commonly used in 

gaming machines to generate game outcome.

Reel symbols. The symbols listed on reel strips of gaming machines.

Rim credit. Extensions of credit that are not evidenced by the immediate preparation of a marker and 

does not include call bets.

Runner. A gaming employee who transports chips/cash to or from a gaming table and a cashier.

Shift. An eight-hour period, unless otherwise approved by the Tribal gaming regulatory authority, not to 

exceed twenty-four (24) hours.

Smart card. A card with embedded integrated circuits that possesses the means to electronically store or 

retrieve account data.

Soft count. The count of the contents in a drop box or a bill acceptor canister.

Statistical drop. The total amount of money, chips and tokens contained in the drop boxes, plus pit

credit issued, minus pit credit payments in cash in the pit. 

Statistical win. The closing bankroll, plus credit slips for cash, chips or tokens returned to the cage, plus 

drop, minus opening bankroll, minus fills to the table, plus marker credits. 

Storage rack keys. The key used to access the storage rack where drop boxes and bill acceptors are 

secured.

Sufficient clarity. The capacity of a surveillance system to record images at a minimum of 20 frames per 

second or equivalent recording speed and at a resolution sufficient to clearly identify the intended 

activity, person, object, or location. 
Class III Minimum Internal Controls Guidance

Page 10 of 81

2018

Surveillance operation room(s). The secured area(s) where surveillance takes place and/or where active 

surveillance equipment is located. 

Surveillance system. A system of video cameras, monitors, recorders, video printers, switches, selectors, 

and other equipment used for surveillance.

SICS (System of Internal Control Standards). An overall operational framework for a gaming operation 

that incorporates principles of independence and segregation of function, and is comprised of written 

policies, procedures, and standard practices based on overarching regulatory standards specifically 

designed to create a system of checks and balances to safeguard the integrity of a gaming operation and 

protect its assets from unauthorized access, misappropriation, forgery, theft, or fraud.

Table games. Games that are banked by the house or a pool whereby the house or the pool pays all 

winning bets and collects from all losing bets.

Table inventory. The total coins, chips, and markers at a table.

Table inventory form. The form used by gaming operation supervisory personnel to document the 

inventory of chips, coins, and tokens on a table at the beginning and ending of a shift.

Table tray. The container located on gaming tables where chips, coins, or cash are stored that are used 

in the game.

Take. The same as earned and unearned take.

Theoretical hold. The intended hold percentage or win of an individual gaming machine as computed by 

reference to its payout schedule and reel strip settings or EPROM.

Theoretical hold worksheet. A worksheet provided by the manufacturer for all gaming machines that 

indicate the theoretical percentages that the gaming machine should hold based on adequate levels of 

coin-in. The worksheet also indicates the reel strip settings, number of credits that may be played, the 

payout schedule, the number of reels and other information descriptive of the particular type of gaming 

machine.

Tier A. Gaming operations with annual gross gaming revenues of more than $3 million but not more 

than $8 million.

Tier B. Gaming operations with annual gross gaming revenues of more than $8 million but not more 

than $15 million.

Tier C. Gaming operations with annual gross gaming revenues of more than $15 million.

Tokens. A coin-like cash substitute, in various denominations, used for gambling transactions.
Class III Minimum Internal Controls Guidance

Page 11 of 81

2018

Tribal gaming regulatory authority. Tribal gaming regulatory authority, which is the entity authorized by 

tribal law to regulate gaming conducted pursuant to the Indian Gaming Regulatory Act. 

TICS. Tribal Internal Control Standards established by the TGRA that are at least as stringent as the 

standards set forth in this part.

Vault. A secure area where cash and cash equivalents are stored.

Voucher. A financial instrument of fixed wagering value, usually paper, that can be used only to acquire 

an equivalent value of cashable credits or cash through interaction with a voucher system.

Voucher system. A system that securely maintains records of vouchers and coupons; validates payment 

of vouchers; records successful or failed payments of vouchers and coupons; and controls the purging of 

expired vouchers and coupons.

Weigh scale interface. A communication device between the weigh scale used to calculate the amount 

of funds included in drop buckets and the computer system used to record the weigh data.

Wide area progressive gaming machine. A progressive gaming machine that is linked to machines in 

other operations and play on the machines affect the progressive amount. As wagers are placed, the 

progressive meters on all of the linked machines increase.

Win. The win from gaming activities, which is the difference between gaming wins and losses before 

deducting costs and expenses (see Gross Gaming Revenue).

Win-to-write hold percentage. The win divided by write to determine hold percentage.

Wrap. The method of storing coins after the count process has been completed, including, but not 

limited to, wrapping, racking, or bagging. May also refer to the total amount or value of the counted 

and stored coins.

Write. The total amount wagered in keno, bingo, pull tabs, and pari-mutuel operations.

Writer. An employee who writes keno, bingo, pull tabs, or pari-mutuel tickets. A keno writer usually also 

makes payouts.
Class III Minimum Internal Controls Guidance

Page 12 of 81

2018

§2. What are the minimum internal control standards for keno?

(a) Supervision. Supervision must be provided as needed for keno operations by an agent(s) with 

authority equal to or greater than those being supervised. 

(b) Game play standards. 

(1) The computerized customer ticket must include the date, game number, ticket sequence 

number, station number or writer identification number, and conditioning (including multi-race 

if applicable). 

(2) Concurrently with the generation of the ticket the information on the ticket must be 

recorded in a manner that restricts access. 

(3) Keno personnel must be precluded from having access to the restricted ticket information. 

(4) When it is necessary to void a ticket, the void information must be entered into the 

computer and the computer must document the appropriate information pertaining to the 

voided wager (e.g., void slip is issued or equivalent documentation is generated). 

(5) Controls must exist to prevent the writing and voiding of tickets after a game has been 

closed and after the number selection process for that game has begun. 

(6) The controls in effect for tickets prepared in areas other than the main keno area where bets 

may be placed and tickets paid must be identical to those in effect for the primary keno game. 

(c) Rabbit ear or wheel system. The following standards must apply if a rabbit ear or wheel system is 

utilized: 

1) Before and after the game, the following must be monitored by a dedicated camera: 

(i) Empty rabbit ears or wheel; 

(ii) Date and time; 

(iii) Game number; and 

(iv) Full rabbit ears or wheel. 

(2) The recording of the rabbit ears or wheel must provide a legible identification of the 

numbers on the balls drawn.

(3) Keno agents must immediately input the numbers on the balls drawn in the computer and 

the computer must document the date, the game number, the time the game was closed, and 

the numbers drawn. 
Class III Minimum Internal Controls Guidance

Page 13 of 81

2018

(4) Controls must be established and procedures implemented that prevent unauthorized access 

to keno balls in play. 

(5) Back-up keno ball inventories must be secured in a manner to prevent unauthorized access. 

(6) Controls must be established and procedures implemented to ensure that all eligible objects 

used in the conduct of the keno game are available to be drawn and have not been damaged or 

altered. Verification of physical objects must be performed by two agents before the start of the 

first keno game/session. At least one of the verifying agents must be a supervisory agent or 

independent of the keno games department.

(d) Random number generator. If a random number generator is utilized, controls must be established 

and procedures implemented that require the following: 

(1) The numbers selected by the random number generator must be directly relayed to, and 

automatically recorded in, the keno computer system. 

(2) Keno agents must be precluded from access to the random number generator. 

(e) Prize payout.

(1) Controls must be established and procedures implemented that address the following:

(i) Identification of the agent authorized (by position) to make a payout;

(ii) Predetermined payout authorization levels (by position); 

(iii) Documentation procedures ensuring separate control of the cash accountability 

functions; 

(iv) The sequence number of tickets presented for payment must be entered into the 

computer, and the payment amount generated by the computer must be given to the 

customer.

(v)Preclusion of payment of tickets previously presented for payment;

(vi) Unclaimed winning tickets (sleepers) after a specified period of time; 

(vii) Voided tickets; and 

(viii) Tickets that have not been issued yet. 

(ix) All payouts must be supported by the customer (computer-generated) copy of the 

winning ticket (payout amount is indicated on the customer ticket or a payment slip is 

issued). 
Class III Minimum Internal Controls Guidance

Page 14 of 81

2018

(x) A manual report or other documentation must be produced and maintained 

documenting any payments made on tickets that are not authorized by the computer. 

(2) Prize payouts over a specified dollar amount, not to exceed $10,000 or a lower threshold as 

authorized by management and approved by the TGRA, must also require the following: 

(i) Approval of management personnel independent of the keno department, evidenced 

by their signature; 

(ii) Review of the video recording and/or digital record of the rabbit ears or wheel to 

verify the legitimacy of the draw and the accuracy of the draw ticket (for rabbit ear or 

wheel systems only); 

(iii) Comparison of the winning customer copy to the computer reports; 

(iv) Regrading of the customer copy using the payout schedule and draw information; 

and 

(v) Documentation and maintenance of the performance of the procedures in this 

paragraph. 

(3) Authorization and signatures. 

(i) At least two agents must authorize, sign, and witness prize payouts above $1,500 or 

a lower threshold as authorized by management and approved by the TGRA.

(ii) Prize payouts above the following threshold, or a lower threshold, as authorized by 

management and approved by TGRA, must require one of the two signatures and 

verifications to be a supervisory or management employee independent of the keno 

operation:

(A) $5,000 for a Tier A facility;

(B) $10,000 at a Tier B facility;

(C) $20,000 for a Tier C facility; or

(D) $50,000 for a Tier C facility with over $100,000,000 in gross gaming 

revenues.

(iii) The predetermined thresholds, whether set at the MICS level or lower, must be 

authorized by management, approved by the TGRA, documented, and maintained.

(f) For each agent station, a cash summary report (count sheet) at the end of each keno shift must be 

prepared that includes: 
Class III Minimum Internal Controls Guidance

Page 15 of 81

2018

(1) Computation of net cash proceeds for the shift and the cash turned in, and any variances 

between the cash turn-in and the amount of net cash that the computer system indicates 

should be in each agent station; and 

(2) Signatures of two agents who have verified the net cash proceeds for the shift and the cash 

turned in. 

(g) Cash and cash equivalent controls. 

(1) Cash or cash equivalents exchanged between two persons must be counted independently 

by at least two agents and reconciled to the recorded amounts at the end of each shift or 

session. Unexplained variances must be documented and maintained. Unverified transfers of 

cash or cash equivalents are prohibited.

(2) Procedures must be implemented to control cash or cash equivalents based on the amount 

of the transaction. These procedures must include documentation by shift, session, or other 

relevant time period of the following:

(i) Inventory, including any increases or decreases;

(ii) Transfers;

(iii) Exchanges, including acknowledging signatures or initials; and

(iv) Resulting variances.

(3) Any change to control of accountability, exchange, or transfer requires that the cash or cash 

equivalents be counted and recorded independently by at least two agents and reconciled to 

the recorded amount.

(h) Promotional payouts or awards. If a gaming operation offers promotional payouts or awards, the 

payout form/documentation must include the following information: 

(1) Date and time; 

(2) Dollar amount of payout or description of personal property (e.g., jacket, toaster, car, etc.), 

including fair market value; 

(3) Type of promotion; and 

(4) Signature of at least one employee authorizing and completing the transaction. 

(i) Standards for statistical reports. 

(1) Records must be maintained that include win and write by individual writer for each day. 
Class III Minimum Internal Controls Guidance

Page 16 of 81

2018

(2) Records must be maintained for each keno game operated and the total for all keno games 

operated that include win, write, and win-to-write hold percentage for the following: 

(i) Each shift; 

(ii) Each day; 

(iii) Month-to-date; and 

(iv) Year-to-date or fiscal year-to-date as applicable. 

(3) A manager independent of the keno department must review keno statistical data at least on 

a monthly basis and investigate any large or unusual statistical variances. 

(4) At a minimum, investigations must be performed for statistical percentage fluctuations from 

the base level for a month at thresholds established by management and approved by the 

TGRA. The base level must be defined as the gaming operation's win percentage for the 

previous business year or the previous twelve (12) months. 

(5) Such investigations must be documented, maintained for inspection, and provided to the 

Tribal gaming regulatory authority upon request. 

(j) Documentation standards. 

(1) The computer system must generate adequate documentation of all pertinent keno 

information, to include the following:

(i) Ticket information (as described in paragraph (b)(1) of this section); 

(ii) Payout information (e.g., date, time, ticket number, amount, etc.); 

(iii) Game information (e.g., number, ball draw, time, etc.); 

(iv) Daily recap information, including: 

(A) Write; 

(B) Payouts; and 

(C) Gross revenue (win); 

(v) System exception information, including: 

(A) Voids; 

(B) Late pays; and 
Class III Minimum Internal Controls Guidance

Page 17 of 81

2018

(C) Appropriate system parameter information (e.g., changes in pay tables, ball 

draws, payouts over a predetermined amount, etc.); and 

(vi) Agent access listing, including: 

(A) Agent name or agent identification number; and 

(B) Listing of functions agent can perform or equivalent means of identifying 

same. 

(2) This documentation must be restricted to authorized agents. 

(k) Equipment standards. 

(1) There must be effective maintenance planned to service keno equipment, including 

computer program updates, hardware servicing, and keno ball selection equipment (e.g., service 

contract with lessor). 

(2) Keno equipment maintenance (excluding keno balls) must be independent of the operation 

of the keno game. 

(3) Keno maintenance agents must report irregularities to management independent of the 

keno department. 

(4) If the gaming operation utilizes a barcode or microchip reader in connection with the play of 

keno, the reader must be tested at least annually by agents independent of the keno 

department to determine that it is correctly reading the barcode or microchip. 

(l) Document retention. 

(1) All documents (including computer storage media) discussed in this section must be retained 

for five (5) years, except for the following, which must be retained for at least seven (7) days: 

(i) Video recordings and/or digital records of rabbit ears or wheel;

(ii) All copies of winning keno tickets of less than $1,500.00. 

(m) Multi-race tickets. 

(1) Procedures must be established to notify keno agents immediately of large multi-race 

winners. 

(2) Procedures must be established to ensure that keno agents are aware of multi-race tickets 

still in process at the end of a shift. 
Class III Minimum Internal Controls Guidance

Page 18 of 81

2018

(n) All relevant controls from § 11, Information and Technology will apply.

(o) Revenue Audit. Standards for revenue audit of keno are contained in § 13, Revenue Audit. 

(p) Variance. The operation must establish, as approved by the TGRA, the threshold level at which a 

variance must be reviewed to determine the cause. Any such review must be documented.

§3. What are the minimum internal control standards for pari-mutuel wagering?

(a) Supervision. Supervision must be provided as needed for pari-mutuel operations by an agent(s) with 

authority equal to or greater than those being supervised. 

(b) Betting ticket and equipment standards. 

(1) All pari-mutuel wagers must be transacted through the pari-mutuel satellite system. In case 

of computer failure between the pari-mutuel book and the hub, no tickets must be manually 

written. 

(2) Whenever a betting station is opened for wagering or turned over to a new agent, the agent 

must sign on and the computer must document gaming operation name (or identification 

number), station number, the agent identifier, and the date and time. 

(3) A betting ticket must consist of at least two parts: 

(i) An original, which must be transacted and issued through a printer and given to the 

customer; and 

(ii) A copy that must be recorded concurrently with the generation of the original ticket.

(4) Upon accepting a wager, the betting ticket that is created must contain the following: 

(i) A unique transaction identifier; 

(ii) Gaming operation name (or identification number) and station number; 

(iii) Race track, race number, horse identification or event identification, as applicable; 

(iv) Type of bet(s), each bet amount, total number of bets, and total take; and 

(v) Date and time. 

(5) All tickets must be considered final at post time. 

(6) If a gaming operation voids a betting ticket written prior to post time, it must be immediately 

entered into the system. 
Class III Minimum Internal Controls Guidance

Page 19 of 81

2018

(7) Future wagers must be accepted and processed in the same manner as regular wagers. 

(8) The gaming operation must be prohibited from the following;

(i) Accepting from a patron less than full face value of a pari-mutuel wager;

(ii) Agreeing to refund or rebate to a patron any portion or percentage of the value of a 

pari-mutuel wager after post time; or

(iii) Increasing the payoff of, or pay a bonus on, a winning pari-mutuel wager.

(c) Payout standards. 

(1) Prior to making payment on a ticket, the agent must input the ticket for verification and 

payment authorization. 

(2) The computer must be incapable of authorizing payment on a ticket that has been previously 

paid, a voided ticket, a losing ticket, or an unissued ticket. 

(d) Checkout standards. 

(1) Whenever the betting station is closed or the agent is replaced, the agent must sign off and 

the computer must document the gaming operation name (or identification number), station 

number, the agent identifier, the date and time, and cash balance. 

(2) For each agent station a summary report must be completed at the conclusion of each shift 

including: 

(i) Computation of cash turned in for the shift; and 

(ii) Signature of two agents who have independently verified the cash turned in for the 

shift. Unverified transfers of cash and/or cash equivalents are prohibited.

(e) Computer reports standards. 

(1) Adequate documentation of all pertinent pari-mutuel information must be generated by the 

computer system for each day's operation. 

(2) This documentation must be restricted to authorized agents. 

(3) The documentation must include, but is not limited to the following: 

(i) Unique transaction identifier; 

(ii) Date/time of transaction; 
Class III Minimum Internal Controls Guidance

Page 20 of 81

2018

(iii) Type of wager; 

(iv) Animal identification or event identification; 

(v) Amount of wagers (by ticket, agent/kiosk, track/event, and total); 

(vi) Amount of payouts (by ticket, agent/kiosk, track/event, and total); 

(vii) Tickets refunded (by ticket, agent, track/event, and total); 

(viii) Unpaid winners/vouchers (“outs”) (by ticket/voucher, track/event, and total); 

(ix) Voucher sales/payments (by ticket, agent/kiosk, and track/event); 

(x) Voids (by ticket, agent, and total); 

(xi) Future wagers (by ticket, date of event, total by day, and total at the time of revenue 

recognition); 

(xii) Results (winners and payout data); 

(xiii) Breakage data (by race and track/event); 

(xiv) Commission data (by race and track/event); and 

(xv) Purged data (by ticket and total). 

(4) The system must generate the following reports: 

(i) A reconciliation report that summarizes totals by track/event, including write, the 

day's winning ticket total, total commission and breakage due the gaming operation, 

and net funds transferred to or from the gaming operation's bank account; 

(ii) An exception report that contains a listing of all system functions and overrides not 

involved in the actual writing or cashing of tickets, including sign-on/off, voids, and 

manually input paid tickets; and 

(iii) A purged ticket report that contains a listing of the unique transaction identifier(s), 

description, ticket cost and value, and date purged. 

(f) All relevant controls from § 11, Information and Technology will apply.

(g) Revenue Audit. Standards for revenue audit of pari-mutuel wagering are contained in §13, Auditing 

Revenue. 
Class III Minimum Internal Controls Guidance

Page 21 of 81

2018

(h) Variance. The operation must establish, as approved by the TGRA, the threshold level at which a 

variance must be reviewed to determine the cause. Any such review must be documented.

§4. What are the minimum internal control standards for table games?

(a) Supervision. Supervision must be provided as needed for table games operations by an agent(s) with 

authority equal to or greater than those being supervised.

(b) Fill and credit standards. 

(1) Fill slips and credit slips must be in at least triplicate form, and in a continuous, prenumbered series. Such slips must be concurrently numbered in a form utilizing the alphabet and 

only in one series at a time. The alphabet need not be used if the numerical series is not 

repeated during the business year. 

(2) Unissued and issued fill/credit slips must be safeguarded and adequate procedures must be 

employed in their distribution, use, and control. Agents from the cashier or pit departments 

must have no access to the secured (control) copies of the fill/credit slips. 

(3) When a fill/credit slip is voided, the cashier agent must clearly mark “void” across the face of 

the original and first copy, the cashier and one other agent independent of the transactions

must sign both the original and first copy, and must submit them to the accounting department 

for retention and accountability. 

(4) Fill transactions must be authorized by pit supervisory agents before the issuance of fill slips 

and transfer of chips, tokens, or cash equivalents. The fill request must be communicated to the 

cage where the fill slip is prepared. 

(5) At least three parts of each fill slip must be utilized as follows: 

(i) One part must be transported to the pit with the fill and, after the appropriate 

signatures are obtained, deposited in the table game drop box; 

(ii) One part must be retained in the cage for reconciliation of the cashier bank; and 

(iii) For computer systems, one part must be retained in a secure manner to insure that 

only authorized agents may gain access to it. For manual systems, one part must be 

retained in a secure manner in a continuous unbroken form. 

(6) The table number, shift, and amount of fill by denomination and in total must be noted on all 

copies of the fill slip. The correct date and time must be indicated on at least two copies. 

(7) All fills must be carried from the cashier's cage by an agent who is independent of the cage 

or pit. 
Class III Minimum Internal Controls Guidance

Page 22 of 81

2018

(8) The fill slip must be signed by at least the following agents (as an indication that each has 

counted the amount of the fill and the amount agrees with the fill slip): 

(i) Cashier who prepared the fill slip and issued the chips, tokens, or cash equivalent; 

(ii) Runner who carried the chips, tokens, or cash equivalents from the cage to the pit; 

(iii) Dealer who received the chips, tokens, or cash equivalents at the 

gaming table; and 

(iv) Pit supervisory agent who supervised the fill transaction. 

(9) Fills must be broken down and verified by the dealer in public view before the dealer places 

the fill in the table tray. 

(10) A copy of the fill slip must then be deposited into the drop box on the table by the dealer, 

where it must appear in the soft count room with the cash receipts for the shift. 

(11) Table credit transactions must be authorized by a pit supervisor before the issuance of 

credit slips and transfer of chips, tokens, or other cash equivalent. The credit request must be 

communicated to the cage where the credit slip is prepared. 

(12) At least three parts of each credit slip must be utilized as follows: 

(i) Two parts of the credit slip must be transported by the runner to the pit. After 

signatures of the runner, dealer, and pit supervisor are obtained, one copy must be

deposited in the table game drop box and the original must accompany transport of the 

chips, tokens, markers, or cash equivalents from the pit to the cage for verification and 

signature of the cashier. 

(ii) For computer systems, one part must be retained in a secure manner to insure that 

only authorized agents may gain access to it. For manual systems, one part must be 

retained in a secure manner in a continuous unbroken form. 

(13) The table number, shift, and the amount of credit by denomination and in total must be 

noted on all copies of the credit slip. The correct date and time must be indicated on at least 

two copies. 

(14) Chips, tokens, and/or cash equivalents must be removed from the table tray by the dealer 

and must be broken down and verified by the dealer in public view prior to placing them in racks 

for transfer to the cage. 

(15) All chips, tokens, and cash equivalents removed from the tables and markers removed from 

the pit must be carried to the cashier's cage by an agent who is independent of the cage or pit. 
Class III Minimum Internal Controls Guidance

Page 23 of 81

2018

(16) The credit slip must be signed by at least the following agents (as an indication that each 

has counted or, in the case of markers, reviewed the items transferred): 

(i) Cashier who received the items transferred from the pit and prepared the credit slip; 

(ii) Runner who carried the items transferred from the pit to the cage; 

(iii) Dealer who had custody of the items prior to transfer to the cage; and 

(iv) Pit supervisory agent who supervised the credit transaction. 

(17) The credit slip must be inserted in the drop box by the dealer. 

(18) Chips, tokens, or other cash equivalents must be deposited on or removed from gaming 

tables only when accompanied by the appropriate fill/credit or marker transfer forms. 

(19) Cross fills (the transfer of chips between table games) and even cash exchanges are 

prohibited in the pit. 

(c) Table inventory forms. 

(1) At the close of each shift, for those table banks that were opened during that shift: 

(i) The table's chip, token, coin, and marker inventory must be counted and recorded on 

a table inventory form; or 

(ii) If the table banks are maintained on an imprest basis, a final fill or credit must be 

made to bring the bank back to par. 

(2) If final fills are not made, beginning and ending inventories must be recorded on the master 

game sheet for shift win calculation purposes. 

(3) The accuracy of inventory forms prepared at shift end must be verified by the outgoing pit 

supervisor and the dealer. Alternatively, if the dealer is not available, such verification may be 

provided by another pit supervisor or another supervisor from another gaming department. 

Verifications must be evidenced by signature on the inventory form. 

(4) If inventory forms are placed in the drop box, such action must be performed by an agent 

other than a pit supervisor. 

(d) Table games computer generated documentation standards. 

(1) The computer system must be capable of generating adequate documentation of all 

information recorded on the source documents and transaction detail (e.g., fill/credit slips, 

markers, etc.). 
Class III Minimum Internal Controls Guidance

Page 24 of 81

2018

(2) This documentation must be restricted to authorized agents. 

(3) The documentation must include, at a minimum: 

(i) System exception information (e.g., appropriate system parameter information, 

corrections, voids, etc.); and 

(ii) Agent access listing, which includes, at a minimum: 

(A) Agent name or agent identification number (if applicable); and 

(B) Listing of functions agents can perform or equivalent means of identifying 

the same. 

(e) Standards for playing cards and dice. 

(1) Playing cards and dice must be maintained in a secure location to prevent unauthorized 

access and to reduce the possibility of tampering. 

(2) Used cards and dice must be maintained in a secure location until marked, scored, or 

destroyed, in a manner as approved by the Tribal gaming regulatory authority, to prevent 

unauthorized access and reduce the possibility of tampering. 

(3) Controls must be established and procedures implemented that establish a reasonable time 

period, within which to mark, cancel, or destroy cards and dice from play. 

(i) This standard does not apply where playing cards or dice are retained for an 

investigation. 

(4) A card and/or dice control log must be maintained that documents when cards and dice are 

received on site, distributed to and returned from tables and removed from play by the gaming 

operation. 

(f) Plastic cards. If a gaming operation uses plastic cards (not plastic-coated cards), the cards may be 

used for up to three (3) months if the plastic cards are routinely inspected, and washed or cleaned in a 

manner and time frame approved by the Tribal gaming regulatory authority. 

(g) Analysis of table game performance standards. 

(1) Records must be maintained by day and shift indicating any single-deck blackjack games that 

were dealt for an entire shift. 

(2) Records reflecting hold percentage by table and type of game must be maintained by shift, 

by day, cumulative month-to-date, and cumulative year-to-date. 
Class III Minimum Internal Controls Guidance

Page 25 of 81

2018

(3) This information must be presented to and reviewed by management independent of the pit 

department on at least a monthly basis. 

(4) The management in paragraph (g)(3) of this section must investigate any unusual 

fluctuations in hold percentage with pit supervisory agents.

(5) The results of such investigations must be documented, maintained for inspection, and 

provided to the Tribal gaming regulatory authority upon request. 

(h) Marker credit play. 

(1) If a gaming operation allows marker credit play (exclusive of rim credit and call bets), the 

following standards must apply: 

(i) A marker system must allow for credit to be both issued and repaid in the pit. 

(ii) Prior to the issuance of gaming credit to a player, the agent extending the credit 

must contact a credit reporting bureau to determine if the player's credit limit has been 

properly established and there is sufficient remaining credit available for the advance. 

(iii) Proper authorization of credit extension in excess of the previously established limit 

must be documented. 

(iv) The amount of credit extended must be communicated to the independent source 

and the amount documented within a reasonable time subsequent to each issuance. 

(v) The marker form must be prepared in at least triplicate form with a preprinted or 

concurrently printed marker number, and utilized in numerical sequence. (This 

requirement must not preclude the distribution of batches of markers to various pits.) 

(vi) At least three parts of each separately numbered marker form must be utilized as 

follows: 

(A) Original must be maintained in the pit until settled or transferred to the 

cage; 

(B) Payment slip must be maintained in the pit until the marker is settled or 

transferred to the cage. If paid in the pit, the slip must be inserted in the table 

game drop box. If not paid in the pit, the slip must be transferred to the cage 

with the original; 

(C) Issue slip must be inserted into the appropriate table game drop box when 

credit is extended or when the player has signed the original. 
Class III Minimum Internal Controls Guidance

Page 26 of 81

2018

(vii) When marker documentation (e.g., issue slip and payment slip) is inserted in the 

drop box, such action must be performed by the dealer at the table. 

(viii) A record must be maintained that details the following (e.g., master credit record 

retained at the pit podium): 

(A) The signature or initials of the agent(s) approving the extension of credit 

(unless such information is contained elsewhere for each issuance); 

(B) The legible name of the person receiving the credit; 

(C) The date and shift of granting the credit; 

(D) The table on which the credit was extended; 

(E) The amount of credit issued; 

(F) The marker number; 

(G) The amount of credit remaining after each issuance or the total credit 

available for all issuances; 

(H) The amount of payment received and nature of settlement (e.g., credit slip 

number, cash, chips, etc.); and 

(I) The signature or initials of the agent receiving payment/settlement. 

(ix) The forms required in paragraphs (h)(1)(v), (vi), and (viii) of this section must be 

safeguarded, and adequate procedures must be employed to control the distribution, 

use, and access to these forms.

(x) All credit extensions must be initially evidenced by lammer buttons, which must be 

displayed on the table in public view and placed there by supervisory agents. 

(xi) Marker preparation must be initiated and other records updated within 

approximately one hand of play following the initial issuance of credit to the player. 

(xii) Only the dealer moves lammer buttons from the table into the table tray, or moves 

lammer buttons to a neutral area for subsequent removal by pit supervisory personnel. 

This procedure is performed when the marker issue slip is placed in the table game drop 

box.

(xiii) The original marker must contain at least the following information: 

(A) Marker number; 
Class III Minimum Internal Controls Guidance

Page 27 of 81

2018

(B) Player's name and signature; 

(C) Date; and 

(D) Amount of credit issued. 

(xiv) The issue slip or stub must include the same marker number as the original, the 

table number, date and time of issuance, and amount of credit issued. The issue slip or 

stub must also include the signature of the agent extending the credit, and the signature 

or initials of the dealer at the applicable table, unless this information is included on 

another document verifying the issued marker. 

(xv) The payment slip must include the same marker number as the original. When the 

marker is paid in full in the pit, it must also include the table number where paid, date 

and time of payment, nature of settlement (cash, chips, etc.), and amount of payment. 

The payment slip must also include the signature of pit supervisory agent acknowledging 

payment, and the signature or initials of the dealer receiving payment, 

unless this information is included on another document verifying the payment of the 

marker. 

(xvi) When partial payments are made in the pit, a new marker must be completed 

reflecting the remaining balance and the marker number of the marker originally issued. 

(xvii) When partial payments are made in the pit, the payment slip of the marker that 

was originally issued must be properly cross-referenced to the new marker number, 

completed with all information required by paragraph (h)(1)(xv) of this section, and 

inserted into the drop box.

(xviii) The independent source must be notified when payments (full or partial) are 

made in the pit so that cage records can be updated for such transactions. Notification 

must be made no later than when the customer's play is completed or at shift end, 

whichever is earlier. 

(xix) All portions of markers, both issued and unissued, must be safeguarded and 

procedures must be employed to control the distribution, use and access to the forms. 

(xx) An investigation must be performed to determine the cause and responsibility for 

loss whenever marker forms, or any part thereof, are missing. These investigations must 

be documented, maintained for inspection, and provided to the Tribal gaming 

regulatory authority upon request. 

(xxi) When markers are transferred to the cage, marker transfer forms or marker credit 

slips (or similar documentation) must be utilized and such documents must include, at a 
Class III Minimum Internal Controls Guidance

Page 28 of 81

2018

minimum, the date, time, shift, marker number(s), table number(s), amount of each 

marker, the total amount transferred, signature of pit supervisory agent releasing 

instruments from the pit, and the signature of agent verifying receipt of instruments at 

the cage. 

(xxii) All markers must be transferred to the cage within twenty-four (24) hours of 

issuance. 

(xxiii) Markers must be transported to the cashier's cage by an agent who is 

independent of the marker issuance and payment functions (pit clerks may perform this 

function). 

(i) Name credit instruments accepted in the pit. 

(1) For the purposes of this paragraph, name credit instruments means personal checks, payroll 

checks, counter checks, hold checks, traveler's checks, or other similar instruments that are 

accepted in the pit as a form of credit issuance to a player with an approved credit limit. 

(2) The following standards must apply if name credit instruments are accepted in the pit: 

(i) A name credit system must allow for the issuance of credit without using markers; 

(ii) Prior to accepting a name credit instrument, the employee extending the credit must 

contact the cashier or another independent source to determine if the player's credit 

limit has been properly established and the remaining credit available is sufficient for 

the advance; 

(iii) All name credit instruments must be transferred to the cashier's cage (utilizing a 

two-part order for credit) immediately following the acceptance of the instrument and 

issuance of chips (if name credit instruments are transported accompanied by a credit 

slip, an order for credit is not required); 

(iv) The order for credit (if applicable) and the credit slip must include the customer's 

name, amount of the credit instrument, the date, time, shift, table number, signature of 

pit supervisory agent releasing instrument from pit, and the signature of the agent 

verifying receipt of instrument at the cage; 

(v) The procedures for transacting table credits at standards in paragraphs (b)(11) 

through (18) of this section must be strictly adhered to; and 

(vi) The acceptance of payments in the pit for name credit instruments must be 

prohibited. 

(j) Call bets. 
Class III Minimum Internal Controls Guidance

Page 29 of 81

2018

(1) The following standards must apply if call bets are accepted in the pit: 

(i) A call bet must be evidenced by the placement of a lammer button, chips, or other 

identifiable designation in an amount equal to that of the wager in a specific location on 

the table; 

(ii) The placement of the lammer button, chips, or other identifiable designation must 

be performed by supervisory/boxperson agents. The placement may be performed by a 

dealer only if the supervisor physically observes and gives specific authorization; 

(iii) The call bet must be settled at the end of each hand of play by the preparation of a 

marker, repayment of the credit extended, or the payoff of the winning wager. Call bets 

extending beyond one hand of play must be prohibited; and 

(iv) Only the dealer moves lammer buttons from the table into the table tray, or moves 

lammer buttons to a neutral area for subsequent removal by pit supervisory personnel. 

This procedure is performed at the completion of the call bet transaction.

(k) Rim credit. 

(1) The following standards must apply if rim credit is extended in the pit: 

(i) Rim credit must be evidenced by the issuance of chips to be placed in a neutral zone 

on the table and then extended to the customer for the customer to wager, or to the 

dealer to wager for the customer, and by the placement of a lammer button or other 

identifiable designation in an amount equal to that of the chips extended; and 

(ii) Rim credit must be recorded on player cards, or similarly used documents, which 

must be: 

(A) Prenumbered or concurrently numbered and accounted for by a department 

independent of the pit; 

(B) For all extensions and subsequent repayments, evidenced by the initials or 

signatures of a supervisor and the dealer attesting to the validity of each credit 

extension and repayment; 

(C) An indication of the settlement method (e.g., serial number of marker 

issued, chips, cash); 

(D) Settled no later than when the customer leaves the table at which the card is 

prepared; 

(E) Transferred to the accounting department on a daily basis; and 
Class III Minimum Internal Controls Guidance

Page 30 of 81

2018

(F) Reconciled with other forms utilized to control the issuance of pit credit (e.g., 

master credit records, table cards). 

(l) The following standards must apply if foreign currency is accepted in the pit: 

(1) Foreign currency transactions must be authorized by a pit supervisor/ boxperson who 

completes a foreign currency exchange form before the exchange for chips or tokens; 

(2) Foreign currency exchange forms include the country of origin, total face value, 

amount of chips/token extended (i.e., conversion amount), signature of 

supervisor/boxperson, and the dealer completing the transaction; 

(3) Foreign currency exchange forms and the foreign currency must be inserted in the 

drop box by the dealer; and 

(4) Alternate procedures specific to the use of foreign valued gaming chips must be 

developed by the Tribal gaming regulatory authority, or the gaming operation as 

approved by the Tribal gaming regulatory authority. 

(m) All relevant controls from § 11, Information and Technology will apply.

(n) Revenue Audit. Standards for revenue audit of table games are contained in § 13, Revenue Audit. 

(o) Variance. The operation must establish, as approved by the TGRA, the threshold level at which a 

variance must be reviewed to determine the cause. Any such review must be documented.

§5. What are the minimum internal control standards for gaming machines?

(a) Supervision. Supervision must be provided as needed for gaming machines operations by an agent(s) 

with authority equal to or greater than those being supervised.

(b) Standards for gaming machines. 

(1) For this section only, credit or customer credit means a unit of value equivalent to cash or 

cash equivalents deposited, wagered, won, lost, or redeemed by a customer. 

(2) Coins shall include tokens. 

(3) For all computerized gaming machine systems, an agent access listing shall be maintained, 

which includes at a minimum: 

(i) Agent name or agent identification number (or equivalent); and 

(ii) Listing of functions agents can perform or equivalent means of identifying same. 
Class III Minimum Internal Controls Guidance

Page 31 of 81

2018

(c) Jackpot prize payout and fills. Controls must be established and procedures implemented for jackpot

prize payout and fills that address the following:

(1) Identification of the agent authorized (by position) to make a payout;

(2) Predetermined payout authorization levels (by position); 

(3) Computerized jackpot/fill systems shall be restricted so as to prevent unauthorized 

access and fraudulent payouts by one person. 

(4) Payout forms shall be controlled and routed in a manner that precludes any one 

person from producing a fraudulent payout by forging signatures or by altering the 

amount paid out after the payout and misappropriating the funds; and

(5) Documentation procedures ensuring separate control of the cash accountability 

functions. Documentation at minimum must include the following information: 

(i) Date and time; 

(ii) Machine number; 

(iii) Dollar amount of cash payout or gaming machine fill (both alpha and 

numeric) or description of personal property awarded, including fair market 

value. (Alpha is optional if another unalterable method is used for evidencing the 

amount of the payout); 

(iv) Game outcome (including reel symbols, card values, suits, etc.) for jackpot 

payouts. Game outcome is not required if a computerized jackpot/fill system is 

used; and

(v) Preprinted or concurrently printed sequential number.

(6) Verification.

(i) For payouts, at least two agents must verify that the winning pattern has 

been achieved prior to the payment of a prize. The system may serve as one of 

the verifiers.

(ii) For automated payouts, the system may serve as the sole verifier that a 

winning pattern has been achieved.

(7) Authorization and signatures.
Class III Minimum Internal Controls Guidance

Page 32 of 81

2018

(i) At least two agents must authorize, sign, and witness all manual prize 

payouts above $1,200, or a lower threshold as authorized by management and 

approved by the TGRA.

(ii) Manual jackpot prize payouts above the following threshold (or a lower threshold, as 

authorized by management and approved by TGRA) must require one of the 

two signatures and verifications to be a supervisory or management agent 

independent of gaming machine operations:

(A) $5,000 for a Tier A facility;

(B) $10,000 for a Tier B facility;

(C) $20,000 for a Tier C facility; or

(D) $50,000 for a Tier C facility with over $100,000,000 in gross gaming 

revenues.

(iii) The predetermined thresholds, whether set at the MICS level or lower, must be 

authorized by management, approved by the TGRA, documented, and maintained.

(iv) A gaming system may substitute for one authorization/signature verifying or 

authorizing a win, but may not substitute for a supervisory or management 

authorization/signature.

(8) Payout records, including manual payout records, must include the following 

information:

(i) Date and time;

(ii) Amount of the payout (alpha & numeric for gaming machine payouts); 

(iii) Machine identifier;

(iv) Signature of all, but not less than two, agents involved in the transaction;

(v) For override transactions, verification by a supervisory or management agent 

independent of the transaction; and

(vi) Any other information necessary to substantiate the payout.

(d) Cash and cash equivalent controls for gaming machine booths and change banks . 

(1) Cash or cash equivalents exchanged between two persons must be counted independently 

by at least two agents and reconciled to the recorded amounts at the end of each shift or 
Class III Minimum Internal Controls Guidance

Page 33 of 81

2018

session. Unexplained variances must be documented and maintained. Unverified transfers of 

cash or cash equivalents are prohibited.

(2) Procedures must be implemented to control cash or cash equivalents based on the amount 

of the transaction. These procedures must include documentation by shift or other relevant 

time period of the following:

(i) Transfers;

(ii) Exchanges, including acknowledging signatures or initials; and

(iii) Resulting variances.

(3) Any change to control of accountability, exchange, or transfer requires that the cash or cash 

equivalents be counted and recorded independently by at least two agents and reconciled to 

the recorded amount.

(4) The gaming machine booths and change banks that are active during the shift shall be 

counted down and reconciled each shift by two agents utilizing appropriate accountability 

documentation. 

(5) The wrapping of loose gaming machine booth and cage cashier coin shall be performed at a 

time or location that does not interfere with the hard count/wrap process or the accountability 

of that process. 

(6) A record shall be maintained evidencing the transfers of wrapped and unwrapped coins and 

retained for seven (7) days. 

(e) Gaming machines and components. Controls must be established and procedures implemented to 

safeguard the integrity of gaming machines and components during installations, operations, 

modifications, removal and retirements. Such procedures must include the following:

(1) Shipping and receiving.

(i) A communication procedure must be established between the supplier, the gaming 

operation, and the TGRA to properly control the shipping and receiving of all software 

and hardware components. Such procedures must include:

(A) Notification of pending shipments must be provided to the TGRA by the 

gaming operation;

(B) Certification by an independent test lab (if technical standards apply through 

tribal law or compact);
Class III Minimum Internal Controls Guidance

Page 34 of 81

2018

(C) Notification from the supplier to the TGRA, or the gaming operation as 

approved by the TGRA, of the shipping date and expected date of delivery. The 

shipping notification must include:

(1) Name and address of the supplier;

(2) Description of shipment;

(3) Gaming machine serial number;

(4) For software: software version and description of software;

(5) Method of shipment; and

(6) Expected date of delivery.

(ii) Procedures must be implemented for the gaming machine system components for 

maintenance and replacement.

(iii) Gaming machine components must be shipped in a secure manner to deter 

unauthorized access.

(iv) The TGRA, or its designee, must receive all gaming machine system components and 

game play software packages, and verify the contents against the shipping notification.

(2) Access credential control methods.

(i) Controls must be established to restrict access to gaming machine system 

components.

(3) Recordkeeping and audit processes.

(i) The gaming operation must maintain the following records, as applicable, related to 

installed gaming machine system components:

(A) Date placed into service;

(B) Date made available for play;

(C) Supplier;

(D) Software version;

(E) Serial number;

(F) Game title or other similar identifying information;
Class III Minimum Internal Controls Guidance

Page 35 of 81

2018

(G) Asset and/or location number;

(H) Seal number; and

(I) Initial meter reading.

(ii) Procedures must be implemented for auditing such records in accordance with §14, 

Audit and Accounting.

(4) System software signature verification.

(i) Procedures must be implemented for system software verifications. These 

procedures must include comparing signatures generated by the verification programs 

to the signatures provided in the independent test laboratory letter for that software 

version.

(ii) An agent independent of the gaming machine operation must perform system 

software signature verification(s) to verify that only approved software is installed.

(iii) Procedures must be implemented for investigating and resolving any software 

verification variances.

(iv) Internal audits must be conducted as set forth in §14, Audit and Accounting. Such 

audits must be documented.

(5) Game program or other equivalent game software media control standards. 

(i) At least annually, procedures shall be performed to insure the integrity of a sample of 

gaming machine game program or other equivalent game software media, by personnel 

independent of the gaming machine department or the machines being tested. 

(ii) The TGRA, or the gaming operation subject to the approval of the TGRA, shall 

develop and implement procedures for the following: 

(1) Removal of game program or other equivalent game software media, from 

devices, the verification of the existence of errors as applicable, and the 

correction via duplication from the master game program or other equivalent 

game software media; 

(2) Copying one gaming device program to another approved program; 

(3) Verification of duplicated game program or other equivalent game software 

media before being offered for play; 
Class III Minimum Internal Controls Guidance

Page 36 of 81

2018

(4) Receipt and destruction of game program or other equivalent game software 

media; and 

(5) Securing game program or other equivalent game software media and 

duplicator from unrestricted access.

(iii) The master game program number, par percentage, and the pay table shall be 

verified to the par sheet when initially received from the manufacturer. 

(iv) Gaming machines shall have the game software circuit boards locked or physically 

sealed. The lock or seal shall necessitate the presence of a person independent of the 

gaming machine department to access the device game program or other equivalent 

game software media. If a seal is used to secure the board to the frame of the gaming 

device, it shall be pre-numbered. 

(6) Installation testing.

(i) Testing must be completed during the installation process to verify that the gaming 

machine component has been properly installed. This must include testing of the 

following, as applicable:

(A) Communication with the gaming system;

(B) Communication with the accounting system;

(C) Communication with the player tracking system;

(D) Currency and vouchers to bill acceptor;

(E) Voucher printing;

(F) Meter incrimination;

(G) Pay table, for verification;

(H) Gaming machine denomination, for verification;

(I) All buttons, to ensure that all are operational and programmed appropriately;

(J) System components, to ensure that they are safely installed at location; and

(K) Locks, to ensure that they are secure and functioning.
Class III Minimum Internal Controls Guidance

Page 37 of 81

2018

(7) Display of rules and necessary disclaimers. The TGRA or the operation must verify that all 

game rules and disclaimers are displayed at all times or made readily available to the player 

upon request;

(8) TGRA approval of all gaming machines before they are offered for play; and

(9) Dispute resolution.

(f) Operations. 

(1) Malfunctions. Procedures must be implemented to investigate, document and resolve 

malfunctions. Such procedures must address the following:

(i) Determination of the event causing the malfunction;

(ii) Review of relevant records, game recall, reports, logs, surveillance records;

(iii) Repair or replacement of the gaming component;

(iv) Verification of the integrity of the gaming component before restoring it to 

operation; and

(2) Removal, retirement and/or destruction. Procedures must be implemented to retire or 

remove any or all associated components of a gaming system from operation. Procedures must 

include the following:

(i) For gaming machines and components that accept cash or cash equivalents:

(A) Coordinate with the drop team to perform a final drop;

(B) Collect final accounting information such as meter readings, drop and 

payouts;

(C) Remove and/or secure any or all associated equipment such as locks, card 

reader, or ticket printer from the retired or removed component; and

(D) Document removal, retirement, and/or destruction.

(ii) For removal of software components:

(A) Uninstall and/or return the software to the license holder; and

(B) Document the removal.

(iii) For all components:
Class III Minimum Internal Controls Guidance

Page 38 of 81

2018

(A) Verify that unique identifiers, and descriptions of removed/retired 

components are recorded as part of the retirement documentation; and

(B) Coordinate with the accounting department to properly retire the 

component in the system records.

(v) Where the TGRA authorizes destruction of any gaming system components, 

procedures must be developed to destroy such components. Such procedures must 

include the following:

(A) Methods of destruction;

(B) Witness or surveillance of destruction;

(C) Documentation of all components destroyed; and

(D) Signatures of agent(s) destroying components attesting to destruction.

(g) Vouchers.

(1) Controls must be established and procedures implemented to:

(i) Verify the authenticity of each voucher redeemed.

(ii) If the voucher is valid, verify that the patron is paid the appropriate amount.

(iii) Document the payment of a claim on a voucher that is not physically available or a 

voucher that cannot be validated such as a mutilated, expired, lost, or stolen voucher.

(iv) Retain payment documentation for reconciliation purposes.

(v) For manual payment of a voucher in an amount established by management and 

approved by the TGRA, require a supervisory agent to verify the validity of the voucher 

prior to payment.

(2) Vouchers paid during a period while the voucher system is temporarily out of operation must 

be marked “paid” by the cashier.

(3) Vouchers redeemed while the voucher system was temporarily out of operation must be 

validated as expeditiously as possible upon restored operation of the voucher system.

(4) Paid vouchers must be maintained in the cashier's accountability for reconciliation purposes.

(5) Unredeemed vouchers can only be voided in the voucher system by supervisory agents. The 

accounting department will maintain the voided voucher, if available.
Class III Minimum Internal Controls Guidance

Page 39 of 81

2018

(h) Standards for evaluating theoretical and actual hold percentages.

(1) Accurate and current theoretical hold worksheets shall be maintained for each gaming 

machine.

(2) For multi-game/multi-denominational machines, an employee or department independent 

of the gaming machine department shall:

(i) Weekly, record the total coin-in meter;

(ii) Quarterly, record the coin-in meters for each paytable contained in the machine; and

(iii) On an annual basis, adjust the theoretical hold percentage in the gaming machine 

statistical report to a weighted average based upon the ratio of coin-in for each game 

paytable.

(3) For those gaming operations that are unable to perform the weighted average calculation as 

required by paragraph (g)(2) of this section, the following procedures shall apply:

(i) On at least an annual basis, calculate the actual hold percentage for each gaming 

machine;

(ii) On at least an annual basis, adjust the theoretical hold percentage in the gaming 

machine statistical report for each gaming machine to the previously calculated actual 

hold percentage; and

(iii) The adjusted theoretical hold percentage shall be within the spread between the 

minimum and maximum theoretical payback percentages.

(4) The adjusted theoretical hold percentage for multi-game/multi-denominational machines 

may be combined for machines with exactly the same game mix throughout the year.

(5) The theoretical hold percentages used in the gaming machine analysis reports should be 

within the performance standards set by the manufacturer.

(6) Records shall be maintained for each machine indicating the dates and type of changes made 

and the recalculation of theoretical hold as a result of the changes.

(7) Records shall be maintained for each machine that indicate the date the machine was placed 

into service, the date the machine was removed from operation, the date the machine was 

placed back into operation, and any changes in machine numbers and designations.

(8) All of the gaming machines shall contain functioning meters that shall record coin-in or 

credit-in, or on-line gaming machine monitoring system that captures similar data.
Class III Minimum Internal Controls Guidance

Page 40 of 81

2018

(9) All gaming machines with bill acceptors shall contain functioning billing meters that record 

the dollar amounts or number of bills accepted by denomination.

(10) Gaming machine in-meter readings shall be recorded at least weekly (monthly for Tier A 

and Tier B gaming operations) immediately prior to or subsequent to a gaming machine drop. 

On-line gaming machine monitoring systems can satisfy this requirement. However, the time 

between readings may extend beyond one week in order for a reading to coincide with the end 

of an accounting period only if such extension is for no longer than six (6) days.

(11) The agent who records the in-meter reading shall either be independent of the count team 

or shall be assigned on a rotating basis, unless the in-meter readings are randomly verified 

quarterly for all gaming machines and bill acceptors by an agent other than the regular in-meter 

reader.

(12) Upon receipt of the meter reading summary, the accounting department shall review all 

meter readings for reasonableness using pre-established parameters.

(13) Prior to final preparation of statistical reports, meter readings that do not appear 

reasonable shall be reviewed with gaming machine department agents or other appropriate 

designees, and exceptions documented, so that meters can be repaired or clerical errors in the 

recording of meter readings can be corrected.

(14) A report shall be produced at least monthly showing month-to-date, year-to-date (previous 

twelve (12) months data preferred), and if practicable, life-to-date actual hold percentage 

computations for individual machines and a comparison to each machine's theoretical hold 

percentage previously discussed.

(15) Each change to a gaming machine's theoretical hold percentage, including progressive 

percentage contributions, shall result in that machine being treated as a new machine in the 

statistical reports (i.e., not commingling various hold percentages), except for adjustments made 

in accordance with paragraph (h)(2) of this section.

(16) If promotional payouts or awards are included on the gaming machine statistical reports, it 

shall be in a manner that prevents distorting the actual hold percentages of the affected 

machines.

(17) The statistical reports shall be reviewed by both gaming machine department management 

and management agents independent of the gaming machine department on at least a monthly 

basis.

(18) For those gaming machines that have experienced a level of wagering transactions (as 

established by the gaming operations and approved by the TGRA), large variances between 

theoretical hold and actual hold shall be investigated and resolved by a department 
Class III Minimum Internal Controls Guidance

Page 41 of 81

2018

independent of the gaming machine department. The threshold for the variance as established 

by the gaming operations and approved by the TGRA.

(19) Maintenance of the on-line gaming machine monitoring system data files shall be 

performed by a department independent of the gaming machine department. Alternatively, 

maintenance may be performed by gaming machine supervisory agents if sufficient 

documentation is generated and it is randomly verified on a monthly basis by agents 

independent of the gaming machine department.

(20) Updates to the on-line gaming machine monitoring system to reflect additions, deletions, or 

movements of gaming machines shall be made at least weekly prior to in-meter readings and 

the weigh process.

(i) Gaming machine drop and hopper contents standards. 

(1) When machines are temporarily removed from the floor, gaming machine drop and hopper 

contents shall be protected to preclude the misappropriation of stored funds. 

(2) When machines are permanently removed from the floor, the gaming machine drop and 

hopper contents shall be counted and recorded by at least two employees with appropriate 

documentation being routed to the accounting department for proper recording and accounting 

for initial hopper loads. 

(j) In-house progressive gaming machine standards. 

(1) A meter that shows the amount of the progressive jackpot shall be conspicuously displayed 

at or near the machines to which the jackpot applies. 

(2) At least once each day, each gaming operation shall record the amount shown on each 

progressive jackpot meter at the gaming operation except for those jackpots that can be paid 

directly from the gaming machine; 

(3) Explanations for meter reading decreases shall be maintained with the progressive meter 

reading sheets, and where the payment of a jackpot is the explanation for a decrease, the 

gaming operation shall record the jackpot payout number on the sheet or have the number 

reasonably available; and 

(4) Each gaming operation shall record the base amount of each progressive jackpot the gaming 

operation offers. 

(5) Controls and procedures specific to the transfer of progressive amounts in excess of the base 

amount to other gaming machines must be approved by the TGRA. Such procedures may also 
Class III Minimum Internal Controls Guidance

Page 42 of 81

2018

include other methods of distribution that accrue to the benefit of the gaming public via an 

award or prize. 

(k) Wide area progressive gaming machine standards. 

(1) A meter that shows the amount of the progressive jackpot shall be conspicuously displayed 

at or near the machines to which the jackpot applies. 

(2) As applicable to participating gaming operations, the wide area progressive gaming machine 

system shall be adequately restricted to prevent unauthorized access. 

(3) The TGRA shall approve procedures for the wide area progressive system that: 

(i) Reconcile meters and jackpot payouts; 

(ii) Collect/drop gaming machine funds; 

(iii) Verify jackpot, payment, and billing to gaming operations on pro-rata basis; 

(iv) System maintenance; 

(v) System accuracy; and 

(vi) System security. 

(4) Reports, where applicable, adequately documenting the procedures required in paragraph 

(j)(3) of this section shall be generated and retained.

(l) All relevant controls from § 11, Information and Technology will apply.

(m) Revenue Audit. Standards for revenue audit of gaming machines are contained in § 13, Revenue 

Audit. 

(n) Variance. The operation must establish, as approved by the TGRA, the threshold level at which a 

variance must be reviewed to determine the cause. Any such review must be documented.

§6. What are the minimum internal control standards for gaming promotions and player tracking 

systems? 

(a) Supervision. Supervision must be provided as needed for gaming promotions and player tracking by 

an agent(s) with authority equal to or greater than those being supervised. 

(b) Gaming promotions. The rules of the gaming promotion must be displayed or made readily available 

to patron upon request. Gaming promotions rules require TGRA approval and must include the 

following: 

(1) The rules of play; 
Class III Minimum Internal Controls Guidance

Page 43 of 81

2018

(2) The nature and value of the associated prize(s) or cash award(s); 

(3) Any restrictions or limitations on participant eligibility; 

(4) The date(s), time(s), and location(s) for the associated promotional activity or activities; 

(5) Any other restrictions or limitations, including any related to the claim of prizes or cash 

awards; 

(6) The announcement date(s), time(s), and location(s) for the winning entry or entries; and 

(7) Rules governing promotions offered across multiple gaming operations, third party 

sponsored promotions, and joint promotions involving third parties. 

(c) Player tracking systems and gaming promotions. 

(1) Changes to the player tracking systems, promotion and external bonusing system 

parameters—which control features such as the awarding of bonuses, the issuance of cashable 

credits, non-cashable credits, coupons and vouchers—must be documented and performed 

under the authority of supervisory agents independent of the department initiating the change. 

Alternatively, the changes may be performed by supervisory agents of the department initiating 

the change if sufficient documentation is generated and the propriety of the changes are 

randomly verified by supervisory agents independent of the department initiating the change on 

a monthly basis. 

(2) Changes to individual player tracking accounts other than through an automated process 

related to actual play must be sufficiently documented (including substantiation of reasons for 

increases) and authorized or performed by supervisory agents. An addition, deletion, or change 

to individual player tracking accounts must be authorized by supervisory agents and 

documented and randomly verified by accounting or audit personnel on a quarterly basis.

(3) All other changes to the player tracking system must be appropriately documented. 

(d) Variances. The operation must establish, as approved by the TGRA, the threshold level at which a 

variance must be reviewed to determine the cause. Any such review must be documented.

§7. What are the minimum internal control standards for complimentary services or items? 

(a) Supervision. Supervision must be provided as needed for approval of complimentary services by an 

agent(s) with authority equal to or greater than those being supervised. 

(b) Complimentary services or items. Controls must be established and procedures implemented for 

complimentary services or items that address the following: 

(1) Agents authorized to approve the issuance of complimentary services or items, including 

levels of authorization; 

(2) Limits and conditions on the approval and issuance of complimentary services or items; 

(3) Making and documenting changes to conditions or limits on the approval and issuance of 

complimentary services or items; 

(4) Documenting and recording the authorization, issuance, and redemption of complimentary 

services or items, including cash and non-cash gifts; 
Class III Minimum Internal Controls Guidance

Page 44 of 81

2018

(i) Records must include the following for all complimentary items and services equal to 

or exceeding an amount established by the gaming operation and approved by the 

TGRA: 

(A) Name of patron who received the complimentary service or item;

(B) Name(s) of issuer(s) of the complimentary service or item; 

(C) The actual cash value of the complimentary service or item; 

(D) The type of complimentary service or item (i.e., food, beverage); and 

(E) Date the complimentary service or item was issued. 

(c) Complimentary services and items records must be summarized and reviewed for proper 

authorization and compliance with established authorization thresholds. 

(1) A detailed reporting of complimentary services or items transactions that meet an 

established threshold approved by the TGRA must be prepared at least monthly. 

(2) The detailed report must be forwarded to management for review. 

(d) Variances. The operation must establish, as approved by the TGRA, the threshold level at which a 

variance must be reviewed to determine the cause. Any such review must be documented.

§8. What are the minimum internal control standards for patron deposit accounts and cashless 

systems? 

(a) Supervision. Supervision must be provided as needed for patron deposit accounts and cashless 

systems by an agent(s) with authority equal to or greater than those being supervised. 

(b) Patron deposit accounts and cashless systems. 

(1) Smart cards cannot maintain the only source of account data. 

(2) Establishment of patron deposit accounts. The following standards apply when a patron 

establishes an account:

(i) The patron must appear at the gaming operation in person, at a designated area of 

accountability, and present valid government issued picture identification; and 

(ii) An agent must examine the patron's identification and record the following 

information: 

(A) Type, number, and expiration date of the identification; 

(B) Patron's name; 

(C) A unique account identifier; 

(D) Date the account was opened; and 

(E) The agent's name. 

(3) The patron must sign the account documentation before the agent may activate the account. 

(4) The agent or cashless system must provide the patron deposit account holder with a secure 

method of access. 

(c) Patron deposits, withdrawals and adjustments. 
Class III Minimum Internal Controls Guidance

Page 45 of 81

2018

(1) Prior to the patron making a deposit or withdrawal from a patron deposit account, the agent 

or cashless system must verify the patron deposit account, the patron identity, and availability 

of funds. A personal identification number (PIN) is an acceptable form of verifying identification. 

(2) Adjustments made to the patron deposit accounts must be performed by an agent. 

(3) When a deposit, withdrawal, or adjustment is processed by an agent, a transaction record 

must be created containing the following information: 

(i) Same document number on all copies; 

(ii) Type of transaction, (deposit, withdrawal, or adjustment); 

(iii) Name or other identifier of the patron; 

(iv) The unique account identifier; 

(v) Patron signature for withdrawals, unless a secured method of access is utilized; 

(vi) For adjustments to the account, the reason for the adjustment; 

(vii) Date and time of transaction; 

(viii) Amount of transaction; 

(ix) Nature of deposit, withdrawal, or adjustment (cash, check, chips); and 

(x) Signature of the agent processing the transaction. 

(4) When a patron deposits or withdraws funds from a patron deposit account electronically, 

the following must be recorded: 

(i) Date and time of transaction; 

(ii) Location (gaming machine, kiosk); 

(iii) Type of transaction (deposit, withdrawal); 

(iv) Amount of transaction; and 

(v) The unique account identifier. 

(5) Patron deposit account transaction records must be available to the patron upon reasonable 

request. 

(6) If electronic funds transfers are made to or from a gaming operation bank account for patron 

deposit account funds, the bank account must be dedicated and may not be used for any other 

types of transactions. 

(d) Variances. The operation must establish, as approved by the TGRA, the threshold level at which a 

variance must be reviewed to determine the cause. Any such review must be documented.

§9. What are the minimum internal control standards for lines of credit? 

(a) Supervision. Supervision must be provided as needed for the authorization, extension, or 

modification of lines of credit by an agent(s) with authority equal to or greater than those being 

supervised. 

(b) Establishment of lines of credit policy. 
Class III Minimum Internal Controls Guidance

Page 46 of 81

2018

(1) If a gaming operation extends lines of credit, controls must be established and procedures 

implemented to safeguard the assets of the gaming operation. Such controls must include a 

lines of credit policy including the following: 

(i) A process for the patron to apply for, modify, and/or re-establish lines of credit, to 

include required documentation and credit line limit; 

(ii) Authorization levels of credit issuer(s); 

(iii) Identification of agents authorized to issue lines of credit; 

(iv) A process for verifying an applicant's credit worthiness; 

(v) A system for recording patron information, to include: 

(A) Name, current address, and signature; 

(B) Identification credential; 

(C) Authorized credit line limit; 

(D) Documented approval by an agent authorized to approve credit line limits; 

(E) Date, time and amount of credit issuances and payments; and 

(F) Amount of available credit. 

(vi) A process for issuing lines of credit to: 

(A) Verify the patron's identity; 

(B) Notify the patron of the lines of credit terms, including obtaining patron's written 

acknowledgment of the terms by signature; 

(C) Complete a uniquely identified, multi-part, lines of credit issuance form, such as a 

marker or counter check, which includes the terms of the lines of credit transaction; 

(D) Obtain required signatures; 

(E) Determine the amount of the patron's available lines of credit; 

(F) Update the credit balance record at the time of each transaction to ensure that lines 

of credit issued are within the established limit and balance for that patron; and 

(G) Require the agent issuing the lines of credit to be independent of the agent who 

authorized the lines of credit. 

(vii) A policy establishing credit line limit exceptions to include the following: 

(A) Identification of the agent(s) authorized to permit a credit line limit to be exceeded; 

(B) Authorization thresholds; and 

(C) Required documentation. 

(viii) A policy governing increases and decreases to a patron's lines of credit account balances to 

include the following: 

(A) Documentation and record keeping requirements; 

(B) Independence between the department that receives the payment and the 

department that maintains custody of the credit balance for payments made by mail; 
Class III Minimum Internal Controls Guidance

Page 47 of 81

2018

(C) Collections; 

(D) Periodic audits and confirmation of balances; and 

(E) If a collection agency is used, a process to ensure documentation of increases and 

decreases to the lines of credit account balances. 

(ix) A policy governing write-offs and settlements to include: 

(A) Identification of agent(s) authorized to approve write-offs and settlements; 

(B) Authorization levels for write-offs and settlements of lines of credit instruments; 

(C) Required documentation for write-offs and settlements; 

(D) Independence between the agent who established the lines of credit and the agent 

writing off or settling the lines of credit instrument; and 

(E) Necessary documentation for the approval of write-offs and settlements and 

transmittal to the appropriate department for recording and deductibility. 

(c) Variances. The operation must establish, as approved by the TGRA, the threshold level at which a 

variance must be reviewed to determine the cause. Any such review must be documented.

§10. What are the minimum internal control standards for the cage, vault, kiosk, cash and cash 

equivalents? 

(a) Supervision. Supervision must be provided as needed for cage, vault, kiosk, and other operations 

using cash or cash equivalents by an agent(s) with authority equal to or greater than those being 

supervised. 

(b) Check cashing. 

(1) If checks are cashed at the cage, the controls must provide for security and integrity. For 

each check cashing transaction, the agent(s) conducting the transaction must: 

(i) Verify the patron's identity; 

(ii) Examine the check to ensure it includes the patron's name, current address, and 

signature; 

(iii) For personal checks, verify the patron's check cashing authority and record the 

source and results in accordance with management policy; however 

(iv) If a check guarantee service is used to guarantee the transaction and the procedures 

required by the check guarantee service are followed, then the above requirements do 

not apply. 

(2) When counter checks are issued, the following must be included on the check: 

(i) The patron's name and signature; 

(ii) The dollar amount of the counter check; 

(iii) Patron's bank name, bank routing, and account numbers; 

(iv) Date of issuance; and 

(v) Signature of the agent approving the counter check transaction. 
Class III Minimum Internal Controls Guidance

Page 48 of 81

2018

(3) Checks that are not deposited in the normal course of business, as established by 

management, (held checks) are subject to §9 lines of credit standards. 

(4) When traveler's checks or other guaranteed drafts, such as cashier's checks, are presented, 

the cashier must comply with the examination and documentation procedures as required by 

the issuer. 

(5) If a third party check cashing or guarantee service is used, the examination and 

documentation procedures required by the service provider apply, unless otherwise provided by 

tribal law or regulation. 

(c) Cage and vault accountability. 

(1) All transactions that flow through the cage must be summarized for each work shift of the 

cage and must be supported by documentation. 

(2) Increases and decreases to the total cage inventory must be verified, supported by 

documentation, and recorded. Documentation must include the date and shift, the purpose of 

the increase/decrease, the agent(s) completing the transaction, and the person or department 

receiving the cage funds (for decreases only). 

(3) The cage and vault inventories (including coin rooms) must be counted independently by at 

least two agents, attested to by signature, and recorded in ink or other permanent form at the 

end of each shift during which the activity took place. These agents must make individual counts 

to compare for accuracy and maintain individual accountability. All variances must be 

documented and investigated. 

(4) The gaming operation must establish and comply with a minimum bankroll formula to ensure 

the gaming operation maintains cash or cash equivalents (on hand and in the bank, if readily 

accessible) in an amount sufficient to satisfy obligations to the gaming operation's patrons as 

they are incurred. 

(d) Kiosks. 

(1) Kiosks must be maintained on the cage accountability and must be counted independently 

by at least two agents, documented, and reconciled for each increase or decrease to the kiosk 

inventory. 

(2) Currency cassettes must be counted and filled by an agent and verified independently by at 

least one agent who was not involved in the initial count and fill of the cassette, all of whom 

must sign each cassette. 

(3) Currency cassettes must be secured with a lock or tamper resistant seal and, if not placed 

inside a kiosk, must be stored in a secured area of the cage/vault. 

(4) The TGRA or the gaming operation, subject to the approval of the TGRA, must develop and 

implement physical security controls over the kiosks. Controls should address the following: 

forced entry, evidence of any entry, and protection of circuit boards containing programs. 

(5) With regard to cashless systems, the TGRA or the gaming operation, subject to the approval 

of the TGRA, must develop and implement procedures to ensure that communications between 

the kiosk and system are secure and functioning. 
Class III Minimum Internal Controls Guidance

Page 49 of 81

2018

(6) The following reconciliation reports must be available upon demand for each day, shift, and 

drop cycle (this is not required if the system does not track the information, but system 

limitation(s) must be noted): 

(i) Starting balance dollar amount per financial instrument; 

(ii) Starting balance number of items per financial instrument; 

(iii) Dollar amount per financial instrument issued; 

(iv) Number of items per financial instrument issued; 

(v) Dollar amount per financial instrument issued; 

(vi) Number of items per financial instrument redeemed; 

(vii) Dollar amount per financial instrument increases; 

(viii) Number of items per financial instrument increases; 

(ix) Dollar amount per financial instrument decreases; 

(x) Number of items per financial instrument decreases; 

(xi) Ending balance dollar amount per financial instrument; and 

(xii) Ending balance number of items per financial instrument. 

(e) Patron deposited funds. If a gaming operation permits a patron to deposit funds with the gaming 

operation at the cage, and when transfers of patron deposited funds are transferred to a gaming area 

for wagering purposes, the following standards apply: 

(1) The receipt or withdrawal of a patron deposit must be documented, with a copy given to the 

patron and a copy remaining in the cage. 

(2) Both copies of the document of receipt or withdrawal must contain the following 

information: 

(i) Same receipt number on each copy; 

(ii) Patron's name and signature; 

(iii) Date of receipt and withdrawal; 

(iv) Dollar amount of deposit/withdrawal (for foreign currency transactions include the 

US dollar equivalent, the name of the foreign country, and the amount of the foreign 

currency by denomination); 

(v) Nature of deposit/withdrawal; and 

(vi) Name and signature of the agent who conducted the transaction. 

(3) Procedures must be established and complied with for front money deposits to: 

(i) Maintain a detailed record by patron name and date of all funds on deposit; 

(ii) Maintain a current balance of all patron deposits that are in the cage/vault inventory 

or accountability; and 

(iii) Reconcile the current balance with the deposits and withdrawals at least daily. 
Class III Minimum Internal Controls Guidance

Page 50 of 81

2018

(f) Promotional payments, drawings, and giveaway programs. The following procedures must apply to 

any payment resulting from a promotional payment, drawing, or giveaway program disbursed by the 

cage department or any other department. This section does not apply to payouts for table game 

promotional pots and/or pools. 

(1) All payments must be documented to support the cage accountability. 

(2) Payments above $600 (or lesser amount as approved by TGRA) must be documented at the 

time of the payment, and documentation must include the following: 

(i) Date and time; 

(ii) Dollar amount of payment or description of personal property; 

(iii) Reason for payment; and 

(iv) Patron's name and confirmation that identity was verified (drawings only). 

(v) Signature(s) of at least two agents verifying, authorizing, and completing the 

promotional payment with the patron. For computerized systems that validate and print 

the dollar amount of the payment on a computer generated form, only one signature is 

required. 

(g) Chip(s) and token(s). Controls must be established and procedures implemented to ensure 

accountability of chip and token inventory. Such controls must include, but are not limited to, the 

following: 

(1) Purchase; 

(2) Receipt; 

(3) Inventory; 

(4) Storage; and 

(5) Destruction. 

(h) Vouchers. 

(1) Controls must be established and procedures implemented to: 

(i) Verify the authenticity of each voucher redeemed. 

(ii) If the voucher is valid, verify that the patron is paid the appropriate amount. 

(iii) Document the payment of a claim on a voucher that is not physically available or a 

voucher that cannot be validated such as a mutilated, expired, lost, or stolen voucher. 

(iv) Retain payment documentation for reconciliation purposes. 

(v) For manual payment of a voucher in an amount established by management and 

approved by the TGRA, require a supervisory employee to verify the validity of the 

voucher prior to payment. 

(2) Vouchers paid during a period while the voucher system is temporarily out of operation must 

be marked “paid” by the cashier. 

(3) Vouchers redeemed while the voucher system was temporarily out of operation must be 

validated as expeditiously as possible upon restored operation of the voucher system. 
Class III Minimum Internal Controls Guidance

Page 51 of 81

2018

(4) Paid vouchers must be maintained in the cashier's accountability for reconciliation purposes. 

(5) Unredeemed vouchers can only be voided in the voucher system by supervisory employees. 

The accounting department will maintain the voided voucher, if available. 

(i) Cage and vault access. Controls must be established and procedures implemented to: 

(1) Restrict physical access to the cage to cage agents, designated staff, and other authorized 

persons; and 

(2) Limit transportation of extraneous items such as personal belongings, tool boxes, beverage 

containers, etc., into and out of the cage. 

(j) Variances. The operation must establish, as approved by the TGRA, the threshold level at which a 

variance must be reviewed to determine the cause. Any such review must be documented.

§11. What are the minimum internal control standards for information technology and information 

technology data? 

(a) Supervision. 

(1) Controls must identify the supervisory agent in the department or area responsible for 

ensuring that the department or area is operating in accordance with established policies and 

procedures. 

(2) The supervisory agent must be independent of the operation of the gaming activity. 

(3) Controls must ensure that duties are adequately segregated and monitored to detect 

procedural errors and to prevent the concealment of fraud. 

(4) Information technology agents having access to gaming systems may not have signatory 

authority over financial instruments and payout forms and must be independent of and 

restricted from access to: 

(i) Financial instruments; 

(ii) Accounting, audit, and ledger entries; and 

(iii) Payout forms. 

(b) As used in this section only, a system is any computerized system that is integral to the gaming 

environment. This includes, but is not limited to, the server and peripherals for gaming system, 

accounting, surveillance, essential phone system, and door access and warning systems. 

(c) Gaming systems' logical and physical controls. Controls must be established and procedures 

implemented to ensure adequate: 

(1) Control of physical and logical access to the information technology environment, including 

accounting, voucher, cashless and player tracking systems, among others used in conjunction 

with gaming; 

(2) Physical and logical protection of storage media and its contents, including recovery 

procedures; 

(3) Access credential control methods; 

(4) Record keeping and audit processes; and 
Class III Minimum Internal Controls Guidance

Page 52 of 81

2018

(5) Departmental independence, including, but not limited to, means to restrict agents that have 

access to information technology from having access to financial instruments. 

(d) Physical security. 

(1) The information technology environment and infrastructure must be maintained in a secured 

physical location such that access is restricted to authorized agents only. 

(2) Access devices to the systems' secured physical location, such as keys, cards, or fobs, must 

be controlled by an independent agent. 

(3) Access to the systems' secured physical location must be restricted to agents in accordance 

with established policies and procedures, which must include maintaining and updating a record 

of agents granted access privileges. 

(4) Network Communication Equipment must be physically secured from unauthorized access. 

(e) Logical security. 

(1) Controls must be established and procedures implemented to protect all systems and to 

ensure that access to the following is restricted and secured: 

(i) Systems' software and application programs; 

(ii) Data associated with gaming; and 

(iii) Communications facilities, systems, and information transmissions associated with 

gaming systems. 

(2) Unused services and non-essential ports must be disabled whenever possible. 

(3) Procedures must be implemented to ensure that all activity performed on systems is 

restricted and secured from unauthorized access, and logged. 

(4) Communications to and from systems via Network Communication Equipment must be 

logically secured from unauthorized access. 

(f) User controls. 

(1) Systems, including application software, must be secured with passwords or other means for 

authorizing access. 

(2) Management personnel or agents independent of the department being controlled must 

assign and control access to system functions. 

(3) Access credentials such as passwords, PINs, or cards must be controlled as follows: 

(i) Each user must have his or her own individual access credential; 

(ii) Access credentials must be changed at an established interval approved by the TGRA; 

and 

(iii) Access credential records must be maintained either manually or by systems that 

automatically record access changes and force access credential changes, including the 

following information for each user: 

(A) User's name; 

(B) Date the user was given access and/or password change; and 
Class III Minimum Internal Controls Guidance

Page 53 of 81

2018

(C) Description of the access rights assigned to user. 

(4) Lost or compromised access credentials must be deactivated, secured or destroyed within an 

established time period approved by the TGRA. 

(5) Access credentials of terminated users must be deactivated within an established time 

period approved by the TGRA. 

(6) Only authorized agents may have access to inactive or closed accounts of other users, such 

as player tracking accounts and terminated user accounts. 

(g) Installations and/or modifications. 

(1) Only TGRA authorized or approved systems and modifications may be installed. 

(2) Records must be kept of all new installations and/or modifications to gaming systems. These 

records must include, at a minimum: 

(i) The date of the installation or modification; 

(ii) The nature of the installation or change such as new software, server repair, 

significant configuration modifications; 

(iii) Evidence of verification that the installation or the modifications are approved; and 

(iv) The identity of the agent(s) performing the installation/modification. 

(3) Documentation must be maintained, such as manuals and user guides, describing the 

systems in use and the operation, including hardware. 

(h) Remote access. 

(1) Agents may be granted remote access for system support, provided that each access session

is documented and maintained at the place of authorization. The documentation must include: 

(i) Name of agent authorizing the access; 

(ii) Name of agent accessing the system; 

(iii) Verification of the agent's authorization; 

(iv) Reason for remote access; 

(v) Description of work to be performed; 

(vi) Date and time of start of end-user remote access session; and 

(vii) Date and time of conclusion of end-user remote access session. 

(2) All remote access must be performed via a secured method. 

(i) Incident monitoring and reporting. 

(1) Procedures must be implemented for responding to, monitoring, investigating, resolving, 

documenting, and reporting security incidents associated with information technology systems. 

(2) All security incidents must be responded to within an established time period approved by 

the TGRA and formally documented. 

(j) Data backups. 

(1) Controls must include adequate backup, including, but not limited to, the following: 
Class III Minimum Internal Controls Guidance

Page 54 of 81

2018

(i) Daily data backup of critical information technology systems; 

(ii) Data backup of critical programs or the ability to reinstall the exact programs as 

needed; 

(iii) Secured storage of all backup data files and programs, or other adequate protection; 

(iv) Mirrored or redundant data source; and 

(v) Redundant and/or backup hardware. 

(2) Controls must include recovery procedures, including, but not limited to, the following: 

(i) Data backup restoration; 

(ii) Program restoration; and 

(iii) Redundant or backup hardware restoration. 

(3) Recovery procedures must be tested on a sample basis at specified intervals at least 

annually. Results must be documented. 

(4) Backup data files and data recovery components must be managed with at least the same 

level of security and access controls as the system for which they are designed to support. 

(k) Software downloads. Downloads, either automatic or manual, must be performed in accordance with 

approved TGRA procedures. 

(l) Verifying downloads. Following download of any gaming system software, the gaming operation must 

verify the downloaded software using a software signature verification method. Using any method it 

deems appropriate, the TGRA must confirm the verification.

§12. What are the minimum internal control standards for drop and count?

(a) Supervision. Supervision must be provided for drop and count as needed by an agent(s) with 

authority equal to or greater than those being supervised.

(b) Count room access. Controls must be established and procedures implemented to limit physical 

access to the count room to count team agents, designated staff, and other authorized persons. Such 

controls must include the following:

(1) Count team agents may not exit or enter the count room during the count except for 

emergencies or scheduled breaks.

(2) Surveillance must be notified whenever count room agents exit or enter the count room 

during the count.

(3) The count team policy, at a minimum, must address the transportation of extraneous items 

such as personal belongings, tool boxes, beverage containers, etc., into or out of the count 

room.
Class III Minimum Internal Controls Guidance

Page 55 of 81

2018

(c) Count team. Controls must be established and procedures implemented to ensure security of the 

count and the count room to prevent unauthorized access, misappropriation of funds, forgery, theft, or 

fraud. Such controls must include the following:

(1) For Tier A and B operations, all counts must be performed by at least two agents. For Tier C 

operations, all counts must be performed by at least three agents.

(2) For Tier A and B operations, at no time during the count can there be fewer than two count 

team agents in the count room until the drop proceeds have been accepted into cage/vault 

accountability. For Tier C operations, at no time during the count can there be fewer than three 

count team agents in the count room until the drop proceeds have been accepted into 

cage/vault accountability.

(3) For Tier A and B operations, count team agents must be rotated on a routine basis such that 

the count team is not consistently the same two agents more than four days per week. This 

standard does not apply to gaming operations that utilize a count team of more than two 

agents. For Tier C operations, count team agents must be rotated on a routine basis such that 

the count team is not consistently the same three agents more than four days per week. This 

standard does not apply to gaming operations that utilize a count team of more than three 

agents.

(4) Functions performed by count team agents must be rotated on a routine basis.

(5) Count team agents must be independent of the department being counted. A cage/vault 

agent may be used if they are not the sole recorder of the count and do not participate in the 

transfer of drop proceeds to the cage/vault. An accounting agent may be used if there is an 

independent audit of all count documentation.

(d) Table game drop standards. Controls must be established and procedures implemented to ensure 

security of the drop process. Such controls must include the following:

(1) Surveillance must be notified when the drop is to begin so that surveillance may monitor the 

activities.

(2) At least two agents must be involved in the removal of the drop box, at least one of whom is 

independent of the table games department.

(3) Once the drop is started, it must continue until finished.

(4) All drop boxes may be removed only at the time previously designated by the gaming 

operation and reported to the TGRA. If an emergency drop is required, surveillance must be 

notified before the drop is conducted and the TGRA must be informed within a timeframe 

approved by the TGRA.
Class III Minimum Internal Controls Guidance

Page 56 of 81

2018

(5) All locked table game drop boxes must be removed from the tables by an agent independent 

of the table game shift being dropped;

(6) For any tables opened during the shift, a separate drop box must be placed on each table, or 

a gaming operation may utilize a single drop box with separate openings and compartments for 

each shift; and

(7) Table game drop boxes must be transported directly to the count room or other equivalently 

secure area by a minimum of two agents, at least one of whom is independent of the table 

game department, until the count takes place.

(8) All tables that were not open during a shift and therefore not part of the drop must be 

documented.

(9) All table game drop boxes must be posted with a number corresponding to a permanent 

number on the gaming table and marked to indicate game, table number, and shift, if 

applicable.

(e) Gaming machine and financial instrument storage component drop standards. 

(1) Surveillance must be notified when the drop is to begin so that surveillance may monitor the 

activities.

(2) At least two agents must be involved in the removal of the gaming machine and financial 

instrument storage component drop, at least one of whom is independent of the gaming 

machine department.

(3) All financial instrument storage components may be removed only at the time previously 

designated by the gaming operation and reported to the TGRA. If an emergency drop is 

required, surveillance must be notified before the drop is conducted and the TGRA must be 

informed within a timeframe approved by the TGRA.

(4) The financial instrument storage components must be removed by an agent independent of 

the gaming machine department, then transported directly to the count room or other 

equivalently secure area with comparable controls and locked in a secure manner until the 

count takes place.

(i) Security must be provided for the financial instrument storage components removed 

from gaming machines and awaiting transport to the count room.

(ii) Transportation of financial instrument storage components must be performed by a 

minimum of two agents, at least one of whom is independent of the gaming machine 

department.
Class III Minimum Internal Controls Guidance

Page 57 of 81

2018

(5) All financial instrument storage components must be posted with a number corresponding to 

a permanent number on the gaming machine.

(f) Table game count standards. 

(1) Access to stored, full table game drop boxes must be restricted to:

(i) Authorized members of the drop and count teams; and

(ii) In an emergency, authorized persons for the resolution of a problem.

(2) The table game count must be performed in a count room or other equivalently secure area 

with comparable controls.

(3) Access to the count room during the count must be restricted to members of the drop and 

count teams, with the exception of authorized observers, supervisors for resolution of 

problems, and authorized maintenance personnel.

(4) If counts from various revenue centers occur simultaneously in the count room, procedures 

must be in effect to prevent the commingling of funds from different revenue centers.

(5) Count equipment and systems must be tested, with the results documented, before the first 

count begins, to ensure the accuracy of the equipment.

(6) The table game drop boxes must be individually emptied and counted so as to prevent the 

commingling of funds between boxes until the count of the box has been recorded.

(i) The count of each box must be recorded in ink or other permanent form of 

recordation.

(ii) For counts that do not utilize a currency counter, a second count must be performed 

by a member of the count team who did not perform the initial count. Separate counts 

of chips and tokens must always be performed by members of the count team.

(iii) Coupons or other promotional items not included in gross revenue must be 

recorded on a supplemental document by either the count team members or 

accounting personnel. All single-use coupons must be cancelled daily by an authorized 

agent to prevent improper recirculation.

(iv) If a currency counter interface is used:

(A) It must be adequately restricted to prevent unauthorized access; and

(B) The currency drop figures must be transferred via direct communications 

line or computer storage media to the accounting department.
Class III Minimum Internal Controls Guidance

Page 58 of 81

2018

(7) If currency counters are utilized, a count team member must observe the loading and 

unloading of all currency at the currency counter, including rejected currency.

(8) Two counts of the currency rejected by the currency counter must be recorded per table, as 

well as in total. Posting rejected currency to a nonexistent table is prohibited.

(9) Table game drop boxes, when empty, must be shown to another member of the count team, 

to another agent observing the count, or to surveillance, provided that the count is monitored in 

its entirety by an agent independent of the count.

a) Orders for fill/credit, if applicable, shall be matched to the fill/credit slips. Fills and 

credits shall be traced to or recorded on the count sheet.

b) Pit marker issue and payment slips, if applicable, removed from the table game drop 

boxes shall either be:

i. Traced to or recorded on the count sheet by the count team; or

ii. Totaled by shift and traced to the totals documented by the computerized

system.

c) Accounting personnel shall verify the issue/payment slip for each table is accurate.

d) The opening/closing table inventory forms, if applicable, shall either be:

i. Examined and traced to or recorded on the count sheet; or

ii. If a computerized system is used, accounting personnel can trace the 

opening/closing table inventory forms to the count sheet. Discrepancies 

shall be investigated with the findings documented and maintained for 

inspection.

(10) Procedures must be implemented to ensure that any corrections to the count 

documentation are permanent and identifiable, and that the original, corrected information 

remains legible. Corrections must be verified by two count team agents.

(11) The count sheet must be reconciled to the total drop by a count team member who may 

not function as the sole recorder, and variances must be reconciled and documented.

(12) All count team agents must sign the count sheet attesting to their participation in the 

count.

(13) A final verification of the total drop proceeds, before transfer to cage/vault, must be 

performed by at least two agents, one of whom is a supervisory count team member, and the 

other a count team agent.

(i) Final verification must include a comparison of currency counted totals against the 

currency counter/system report, if any counter/system is used.
Class III Minimum Internal Controls Guidance

Page 59 of 81

2018

(ii) Any unresolved variances must be documented, and the documentation must 

remain part of the final count record forwarded to accounting.

(iii) This verification does not require a complete recount of the drop proceeds, but does 

require a review sufficient to verify the total drop proceeds being transferred.

(iv) The two agents must sign the report attesting to the accuracy of the total drop 

proceeds verified.

(v) All drop proceeds and cash equivalents that were counted must be submitted to the 

cage or vault agent (who must be independent of the count team), or to an agent 

independent of the revenue generation source and the count process, for verification. 

The agent must certify, by signature, the amount of the drop proceeds delivered and 

received. Any unresolved variances must be reconciled, documented, and/or 

investigated by accounting/revenue audit.

(14) After verification by the agent receiving the funds, the drop proceeds must be transferred 

to the cage/vault.

(i) The count documentation and records must not be transferred to the cage/vault with 

the drop proceeds.

(ii) The cage/vault agent must not have knowledge or record of the drop proceeds total 

before it is verified.

(iii) All count records must be forwarded to accounting or secured and accessible only by 

accounting agents.

(iv) The cage/vault agent receiving the transferred drop proceeds must sign the count 

sheet attesting to the verification of the total received, and thereby assume 

accountability of the drop proceeds, ending the count.

(v) Any unresolved variances between total drop proceeds recorded on the count sheet 

and the cage/vault final verification during transfer must be documented and 

investigated.

(15) The count sheet, with all supporting documents, must be delivered to the accounting 

department by a count team member or an agent independent of the cage/vault. Alternatively, 

it may be secured so that it is only accessible only by the accounting department.

(g) Gaming machine financial instrument count standards. 

(1) Access to stored full financial instrument storage components must be restricted to:
Class III Minimum Internal Controls Guidance

Page 60 of 81

2018

(i) Authorized members of the drop and count teams; and

(ii) In an emergency, authorized persons for the resolution of a problem.

(2) The gaming machine financial instrument count must be performed in a count room or other 

equivalently secure area with comparable controls.

(3) Access to the count room during the count must be restricted to members of the drop and 

count teams, with the exception of authorized observers, supervisors for resolution of 

problems, and authorized maintenance personnel.

(4) If counts from various revenue centers occur simultaneously in the count room, procedures 

must be in effect that prevent the commingling of funds from different revenue centers.

(5) The count team must not have access to amount-in or bill-in meter amounts until after the 

count is completed and the drop proceeds are accepted into the cage/vault accountability.

(6) Count equipment and systems must be tested, and the results documented, before the first 

count begins, to ensure the accuracy of the equipment.

(7) If a currency counter interface is used:

(i) It must be adequately restricted to prevent unauthorized access; and

(ii) The currency drop figures must be transferred via direct communications line or 

computer storage media to the accounting department.

(8) The financial instrument storage components must be individually emptied and counted so 

as to prevent the commingling of funds between storage components until the count of the 

storage component has been recorded.

(i) The count of each storage component must be recorded in ink or other permanent 

form of recordation.

(ii) Coupons or other promotional items not included in gross revenue may be recorded 

on a supplemental document by the count team members or accounting personnel. All 

single-use coupons must be cancelled daily by an authorized agent to prevent improper 

recirculation.

(9) If currency counters are utilized, a count team member must observe the loading and 

unloading of all currency at the currency counter, including rejected currency.
Class III Minimum Internal Controls Guidance

Page 61 of 81

2018

(10) Two counts of the currency rejected by the currency counter must be recorded per 

interface terminal as well as in total. Rejected currency must be posted to the gaming machine 

from which it was collected.

(11) Storage components, when empty, must be shown to another member of the count team, 

to another agent observing the count, or to surveillance, provided that the count is monitored in 

its entirety by an agent independent of the count.

(12) Procedures must be implemented to ensure that any corrections to the count 

documentation are permanent, identifiable and the original, corrected information remains 

legible. Corrections must be verified by two count team agents.

(13) The count sheet must be reconciled to the total drop by a count team member who may 

not function as the sole recorder, and variances must be reconciled and documented. This 

standard does not apply to vouchers removed from the financial instrument storage 

components.

(14) All count team agents must sign the report attesting to their participation in the count.

(15) A final verification of the total drop proceeds, before transfer to cage/vault, must be 

performed by the at least two agents, one of whom is a supervisory count team member and 

the other a count team agent.

(i) Final verification must include a comparison of currency counted totals against the 

currency counter/system report, if a counter/system is used.

(ii) Any unresolved variances must be documented and the documentation must remain 

a part of the final count record forwarded to accounting.

(iii) This verification does not require a complete recount of the drop proceeds but does 

require a review sufficient to verify the total drop proceeds being transferred.

(iv) The two agents must sign the report attesting to the accuracy of the total drop 

proceeds verified.

(v) All drop proceeds and cash equivalents that were counted must be turned over to 

the cage or vault cashier (who must be independent of the count team) or to an agent 

independent of the revenue generation and the count process for verification. Such 

cashier or agent must certify, by signature, the amount of the drop proceeds delivered 

and received. Any unresolved variances must be reconciled, documented, and/or 

investigated by accounting/revenue audit.
Class III Minimum Internal Controls Guidance

Page 62 of 81

2018

(16) After certification by the agent receiving the funds, the drop proceeds must be transferred 

to the cage/vault.

(i) The count documentation and records must not be transferred to the cage/vault with 

the drop proceeds.

(ii) The cage/vault agent must not have knowledge or record of the drop proceeds total 

before it is verified.

(iii) All count records must be forwarded to accounting secured and accessible only by 

accounting agents.

(iv) The cage/vault agent receiving the transferred drop proceeds must sign the count 

sheet attesting to the verification of the total received, and thereby assuming 

accountability of the drop proceeds, and ending the count.

(v) Any unresolved variances between total drop proceeds recorded on the count room 

report and the cage/vault final verification during transfer must be documented and 

investigated.

(17) The count sheet, with all supporting documents, must be delivered to the accounting 

department by a count team member or agent independent of the cage/vault. Alternatively, it 

may be adequately secured and accessible only by the accounting department.

(h) Collecting currency cassettes and financial instrument storage components from kiosks. Controls 

must be established and procedures implemented to ensure that currency cassettes and financial 

instrument storage components are securely removed from kiosks. Such controls must include the 

following:

(1) Surveillance must be notified prior to the financial instrument storage components or 

currency cassettes being accessed in a kiosk.

(2) At least two agents must be involved in the collection of currency cassettes and/or financial 

instrument storage components from kiosks and at least one agent should be independent of 

kiosk accountability.

(3) Currency cassettes and financial instrument storage components must be secured in a 

manner that restricts access to only authorized agents.

(4) Redeemed vouchers collected from the kiosk must be secured and delivered to the 

appropriate department (cage or accounting) for reconciliation.

(5) Controls must be established and procedures implemented to ensure that currency cassettes 

contain the correct denominations and have been properly installed.
Class III Minimum Internal Controls Guidance

Page 63 of 81

2018

(i) Kiosk count standards. 

(1) Access to stored full kiosk financial instrument storage components and currency cassettes 

must be restricted to:

(i) Authorized agents; and

(ii) In an emergency, authorized persons for the resolution of a problem.

(2) The kiosk count must be performed in a secure area, such as the cage or count room.

(3) If counts from various revenue centers and kiosks occur simultaneously in the count room, 

procedures must be in effect that prevent the commingling of funds from the kiosks with any 

revenue centers.

(4) The kiosk financial instrument storage components and currency cassettes must be 

individually emptied and counted so as to prevent the commingling of funds between kiosks 

until the count of the kiosk contents has been recorded.

(i) The count of kiosk financial instrument storage components and currency cassettes 

must be recorded in ink or other permanent form of recordation.

(ii) Coupons or other promotional items not included in gross revenue (if any) may be 

recorded on a supplemental document. All single-use coupons must be cancelled daily 

by an authorized agent to prevent improper recirculation.

(5) Procedures must be implemented to ensure that any corrections to the count 

documentation are permanent, identifiable, and the original, corrected information remains 

legible. Corrections must be verified by two agents.

(j) Variances. The operation must establish, as approved by the TGRA, the threshold level at which a 

variance must be reviewed to determine the cause. Any such review must be documented.

§13. What are the minimum internal control standards for auditing revenue?

(a) Supervision. Supervision must be provided as needed for auditing revenue by an agent(s) with 

authority equal to or greater than those being supervised.

(b) Independence. Audits must be performed by agent(s) independent of the transactions being audited.

(c) Documentation. The performance of revenue audit procedures, the exceptions noted, and the 

follow-up of all revenue audit exceptions must be documented and maintained.

(d) Controls must be established and procedures implemented to audit of each of the following 

operational areas:
Class III Minimum Internal Controls Guidance

Page 64 of 81

2018

(1) Keno.

(i) At least annually, foot the write on the restricted copy of the keno transaction report 

for a minimum of one shift and compare the total to the total as documented by the 

computer. 

(ii) For at least one shift every other month, perform the following: 

(A) Foot the customer copy of the payouts and trace the total to the payout 

report; and 

(B) Regrade at least 1% of the winning tickets using the payout schedule and 

draw ticket. 

(iii) For a minimum of five games per week, compare the video recording and/or digital 

record of the rabbit ears or wheel to the computer transaction summary; 

(iv) Daily, compare net cash proceeds to the audited win/loss by shift and investigate 

any large cash overages or shortages (i.e., in excess of $25.00); 

(v) Daily, review and regrade all winning tickets greater than or equal to $1,500, 

including all forms that document that proper authorizations and verifications were 

obtained and performed; 

(vi) Daily, review the documentation for payout adjustments made outside the 

computer and investigate large and frequent payments; 

(vii) Weekly, review personnel access listing for inappropriate functions an agent can 

perform; 

(viii) Review system exception information on a daily basis for propriety of transactions 

and unusual occurrences including changes to the personnel access listing; 

(ix) If a random number generator is used, then at least weekly review the numerical 

frequency distribution for potential patterns; and 

(x) Investigate and document results of all noted improper transactions or unusual 

occurrences. 

(xi) When the keno game is operated by one person: 

(A) The customer copies of all winning tickets in excess of $100 and at least 5% 

of all other winning tickets shall be regraded and traced to the computer payout 

report; 
Class III Minimum Internal Controls Guidance

Page 65 of 81

2018

(B) The video recording and/or digital record of rabbit ears or wheel shall be 

randomly compared to the computer game information report for at least 10% 

of the games during the shift; and 

(C) Review winning tickets for proper authorization. 

(xii) In the event any person performs the writer and deskman functions on the same 

shift, the procedures described in paragraphs (4)(xi)(A) and (B) of this section (using the 

sample sizes indicated) shall be performed on tickets written by that person. 

(xiii) Documentation (e.g., a log, checklist, etc.) that evidences the performance of all 

keno audit procedures shall be maintained. 

(2) Pari-mutuel.

(i) Review handle, commission, and breakage for each day's play and recalculate the net 

amount due to or from the systems operator on a weekly basis. 

(ii) Verify actual cash/cash equivalents turned in daily to the system's summary report 

for each cashier's drawer (Beginning balance, ( + ) fills (draws), ( + ) net write (sold less 

voids), (−) payouts (net of IRS withholding), (−) cashbacks (paids), (=) cash turn-in). 

(iii) Produce a gross revenue recap report to calculate gross revenue for each day's play 

and for a month-to-date basis, including the following totals: 

(A) Commission; 

(B) Positive breakage; 

(C) Negative breakage; 

(D) Track/event fees; 

(E) Track/event fee rebates; and 

(F) Purged tickets. 

(iv) All winning tickets and vouchers shall be physically removed from the kiosk for each 

day's play. 

(v) In the event a kiosk does not balance for a day's play, the auditor shall perform the 

following procedures: 

(A) Foot the winning tickets and vouchers deposited and trace to the totals of 

kiosk activity produced by the system; 
Class III Minimum Internal Controls Guidance

Page 66 of 81

2018

(B) Foot the listing of cashed vouchers and trace to the totals produced by the 

system; 

(C) Review all exceptions for propriety of transactions and unusual occurrences; 

(D) Review all voids for propriety; 

(E) Verify the results as produced by the system to the results provided by an 

independent source; 

(F) Regrade 1% of paid (cashed) tickets to ensure accuracy and propriety; and 

(G) When applicable, reconcile the totals of future tickets written to the totals 

produced by the system for both earned and unearned take, and review the 

reports to ascertain that future wagers are properly included on the day of the 

event. 

(vi) At least annually, foot the wagers for one day and trace to the total produced by the 

system. 

(vii) At least one day per quarter, recalculate and verify the change in the unpaid 

winners to the total purged tickets. 

(iv) At least monthly, review statistical reports for any deviations exceeding a specified 

threshold, as defined by the TGRA. Investigate and document any large and unusual 

fluctuations noted.

(3) Table games.

(i) If a table game has the capability to determine drop (e.g., bill-in/coin-drop meters, 

bill acceptor, computerized record, etc.) the dollar amount of the drop shall be 

reconciled to the actual drop by shift. 

(ii) Accounting/auditing agents shall review exception reports for all computerized table 

games systems at least monthly for propriety of transactions and unusual occurrences. 

(iii) All noted improper transactions or unusual occurrences shall be investigated with 

the results documented. 

(iv) A daily recap shall be prepared for the day and month-to-date, which shall include 

the following information: 

(A) Drop; 

(B) Win; and 
Class III Minimum Internal Controls Guidance

Page 67 of 81

2018

(C) Gross revenue.

(4) Gaming Machines.

(i) For on-line gaming machine monitoring systems, procedures shall be performed at 

least monthly to verify that the system is transmitting and receiving data from the 

gaming machines properly and to verify the continuing accuracy of the coin-in meter 

readings as recorded in the gaming machine statistical report. 

(ii) For weigh scale and currency interface systems, for at least one drop period per 

month accounting/auditing employees shall make such comparisons as necessary to the 

system generated count as recorded in the gaming machine statistical report. 

Discrepancies shall be resolved prior to generation/distribution of gaming machine 

reports. 

(iii) For each drop period, accounting/auditing personnel shall compare the coin-to-drop 

meter reading to the actual drop amount. Discrepancies should be resolved prior to 

generation/distribution of on-line gaming machine monitoring system statistical reports. 

(iv) For each drop period, accounting/auditing employees shall compare the bill-in 

meter reading to the total bill acceptor drop amount for the period. Discrepancies shall 

be resolved before the generation/distribution of gaming machine statistical reports. 

(v) At least monthly, review statistical reports for any deviations from the mathematical 

expectations exceeding a threshold established by the TGRA. 

(vi) At least monthly, take a random sample, foot the vouchers redeemed and trace the 

totals to the totals recorded in the voucher system and to the amount recorded in the 

applicable cashier's accountability document.

(vii) At least annually, accounting/auditing agents shall randomly verify that equivalent 

game software media changes are properly reflected in the gaming machine analysis 

reports. 

(viii) Review exception reports for all computerized gaming machine systems on a daily 

basis for propriety of transactions and unusual occurrences.

(5) Drop and count.

(i) At least quarterly, unannounced currency counter and currency counter interface (if 

applicable) tests must be performed, and the test results documented and maintained. 

All denominations of currency and all types of voucher counted by the currency counter 
Class III Minimum Internal Controls Guidance

Page 68 of 81

2018

must be tested. This test may be performed by internal audit or the TGRA. The result of 

these tests must be documented and signed by the agent(s) performing the test.

(ii) At least quarterly, unannounced weigh scale and weigh scale interface (if applicable) 

tests must be performed, and the test results documented and maintained. This test 

may be performed by internal audit or the TGRA. The result of these tests must be 

documented and signed by the agent(s) performing the test.

(iii) For computerized key security systems controlling access to drop and count keys, 

perform the following procedures:

(A) At least quarterly, review the report generated by the computerized key 

security system indicating the transactions performed by the individual(s) that 

adds, deletes, and changes users' access within the system (i.e., system 

administrator). Determine whether the transactions completed by the system 

administrator provide adequate control over the access to the drop and count 

keys. Also, determine whether any drop and count key(s) removed or returned 

to the key cabinet by the system administrator was properly authorized;

(B) At least quarterly, review the report generated by the computerized key 

security system indicating all transactions performed to determine whether any 

unusual drop and count key removals or key returns occurred; and

(C) At least quarterly, review a sample of users that are assigned access to the 

drop and count keys to determine that their access to the assigned keys is 

appropriate relative to their job position.

(iv) At least quarterly, an inventory of all controlled keys must be performed and 

reconciled to records of keys made, issued, and destroyed. Investigations must be 

performed for all keys unaccounted for, and the investigation documented.

(6) Gaming promotions and player tracking.

(i) At least monthly, review promotional payments, drawings, and giveaway programs to 

verify payout accuracy and proper accounting treatment in accordance with the rules 

provided to patrons.

(ii) At least monthly, for computerized player tracking systems, perform the following 

procedures:

(A) Review authorization documentation for all manual point 

additions/deletions for propriety;
Class III Minimum Internal Controls Guidance

Page 69 of 81

2018

(B) Review exception reports, including transfers between accounts; and 

(C) Review documentation related to access to inactive and closed accounts. 

(iii) At least annually, all computerized player tracking systems must be reviewed by 

agent(s) independent of the individuals that set up or make changes to the system 

parameters. The review must be performed to determine that the configuration 

parameters are accurate and have not been altered without appropriate management 

authorization Document and maintain the test results.

(7) Complimentary services or items. At least monthly, review the reports required in § 7(d). 

These reports must be made available to those entities authorized by the TGRA or by tribal law 

or ordinance.

(8) Patron deposit accounts.

(i) At least weekly, reconcile patron deposit account liability (deposits ± 

adjustments−withdrawals = total account balance) to the system record.

(ii) At least weekly, review manual increases and decreases to/from player deposit 

accounts to ensure proper adjustments were authorized.

(9) Lines of credit.

(i) At least three (3) times per year, an agent independent of the cage, credit, and 

collection functions must perform the following review:

(A) Select a sample of line of credit accounts;

(B) Ascertain compliance with credit limits and other established credit issuance 

procedures;

(C) Reconcile outstanding balances of both active and inactive (includes writeoffs and settlements) accounts on the accounts receivable listing to individual 

credit records and physical instruments. This procedure need only be performed 

once per year for inactive accounts; 

(D) Examine line of credit records to determine that appropriate collection 

efforts are being made and payments are being properly recorded; and 

(E) For at least five (5) days during the review period, subsequently reconcile 

partial payment receipts to the total payments recorded by the cage for the day 

and account for the receipts numerically.
Class III Minimum Internal Controls Guidance

Page 70 of 81

2018

(ii) At least monthly, perform an evaluation of the collection percentage of credit issued 

to identify unusual trends.

(10) Cage, vault, cash, and cash equivalents. 

(i) At least monthly, the cage accountability must be reconciled to the general ledger. 

(ii) At least monthly, trace the amount of cage deposits to the amounts indicated in the 

bank statements.

(iii) Twice annually, a count must be performed of all funds in all gaming areas (i.e.

cages, vaults, and booths (including reserve areas), kiosks, voucher redemption 

machines, and change machines. Count all chips and tokens by denomination and type. 

Count individual straps, bags, and imprest banks on a sample basis. Reconcile all 

amounts counted to the amounts recorded on the corresponding accountability forms 

to ensure that the proper amounts are recorded. Maintain documentation evidencing 

the amount counted for each area and the subsequent comparison to the 

corresponding accountability form. The count must be completed within the same 

gaming day for all areas. 

(A) Counts must be observed by an individual independent of the department 

being counted. It is permissible for the individual responsible for the funds to 

perform the actual count while being observed.

(B) Internal audit may perform and/or observe the two counts.

(iv) At least annually, select a sample of invoices for chips and tokens purchased, and 

trace the dollar amount from the purchase invoice to the accountability document that 

indicates the increase to the chip or token inventory to ensure that the proper dollar 

amount has been recorded.

(v) At each business year end, create and maintain documentation evidencing the 

amount of the chip/token liability, the change in the liability from the previous year, and 

explanations for adjustments to the liability account including any adjustments for 

chip/token float.

(vi) At least monthly, review a sample of returned checks to determine that the required 

information was recorded by cage agent(s) when the check was cashed. 

(vii) At least monthly, review exception reports for all computerized cage systems for 

propriety of transactions and unusual occurrences. The review must include, but is not 

limited to, voided authorizations. All noted improper transactions or unusual 

occurrences identified must be investigated and the results documented. 
Class III Minimum Internal Controls Guidance

Page 71 of 81

2018

(viii) Daily, reconcile all parts of forms used to document increases/decreases to the 

total cage inventory, investigate any variances noted, and document the results of such 

investigations. 

(11) Inventory

(i) At least monthly, verify receipt, issuance, and use of controlled inventory, including, 

but not limited to, bingo cards, pull tabs, playing cards, keys, pre-numbered and/or 

multi-part forms.

(ii) Periodically perform minimum bankroll calculations to ensure that the gaming 

operation maintains cash in an amount sufficient to satisfy the gaming operation’s 

obligations.

§14. What are the minimum internal control standards for audit and accounting?

(a) Conflicts of standards. When establishing SICS, the gaming operation should review, and consider 

incorporating, other external standards such as GAAP, GAAS, and standards promulgated by GASB and 

FASB. In the event of a conflict between the MICS and the incorporated external standards, the external 

standards prevail.

(b) Accounting. Controls must be established and procedures implemented to safeguard assets and 

ensure each gaming operation:

(1) Prepares accurate, complete, legible, and permanent records of all transactions pertaining to 

gaming revenue and activities for operational accountability.

(2) Prepares general accounting records on a double-entry system of accounting, maintaining 

detailed, supporting, subsidiary records, and performs the following activities:

(i) Record gaming activity transactions in an accounting system to identify and track all 

revenues, expenses, assets, liabilities, and equity;

(ii) Record all markers, IOU's, returned checks, held checks, or other similar credit 

instruments;

(iii) Record journal entries prepared by the gaming operation and by any independent 

accountants used;

(iv) Prepare income statements and balance sheets;

(v) Prepare appropriate subsidiary ledgers to support the balance sheet;

(vi) Prepare, review, and maintain accurate financial statements;
Class III Minimum Internal Controls Guidance

Page 72 of 81

2018

(vii) Prepare transactions in accordance with the appropriate authorization, as provided 

by management;

(viii) Record transactions to facilitate proper recording of gaming revenue and fees, and 

to maintain accountability of assets;

(ix) Compare recorded accountability for assets to actual assets at periodic intervals, and 

take appropriate action with respect to any variances;

(x) Segregate functions, duties, and responsibilities;

(xi) Prepare minimum bankroll calculations; and

(xii) Maintain and preserve all financial records and relevant supporting documentation.

(c) Internal audit. Controls must be established and procedures implemented to ensure that:

(1) Internal auditor(s) perform audits of each department of a gaming operation, at least 

annually, to review compliance with TICS, SICS, and these MICS, which include at least the 

following areas:

(i) Keno, including supervision, game play standards, rabbit ear or wheel system, 

random number generator, prize payout, cash and cash equivalents, promotional 

payouts or awards, statistical reports, system security, documentation, equipment, 

document retention, multi-race tickets, and manual keno;

(ii) Pari-mutuel, including, supervision, exemptions, betting ticket and equipment 

standards, payout standards, check-out standards, and computer report standards;

(iii) Table games, including supervision, fill and credit procedures, table inventory forms, 

standards for playing cards and dice, plastic cards, analysis of table game performance, 

marker credit play, name credit instruments, call bets, rim credit, and foreign currency;

(iv) Gaming machines, including supervision, access listing, prize payout and fills, cash 

and cash equivalent controls, gaming machine components, operations, vouchers, 

standards for evaluating theoretical and actual hold percentages, gaming machine drop 

and hopper contents standards, in-house progressive gaming machine standards, widearea progressive gaming machine standards, and account access cards;

(v) Gaming promotions and player tracking procedures, including supervision, gaming 

promotion rules and player tracking systems;

(vi) Complimentary services or items, including procedures for issuing, authorizing, 

redeeming, and reporting complimentary service items;
Class III Minimum Internal Controls Guidance

Page 73 of 81

2018

(vii) Patron deposit accounts and cashless systems procedures, including supervision, 

patron deposit accounts and cashless systems, as well as patron deposits, withdrawals 

and adjustments;

(viii) Lines of credit procedures, including establishment of lines of credit policy;

(ix) Drop and count standards, including supervision, count room access, count team, 

table game drop standards, gaming machine and financial instrument drop standards, 

table game count standards, gaming machine financial instrument count standards, 

collecting currency cassettes and financial instrument storage components from kiosks, 

kiosk count standards, and controlled keys;

(x) Cage, vault, cash and cash equivalent procedures, including supervision, cash and 

cash equivalents, personal checks, cashier's checks, traveler's checks, payroll checks, 

and counter checks, cage and vault accountability, kiosks, patron deposited funds, 

promotional payouts, drawings, and giveaway programs, chip and token standards, and 

cage and vault access;

(xi) Information technology, including supervision, systems' logical and physical controls, 

independence, physical security, logical security, user controls, installations and/or 

modifications, remote access, incident monitoring and reporting, data back-ups, 

software downloads, and verifying downloads; and

(xii) Accounting standards, including accounting records, maintenance and preservation 

of financial records and relevant supporting documentation.

(2) Internal auditor(s) are independent of gaming operations with respect to the departments 

subject to audit (auditors internal to the operation, officers of the TGRA, or outside CPA firm 

may perform this function).

(3) Internal auditor(s) report directly to the Tribe, TGRA, audit committee, or other entity 

designated by the Tribe.

(4) Documentation such as checklists, programs, reports, etc. is prepared to evidence all internal 

audit work and follow-up performed as it relates to compliance with TICS, SICS, and these MICS, 

including all instances of noncompliance.

(5) Audit reports are maintained and made available to the Commission upon request and must 

include the following information:

(i) Audit objectives;

(ii) Audit procedures and scope;
Class III Minimum Internal Controls Guidance

Page 74 of 81

2018

(iii) Findings and conclusions;

(iv) Recommendations, if applicable; and

(v) Management's response.

(6) All material exceptions identified by internal audit work are investigated and resolved and 

the results are documented.

(7) Internal audit findings are reported to management, responded to by management stating 

corrective measures to be taken, and included in the report delivered to management, the 

Tribe, TGRA, audit committee, or other entity designated by the Tribe for corrective action.

(8) Follow-up observations and examinations is performed to verify that corrective action has 

been taken regarding all instances of non-compliance. The verification is performed within six 

(6) months following the date of notification of non-compliance.

(d) Annual requirements. 

(1) Agreed upon procedures. A CPA independent of the gaming operation must be engaged to 

perform an assessment to verify whether the gaming operation is in compliance with these 

MICS, and/or the TICS or SICS if they provide at least the same level of controls as the MICS. The 

assessment must be performed in accordance with agreed upon procedures and the most 

recent versions of the Statements on Standards for Attestation Engagements and Agreed-Upon 

Procedures Engagements (collectively “SSAEs”), issued by the American Institute of Certified 

Public Accountants.

(2) The tribe must submit a copy of the agreed-upon procedures report to the Commission 

within 120 days of the gaming operation's fiscal year end in conjunction with the submission of 

the annual financial audit report required pursuant to 25 CFR part 571.

(3) Review of internal audit.

(i) The CPA must determine compliance by the gaming operation with the internal audit 

requirements in this paragraph (d) by:

(A) Completing the internal audit checklist;

(B) Ensuring that the internal auditor completed checklists for each gaming 

department of the operation;

(C) Verifying that any areas of non-compliance have been identified;
Class III Minimum Internal Controls Guidance

Page 75 of 81

2018

(D) Ensuring that audit reports are completed and include responses from 

management; and

(E) Verifying that appropriate follow-up on audit findings has been conducted 

and necessary corrective measures have been taken to effectively mitigate the 

noted risks.

(ii) If the CPA determines that the internal audit procedures performed during the fiscal 

year have been properly completed, the CPA may rely on the work of the internal audit 

for the completion of the MICS checklists as they relate to the standards covered by this 

part.

(4) Report format. The SSAEs are applicable to agreed-upon procedures engagements required 

in this part. All noted instances of noncompliance with the MICS and/or the TICS or SICS, if they 

provide the same level of controls as the MICS, must be documented in the report with a 

narrative description, the number of exceptions and sample size tested.

§15. What are the minimum internal control standards for surveillance?

(a) Supervision. Supervision must be provided as needed for surveillance by an agent(s) with authority 

equal to or greater than those being supervised.

(b) Surveillance equipment and control room(s). Controls must be established and procedures 

implemented that include the following:

(1) For Tier A, the surveillance system must be maintained and operated from a secured 

location, such as a locked cabinet. For Tiers B and C, the surveillance system must be maintained 

and operated from a staffed surveillance operation room(s).

(2) The surveillance operation room(s) must be secured to prevent unauthorized entry.

(3) Access to the surveillance operation room(s) must be limited to surveillance agents and 

other authorized persons.

(4) Surveillance operation room(s) access logs must be maintained.

(5) Surveillance operation room equipment must have total override capability over all other 

satellite surveillance equipment.

(6) Power loss to the surveillance system:

(i) For Tier A, in the event of power loss to the surveillance system, alternative security 

procedures, such as additional supervisory or security agents, must be implemented 

immediately.
Class III Minimum Internal Controls Guidance

Page 76 of 81

2018

(ii) For Tier B and C, in the event of power loss to the surveillance system, an auxiliary or 

backup power source must be available and capable of providing immediate restoration 

of power to the surveillance system to ensure that surveillance agents can observe all 

areas covered by dedicated cameras.

(7) The surveillance system must record an accurate date and time stamp on recorded events. 

The displayed date and time must not significantly obstruct the recorded view.

(8) All surveillance agents must be trained in the use of the equipment, games, and house rules.

(9) Each camera required by the standards in this section must be installed in a manner that will 

prevent it from being readily obstructed, tampered with, or disabled.

(10) The surveillance system must:

(i) Have the capability to display all camera views on a monitor;

(ii) Include sufficient numbers of recording devices to record the views of all cameras 

required by this section;

(iii) Record all camera views; and

(iv) For Tier B and C only, include sufficient numbers of monitors to simultaneously 

display gaming and count room activities.

(11) A periodic inspection of the surveillance systems must be conducted. When a malfunction 

of the surveillance system is discovered, the malfunction and necessary repairs must be 

documented and repairs initiated within seventy-two (72) hours.

(i) If a dedicated camera malfunctions, alternative security procedures, such as 

additional supervisory or security agents, must be implemented immediately.

(ii) The TGRA must be notified of any surveillance system and/or camera(s) that have 

malfunctioned for more than twenty-four (24) hours and the alternative security 

measures being implemented.

(c) Additional surveillance requirements. With regard to the following functions, controls must also 

include:

(1) Surveillance of the progressive prize meters for gaming systems at the following thresholds:

(i) Wide area progressives with a reset amount of $1 million; and

(ii) In-house progressives with a reset amount of $250,000.
Class III Minimum Internal Controls Guidance

Page 77 of 81

2018

(2) Gaming machines:

(i) Except as otherwise provided in paragraphs (c)(1) of this section, gaming machines 

offering a payout of more than $250,000 shall be monitored and recorded by a 

dedicated camera(s) to provide coverage of:

(A) All customers and employees at the gaming machine, and

(B) The face of the gaming machine, with sufficient clarity to identify the payout 

line(s) of the gaming machine.

(3) Pari-mutuel:

(i) Monitor and record general activities in the pari-mutuel area, to include the ticket 

writer and cashier areas, with sufficient clarity to identify the agents performing the 

different functions.

(4) Table games:

(i) Except for table game tournaments, a dedicated camera(s) with sufficient clarity must 

be used to provide:

(A) An overview of the activities on each table surface, including card faces and 

cash and/or cash equivalents; and

(B) An overview of table game activities, including patrons and dealers.

(ii) For table game tournaments, a dedicated camera(s) must be used to provide an 

overview of tournament activities, and any area where cash or cash equivalents are 

exchanged.

(iii) Progressive table games. 

(A) Progressive table games with a progressive jackpot of $25,000 or 

more shall be monitored and recorded by dedicated cameras that 

provide coverage of:

(1) The table surface, sufficient that the card values and card 

suits can be clearly identified;

(2) An overall view of the entire table with sufficient clarity to 

identify customers and dealer; and
Class III Minimum Internal Controls Guidance

Page 78 of 81

2018

(3) A view of the progressive meter jackpot amount. If several 

tables are linked to the same progressive jackpot meter, only 

one meter need be recorded.

(5) Keno:

(i) Monitor the keno ball-drawing device or random number generator, which shall be 

recorded during the course of the draw by a dedicated camera with sufficient clarity to 

identify the balls drawn or numbers selected.

(iv) Monitor and record general activities in each keno game area with sufficient clarity 

to identify the agents performing the different functions.

(6) Cage and vault:

(i) The surveillance system must monitor and record a general overview of activities 

occurring in each cage and vault area with sufficient clarity to identify individuals within 

the cage and patrons and staff members at the counter areas and to confirm the 

amount of each cash transaction;

(ii) Each cashier station must be equipped with one (1) dedicated overhead camera 

covering the transaction area; and

(iii) The cage or vault area in which exchange and transfer transactions occur must be 

monitored and recorded by a dedicated camera or motion activated dedicated camera 

that provides coverage with sufficient clarity to identify the chip values and the amounts 

on the exchange and transfer documentation. Controls provided by a computerized 

exchange and transfer system constitute an adequate alternative to viewing the 

amounts on the exchange and transfer documentation.

(7) Count rooms:

(i) The surveillance system must monitor and record with sufficient clarity a general 

overview of all areas where cash or cash equivalents may be stored or counted; and

(ii) The surveillance system must provide coverage of count equipment with sufficient 

clarity to view any attempted manipulation of the recorded data.

(8) Kiosks: The surveillance system must monitor and record a general overview of activities 

occurring at each kiosk with sufficient clarity to identify the activity and the individuals 

performing it, including maintenance, drops or fills, and redemption of wagering vouchers or 

credits.
Class III Minimum Internal Controls Guidance

Page 79 of 81

2018

(d) Reporting requirements. TGRA approved procedures must be implemented for reporting suspected 

crimes and suspicious activity.

(e) Recording retention. Controls must be established and procedures implemented that include the 

following:

(1) All recordings required by this section must be retained for a minimum of seven days; and

(2) Suspected crimes, suspicious activity, or detentions by security agents discovered within the 

initial retention period must be copied and retained for a time period, not less than one year.

(f) Logs. Logs must be maintained and demonstrate the following:

(1) Compliance with the storage, identification, and retention standards required in this section;

(2) Each malfunction and repair of the surveillance system as defined in this section; and

(3) Activities performed by surveillance agents as required by the controls in this section.

§16. What are the minimum internal control standards for controlled keys?

(a) Supervision. Supervision must be provided over controlled keys as needed by an agent(s) with 

authority equal to or greater than those being supervised.

(b) Custody of all keys involved in the drop and count must be maintained by a department independent 

of the count and the drop agents as well as those departments being dropped and counted.

(c) Controls must be established and procedures implemented to safeguard the use, access, and security 

of keys in accordance with the following:

(1) Each of the following requires a separate and unique key lock or alternative secure access 

method:

(i) Drop cabinet;

(ii) Drop box release;

(iii) Drop box content; 

(iv) Bill acceptor canister release;

(v) Bill acceptor canister content;

(vi) Count room keys;
Class III Minimum Internal Controls Guidance

Page 80 of 81

2018

(vii) Storage racks and carts;

(viii) Kiosk release; and

(ix) Kiosk contents.

(2) Access to and return of keys or equivalents must be documented with the date, time, and 

signature or other unique identifier of the agent accessing or returning the key(s).

(i) For Tier A and B operations, at least two drop team agents are required to be 

present to access and return keys. For Tier C operations, at least three drop team 

agents are required to be present to access and return keys.

(ii) For Tier A and B operations, at least two count team agents are required to be 

present at the time count room and other count keys are issued for the count. For Tier C 

operations with four tables or more, at least three count team agents are required to be 

present at the time count keys are issued for the count. For Tier C operations with three 

tables or fewer, at least two count team agents are required to be present at the time 

count keys are issued for the count.

(3) Documentation of all keys, including duplicates, must be maintained, including: 

(i) Unique identifier for each individual key;

(ii) Key storage location;

(iii) Number of keys made, duplicated, and destroyed; and

(iv) Authorization and access.

(4) Other than the count team, no agent may have access to the drop box/storage component 

content keys while in possession of storage rack keys and/or release keys.

(5) Other than the count team, only agents authorized to remove drop boxes/storage 

component are allowed access to drop box/storage component release keys.

(6) Any use of keys at times other than the scheduled drop and count must be properly 

authorized and documented.

(7) Emergency manual keys, such as an override key, for computerized, electronic, and 

alternative key systems must be maintained in accordance with the following:

(i) Access to the emergency manual key(s) used to access the box containing the player 

interface drop and count keys requires the physical involvement of at least three agents 

from separate departments, including management. The date, time, and reason for 
Class III Minimum Internal Controls Guidance

Page 81 of 81

2018

access, must be documented with the signatures of all participating persons signing 

out/in the emergency manual key(s);

(ii) The custody of the emergency manual keys requires the presence of two agents from 

separate departments from the time of their issuance until the time of their return; and

(iii) Routine physical maintenance that requires access to the emergency manual key(s), 

and does not involve accessing the gaming machine drop and count keys, only requires 

the presence of two agents from separate departments. The date, time, and reason for 

access must be documented with the signatures of all participating agents signing out/in 

the emergency manual key(s).