Frequently Asked Questions – Agreed‐upon Procedures Requirements

Issued August 24, 2022

The most current version of this document is available at www.NIGC.gov  

The NIGC Division of Compliance maintains this list of Frequently Asked Questions (FAQ) in consultation

with the NIGC’s Office of General Counsel and the Commission. This collection of FAQs is updated as

needed. To propose a question for this FAQ list, please coordinate with a Tribal Gaming Regulatory

Authority (TGRA) and submit the question to audit_mics_inquiry@nigc.gov. The NIGC encourages all

TGRAsto remain in close communication with their NIGC Region Office and assigned NIGC Auditor astribal

gaming operations assess and address the questions associated with the Agreed‐Upon Procedures

requirements.  

1. Question: What is an AUP?

Answer: §543.23(d) outlines the performance of Agreed‐upon Procedures (AUP). The Agreed

Upon Procedures engagement identified in the NIGC’s regulations is an annual review where an

independent CPA verifies whether a gaming operation is in compliance, at a minimum, with the

Minimum Internal Control Standards (MICS). Many Tribes choose to engage the independent CPA

to ensure the gaming operation is in compliance with the Tribal Internal Control Standards (TICS)

and the System of Internal Control Standards (SICS). §543.23(d)(1) states, “...A CPA must be

engaged to perform an assessment to verify whether the gaming operation is in compliance with

these MICS, and/or the TICS or SICS if they provide at least the same level of controls as the MICS.

The assessment must be performed in accordance with agreed upon procedures and the most

recent versions of the Statements on Standards for Attestation Engagements and Agreed‐Upon

Procedures Engagements (collectively “SSAEs”), issued by the American Institute of Certified

Public Accountants.”

More specifically defined by the AICPA1

, an AUP is an attestation engagement in which a CPA

performs specific procedures on subject matter and reports the findings without providing an

opinion or conclusion. The subject matter in this instance is to assess compliance with the

applicable portions of 25 CFR Part 543, Minimum Internal Control Standards (MICS) for Class II

gaming.  

                                                            

1 SSAE 19 par. .02
Page 2 of 4

2. Question: Who is required to submit an Agreed‐Upon Procedures report?

Answer: §543.23(d)(2)  requires tribes to submit copies of the  Agreed‐upon Procedures (AUP)

report to the Commission within 120 days of the gaming operation’s fiscal year end.   

All operations licensed pursuant to the Indian Gaming Regulatory Act (IGRA), provide Class II

gaming, and are required to be compliant with MICS 543 are required to submit AUP reports to

the NIGC unless they meet an allowable exemption.

Finally, as identified in Bulletin No. 2013‐01, “... the NIGC will continue to accept combined AUP

reports covering both Class II and Class III gaming.” However, under NIGC regulations, the AUP

reports for Class III MICS are not required to be submitted unless required by an approved tribal

gaming ordinance, an approved tribal‐state gaming compact or Secretarial Procedures.

3. Question: Are there any exemptions to the AUP submission requirement?

Answer: Unless required by an approved tribal gaming ordinance, an approved tribal‐state

gaming compact or Secretarial Procedures, operations which only offer Class III gaming are

exempt from the AUP submission requirement. Asidentified in Bulletin No. 2022‐02, Tribes which

have been issued a Certificate of Self‐Regulation are not required to submit an AUP for Class II

gaming. The only remaining exemptions to the AUP submission requirements for Class II

operations are outlined in §543.4 and §543.5.  

§543.4 outlines the avenue for a TGRA to provide exemptions for small gaming operations or

charitable gaming operations which have been explicitly exempted from any or all of MICS part

543 and meet the definitions of Small or Charitable. This is achieved through the process of

developing TICS and alternate procedures, or by resolution. In the event the small or charitable

gaming operation receives an exemption and/or develops alternate procedures, it is

recommended that the TGRA notify the NIGC of such occurrence to   prevent an unnecessary

enforcement action.

Another potential exemption for operations which provide Class II gaming but are not Small or

Charitable is to apply for an alternate minimum standard, as outlined in §543.5, which would

require the approval of the NIGC Chairman. However, the alternate standard must achieve a level

of security and integrity sufficient to accomplish the purpose of the standard it is to replace, in

this case the testing of the operations compliance with MICS/TICS/SICS by a licensed CPA.  

In exempting the small or charitable gaming operation from Part 543, the TGRA is exempting the

operations from the AUP requirement in part 543.  However, through its approved TICS or SICS,

the TGRA may require an AUP be conducted and provided to the tribe and/or TGRA. The TGRA

may further require the AUP be submitted to the NIGC.   

4. Question: Did the operation have enough in gaming revenues in a given fiscal year to be required

to submit an AUP?  

Answer: Revenue is not the determining factor regarding AUP report submission to the NIGC.

There is not a revenue threshold for the AUP requirements become effective. As discussed above,

only operations which have been exempted by the TGRA and have approved alternative
Page 3 of 4

procedures which do not require an AUP are precluded from engaging a CPA to perform an AUP

and submitting the report within the 120 days required by the MICS.

5. Question: When is the AUP due and how can it be submitted?

Answer: §543.23(d) requires the submission of Agreed‐upon Procedures (AUP). §543.23(d)(2)

states, “The tribe must submit two copies of the agreed‐upon procedures report to the

Commission within 120 days of the gaming operation's fiscal year end in conjunction with the

submission of the annual financial audit report required pursuant to 25 C.F.R. part 571.”  

Tribes may submit the AUP report(s) electronically, a paper copy by mail, or both. Electronic

submissions can be made by email to Financials_AUPfilings@nigc.gov. Paper copies can be mailed

to the following address:

NIGC Attn: Finance

c/o Department of the Interior

1849 C Street, N.W.

Mail Stop # 1621

Washington, DC 20240

Mailed copies should be post marked by the due date and electronic copies should be emailed by

the due date unless the deadline falls on a weekend or holiday, which push the due date to the

next business day.  

6. Question: Why is NIGC asking for a copy of the Internal Audit reportsto be included with the AUP?

Answer: The Internal Audit report is only required to be submitted with the AUP when the CPA

relies on the work of the Internal Audit but does not include the Internal Audit findings in the AUP

report.  

More specifically, §543.23(d)(3) requires the CPA to review the Internal Audit and determine

compliance with internal audit requirements as outlined in §543.23(d)(3)(i). §543.23(d)(3)(i)

states, “If the CPA determines that the internal audit procedures performed during the fiscal year

have been properly completed, the CPA may rely on the work of the internal audit for the

completion of the MICS checklists as they relate to the standards covered by this part.”  

In practice, if the CPA relies on the work of Internal Audit, then it will be identified in the AUP

report, including any findings with regard to Internal Audit. If the CPA relies on the work of Internal

Audit, then the Internal Audit findings need to be communicated to the NIGC. In some instances,

the CPA will include an attachment or appendix which identifies the Internal Auditor’s findings. If

the CPA does not include the Internal Auditors findings in their report, then the Tribe should

include the Internal Audit report(s) with the AUP submission.

Note: Although MICS Part 543 does not require the CPA to retest 3% and 5% of the Internal Audit

work, as was required in §542.3(f)(3)(B), it is recommended the CPA perform such testing when

relying on the work of internal audit.
Page 4 of 4

7. Question: If requested, will the NIGC grant an extension for the AUP submission?

Answer: No. IGRA and NIGC regulations do not provide for extensions to the statutory and

regulatory deadlines. If the Tribe or operation encounters a situation where the AUP will be late

and the required submission date will not be met, then the Tribe should notify the Region,

describe the circumstance and provide a date by which the AUP is expected to be submitted. In

some instances, the NIGC may be able to provide additional technical assistance.  

8. Question: The Tribe just learned that an AUP should have been performed on one or more of

their operations and the fiscal year end has passed. Is the Tribe still required to engage a CPA to

conduct the AUP for the previous fiscal year?  

Answer: Yes.  

9. Question: If the operation permanently closed before the fiscal year end, and does not plan to

reopen, is the Tribe required to engage a CPA to conduct an AUP?

Answer: In some instances, the CPA may perform parts of the AUP engagement prior to year‐end.

If the AUP has been completed prior to the operation being permanently closed, then the Tribe

should submit it with the Financial Statements required by 25 CFR part 571. If the operation has

permanently closed prior to the CPA performing the AUP engagement, then there is no way for

the CPA to complete the engagement.

10. Question: Is an operation required to submit an AUP if they were opened less than 3 months of

the fiscal year?

Answer: Yes. MICS part 543 does not specify an interval of gaming which must occur prior to the

AUP being performed. The Tribe should develop TICS and the operations should implement SICS

prior to opening the operation; therefore, the CPA should be able to test compliance with the

applicable portions of the TICS.

11. Question: How should the Tribe use the information in the AUP report?  

Answer: The NIGC recommends that the TGRA monitor any finding(s) identified in the AUP report

and require the gaming operation to remedy the finding(s) within a specific time period. Special

attention should be given to any repeat finding(s). This can be accomplished through the internal

audit function and/or compliance reviews conducted by the TGRA or gaming operation.   

12. Question: Can a combined AUP report be submitted for multiple gaming operations that are

licensed by a Tribe?   

Answer: As included in question #2 above, §543.23(d) outlines the performance of an AUP. As

such, the AUP engagement must be performed for each individual gaming operation and cannot

be combined or performed on a sample of operations. The AUP findings for all of the Tribe’s

gaming operations may be presented in a single report. However, the report must clearly identify

the AUP was performed for each operation and the findings must be identifiable to each

respective operation.