Code of Massachusetts Regulations › 205 CMR - MASSACHUSETTS GAMING COMMISSION › Title 205 CMR 138.00 - Uniform Standards of Accounting Procedures and Internal Controls for Gaming › Section 138.02 - Licensee's System of Internal Controls

Current through Register 1525, July 5, 2024
(1) At
			 least 60 days prior to commencing operations a gaming licensee shall submit to
			 the commission its proposed minimum system of internal procedures and
			 administrative and accounting controls (internal controls) in accordance with
			 205
			 CMR 138.02(4). An Operations
			 Certificate shall not be issued to a gaming licensee for the commencement of
			 gaming operations in accordance with 205 CMR until the submission is approved
			 in accordance with
			 205
			 CMR 138.02(2). The
			 commission or its designee may perform any inspection necessary in order to
			 determine conformance with the approved internal controls.
(2) The commission shall refer the proposal
			 submitted in accordance with
			 205
			 CMR 138.02(1)  to the
			 Executive Director who shall review the submission for compliance with M.G.L.
			 c.23K,
			 205 CMR
			 138.00 and other applicable sections of 205 CMR. Upon
			 completion of review the Executive Director shall either approve the submission
			 or advise the gaming licensee in writing of any deficiency, and may include any
			 other recommendations and/or required changes intended to ensure that a robust
			 system of internal controls is implemented. The gaming licensee may either
			 accept a recommendation or required change in writing or advise the Executive
			 Director in writing as to the reason for its disagreement. The gaming licensee
			 may dispute any determination or recommendation made by the Executive Director
			 to the commission which shall resolve the issue.
The commission or the Executive Director may revisit any
				provision of the internal controls at any time and direct adjustment if
				necessary, and provide for a reasonable implementation period, to ensure that a
				robust system of internal controls is in effect. Upon approval by the Executive
				Director the gaming licensee shall be issued a writing evidencing the approval
				of its internal controls including any associated conditions.
(3) At least 15 business days prior to
			 changing any provision of the approved internal controls a gaming licensee
			 shall submit the proposed change, including an explanation therefor, and new
			 certifications from its chief legal and financial officers consistent with
			 205
			 CMR 138.02(4)(i) and (j), to
			 the commission. The commission shall refer the proposed change to the Executive
			 Director who shall review the proposal to determine whether it complies with
			 205 CMR
			 138.00. Changes to the system of internal controls
			 will generally be permitted if the proposed change does not lessen the
			 applicable administrative, accounting, or physical control. Upon completion of
			 review the Executive Director shall either approve the proposed change or
			 advise the gaming licensee in writing as to why the proposal does not comply
			 with 205 CMR
			 138.00. The gaming licensee may appeal the Executive
			 Director's determination to the commission which shall resolve the issue.
			 Approved changes shall be maintained as part of the approved internal controls.
Modifications to internal controls may not be implemented until
				approved by the Executive Director or the commission. Provided, however, if the
				Executive Director does not object or otherwise respond to the submission in
				writing within 15 business days of receipt of the submission, the gaming
				licensee may make the proposed change subject to further direction by the
				Executive Director in accordance with
				205
				CMR 138.02(3).
(4) The internal controls shall
			 include the following:
(a) Administrative
			 controls which include, as their primary objective, policies and procedures
			 designed to assure that all activities and transactions of the gaming licensee
			 are instituted and completed in accordance with the applicable policy and/or
			 procedure.
(b) Accounting controls,
			 as detailed in 205 CMR, which include, as their primary objective, procedures
			 to assure that all activities and transactions of the gaming licensee are
			 accurately reported and recorded in accordance with generally accepted
			 accounting principles.
(c)
			 Reporting controls which shall include policies and procedures for the timely
			 reporting of economic and social impact reports, and standard financial and
			 statistical reports and information in accordance with 205 CMR.
(d) Surveillance controls as detailed in
			 205 CMR
			 141.00:
Surveillance of the Gaming
			 Establishment
.
(e)
			 Physical controls which include, as their primary objective, the safeguarding
			 of company assets to include safeguards in the form of organizational
			 safeguards, such as segregation of duties between incompatible functions, and
			 physical safeguards such as restricted access to assets and routine security
			 devices such as cameras and locking doors.
(f) A network security plan as described in
			 205
			 CMR 143.12:
Network
			 Security
.
(g) A plan to
			 ensure compliance with
			 205 CMR
			 140.00:
Gross Gaming Revenue and Tax
			 Remittance and Reporting
.
(h) All applicable policies and procedures
			 required pursuant to
			 205
			 CMR 138.04 through
			 138.70.
(i) A certification by the gaming licensee's
			 chief legal officer that the submitted procedures conform to M.G.L. c. 23K,
			 205 CMR
			 138.00, and any applicable regulations referenced
			 therein; and
(j) A certification by
			 the gaming licensee's chief financial officer that the submitted procedures
			 provide adequate and effective controls, establish a consistent overall system
			 of internal procedures and administrative and accounting controls, and conform
			 to generally accepted accounting principles and 205 CMR.