Questions we hear from Tribal gaming operations and regulators
How to staff the internal audit function, what our workpaper review covers, and quick answers on MICS, NIGC fees, Title 31 and W-2G reporting.
In-house, outsourced or co-sourced?
Under 25 CFR 543.23(c), each gaming department must be audited at least once a year by auditors who are independent of the departments they audit. The rule allows that work to be done by the operation’s own internal auditors, by the Tribal gaming regulatory authority, or by an outside CPA firm. Most operations use one of three models.
| Model | How it works | Works well when | Watch for |
|---|---|---|---|
| In-house department | The operation employs its own internal audit staff, who report to the Tribe, the regulatory authority, an audit committee or another body the Tribe designates. | The operation is large enough to keep a full department busy year-round and can recruit and keep auditors who know gaming. | Turnover, gaps in specialized areas such as information technology and Title 31, and having no one independent to review the department’s own work. |
| Outsourced | An outside CPA firm performs the internal audit function: it plans the annual cycle, does the fieldwork, writes the reports and follows up on findings. | The operation is too small to justify a full department, has trouble hiring, or wants independence that is easy to show. | Staying in touch between visits; the operation still owns its controls and management’s responses. |
| Co-sourced | The in-house department keeps ownership of the audit plan and reports, and an outside firm supplies specific pieces: certain audit areas, extra staff for peak periods, specialists, or review of the department’s workpapers. | There is a department in place, but it needs specialized skills, more capacity, or an independent reviewer. | Clear agreement on who performs, reviews and signs off on each area. |
Whichever model you choose, the auditors must be independent of the departments they audit, and the work must be documented, reported with management’s responses, and followed up within six months.
Co-sourcing through workpaper review
Co-sourcing does not have to mean doing the fieldwork. Many departments need a qualified, independent reviewer more than extra hands, especially when the department is new, has had turnover, or has no senior auditor to review the staff’s work.
In a workpaper review, we review your department’s completed audits before the reports go to management and the regulatory authority. We check that the audit programs cover the MICS, TICS and Title 31 requirements that apply, that samples support the conclusions, that each step is documented and supported by evidence, that exceptions are tied to the right standard, and that prior findings were followed up within six months. You receive written comments by audit area, with the changes needed before the reports are issued.
Your department keeps the work and the relationships with management; we add the second look that makes the work hold up.
Internal audit
Who can perform the internal audits the MICS require?
Under 25 CFR 543.23(c)(2), the internal audit function may be performed by the operation’s own internal auditors, by the Tribal gaming regulatory authority, or by an outside CPA firm. Whoever does the work must be independent of the departments being audited.
How often does each area need to be audited?
At least once a year for each department under 543.23(c)(1). Your TICS may require some areas more often. Findings must be followed up, and corrective action verified, within six months.
What is the difference between an in-house, outsourced and co-sourced internal audit function?
In-house means the operation employs its own internal auditors. Outsourced means an outside CPA firm performs the whole internal audit function. Co-sourced means the in-house department keeps ownership and an outside firm supplies specific pieces, such as certain audit areas, peak-period staff, specialists, or review of the department’s workpapers.
What is a workpaper review?
We review your internal audit department’s completed workpapers before reports are issued: program coverage, sampling, documentation and evidence, how exceptions are tied to standards, and follow-up on prior findings. You receive written comments by audit area. It gives a department without a senior reviewer an independent second look.
Is an internal audit the same as the annual agreed-upon procedures?
No. Internal audits are a recurring requirement under 543.23(c). The agreed-upon procedures engagement under 543.23(d) is performed by a CPA once a year to assess MICS compliance, and its report goes to the NIGC with the audited financial statements within 120 days of fiscal year-end.
Working with us
What standards do you test against?
The NIGC Minimum Internal Control Standards (25 CFR Parts 542 and 543), your Tribal Internal Control Standards, and the Bank Secrecy Act requirements for casinos (31 CFR Chapter X). Each engagement starts with a risk assessment that decides which standards apply to the gaming you offer.
Do you work with gaming regulatory authorities as well as operations?
Yes. We work with Tribal gaming operations and with the Tribal gaming regulatory authorities that oversee them.
How do we send documents to you?
Through our client document portal at casinoaudit.com/portal. You sign in with a one-time code sent to your email; files are encrypted in transit, stored privately, and every upload and download is logged.
What is AuditAxis360?
The audit management software we built for our own engagements: risk assessment, workbenches for each audit area, evidence uploads, reviewer sign-offs and reports in one place. We are preparing it for internal audit departments and regulatory agencies.
How quickly do you respond?
We respond to inquiries within 48 hours.
Fees, Title 31 and reporting
How is the NIGC annual fee calculated?
On assessable gross revenue: wagers plus entry fees, less prizes paid, free play wagered, and a capital expenditure allowance. For fiscal year 2026 the first $1,500,000 is assessed at 0.00% and the rest at 0.08%, paid in four quarterly installments. Our Resources page has a worked example and an estimator.
What is the W-2G reporting threshold for slot machines in 2026?
$2,000 for payments made on or after January 1, 2026, up from $1,200. The same $2,000 threshold applies to bingo, keno (net of the wager) and poker tournaments (net of the buy-in), and it will be adjusted for inflation in later years.
When does a Tribal casino have to file a CTR?
When cash in or cash out by or for one person exceeds $10,000 in a gaming day, aggregating transactions the casino knows about. The CTR is filed within 15 days. Cash in and cash out are totaled separately.
General information only, not legal or tax advice. See our Resources page for details and links to the official sources.