Internal compliance audits against MICS and TICS
We test your gaming operation’s internal controls area by area against the NIGC Minimum Internal Control Standards and your Tribal Internal Control Standards, and report each exception with the standard it relates to.
Why these audits are required
Under 25 CFR 543.23(c), each department of a Class II gaming operation must be audited at least once a year for compliance with the MICS and with the Tribe’s TICS and SICS. The auditors must be independent of the departments they audit, and the work may be done by an internal audit department, by the Tribal gaming regulatory authority, or by an outside CPA firm.
The same rule requires documented findings, management’s response to each one, and verification of corrective action within six months. Class III operations are audited against their TICS, which commonly incorporate the standards in 25 CFR Part 542. We test against whichever standards apply to your operation.
Areas we audit
Who we work with
Tribal gaming operations that outsource their internal audit function, and Tribal gaming regulatory authorities that need compliance audits performed. Our staff use the same audit programs on every engagement, so results are consistent from year to year.
How the engagement runs
Risk assessment
We profile your operation: gaming class, games offered, credit, foreign currency and revenue tier. The answers decide which areas and standards are tested.
Fieldwork
Each area is tested against its MICS and TICS standards on sampled dates, with observations, document review and the evidence kept with the workpapers.
Exceptions and report
Exceptions are listed with the standard they relate to, separated from operational observations, and reported with management’s responses in the format your organization already uses.
Follow-up
Each area is scheduled within a year of its prior review, and corrective action on findings is verified within six months.
Questions
Is this the same as the annual agreed-upon procedures engagement?
No. Under 25 CFR 543.23(d), a CPA performs agreed-upon procedures each year to assess MICS compliance, and that report goes to the NIGC with the annual financial statement audit. The internal audits described here are a separate, recurring requirement under 543.23(c).
Can our gaming commission perform these audits instead?
Yes. The rule allows the internal audit function to be performed by internal auditors, by the Tribal gaming regulatory authority, or by an outside CPA firm, as long as the auditors are independent of the departments they audit.
How often does each area need to be audited?
At least annually for each department under 543.23(c)(1). Your TICS may set a more frequent schedule for some areas.