La. Admin. Code tit. 42 § III-2715

Current through Register Vol. 50, No. 11, November 20, 2024

Section III-2715 - Internal Controls - Keys, Restricted Areas, Internal Audit, Addition of Game or Computerized System, Training

A. Keys

1. Sensitive keys are maintained in a secure area subject to surveillance.

2. All restricted sensitive keys shall be stored in an immovable lockable key box or an automated access key box.

3. The lockable key box shall have two differently keyed locks:

a. the two keys to the key box locks shall only be issued to employees from different departments;

b. one key shall open only one lock on the key box; and

c. an employee shall be issued only a single key to a key box lock.

4. There shall be dedicated surveillance coverage of all key boxes with restricted sensitive keys.

5. Sensitive keys shall not be removed from the premises unless prior approval has been granted by the division. For purposes of this rule, a licensee's or casino operator's premises shall be specified in the internal controls.

6. Access to the keys in dual-locked boxes storing restricted sensitive keys shall be documented on key access log forms. The logs shall include the following:

a. date and time of issuance;

b. the key or ring of keys issued;

c. printed name, signature, and employee number of the person to whom the key is issued;

d. printed name, signature, and employee number of the person issuing the key;

e. printed name, signature, and employee number of the witness to the issuance of the key;

f. reason for issuance of the key;

g. date and time of return of the key to the key box;

h. signature and employee number of the person returning the key. This shall be the same employee to whom the key was issued. If, due to unforeseen circumstances, a different employee returns the key, surveillance shall be notified and surveillance shall monitor and record the entire log-in process. The recording of the transaction shall be maintained by surveillance for 30 days;

i. signature and employee number of the person receiving the key; and

j. signature and employee number of the witness to the return of the key to the key box.

7. Key logs shall be reviewed at least monthly and an investigation and documentation made of any omissions or instances in which keys are not signed out and signed back in by the same individual.

8. Approved electronically monitored (automated access) key systems do not require the log in paragraph 6 above if the system logs the same or similar information, except signatures, as the transaction takes place.

a. The electronic key box may act as the issuer or receiver in key transactions. The internal controls shall specify the number of employees required for each electronic key transaction.

b. The licensee or casino operator is responsible for establishing access to keys in the electronic key box. Access shall be in accordance with job descriptions and detailed in the internal controls.

c. Access to multiple keys in one transaction, not including multiple keys on one key ring, require the employee to enter all key numbers prior to accessing the keys. Each key or key ring shall be secured individually within the electronic key box to prevent employees from accessing keys without authorization.

d. Electronic key access lists shall be updated within 72 hours after a change to an employee's status and/or position.

e. A licensee or casino operator shall review reports daily to identify questionable key transactions and exceptions identified by the system or licensee's or casino operator's employees. Investigations of possible violations shall be documented and maintained for five years.

9. Cage keys, change bank/booth keys and the two keys used to access the key box are the only restricted sensitive keys not required to be maintained in a dual locked key box. All restricted sensitive keys and all other keys stored in a key box with restricted sensitive keys shall be inventoried and accounted for on a quarterly basis. If an electronic key box is used and each key is secured individually, only restricted sensitive keys in the box must be inventoried in accordance with this Section. Restricted sensitive keys include, but are not limited to:

a. slot drop cabinet keys;

b. bill validator release keys;

c. bill validator contents keys;

d. table drop release keys;

e. table drop contents keys;

f. count room keys;

g. high level Caribbean stud key;

h. vault entrance key;

i. CCOM (processor) keys;

j. card and dice storage keys;

k. slot office storage box keys where sensitive keys are stored for issuance;

l. dual lock box keys;

m. change bank/booth keys;

n. secondary chip access keys;

o. weigh calibration key;

p. cage door keys; and

q. main bank door keys.

10. Slot drop cabinet keys, bill validator release keys, and table drop release keys shall be accompanied by security at all times.

11. All other sensitive keys not listed in §2715. A.9 shall be listed in the internal controls and controlled as prescribed therein.

12. All sensitive keys shall be logged out and in on a per shift basis unless otherwise approved by the division.

13. If key rings are used, a list must be maintained at the key box with all keys on each key ring.

14. Duplicate keys shall be maintained and issued in such a manner as to provide the same degree of control as is required for the original keys.

15. All damaged sensitive keys shall be disposed of timely and adequately. The licensee or casino operator shall notify the division of the destruction in advance. Notification shall include type of key(s), number of key(s), and the place and manner of disposal.

16. The licensee or casino operator shall notify the division within two hours of discovery that a sensitive key may have been lost or removed from the premises.

B. Restricted Areas

1. All access to the count rooms and the vault shall be documented on a log maintained by the count team and vault personnel respectively. Such logs shall be kept in the count rooms and vault room respectively and be available at all times. The logs shall contain entries with the following information:

a. name of each person entering the room;

b. reason each person entered the room;

c. date and time each person enters and exits the room;

d. date, time and type of any equipment malfunction in the room;

e. a description of any unusual events occurring in the room; and

f. such other information required in the internal controls.

2. The logs shall be forwarded to a department independent of the count team and vault personnel for review of appropriateness of access and to ensure all required information is included.

3. Only transparent trash bags are utilized in restricted areas.

C. Internal Audit

1. An independent CPA firm or an autonomous internal audit department of the licensee or casino operator or their parent company shall be used to perform internal audit work. The same CPA firm shall not perform both internal and external audit functions. The performance of reviews at the request of the licensee's or casino operator's management does not affect independence as long as the internal auditor performs the work free of restrictions from the licensee's or casino operator's management.

2. The licensee or casino operator is responsible for notifying the division of any known, actual, or potential conflict that could impair the internal auditors' independence.

3. The internal audit department or independent CPA firm shall develop reports providing details of all exceptions found and subsequent action taken by the licensee or casino operator.

4. Each licensee and casino operator shall submit copies of the internal audit reports to the division within 15 days of completion of the final report.

5. The licensee or casino operator shall investigate and resolve all material exceptions resulting from internal audit work. The results of the investigation shall be documented, retained, and available to division agents for five years.

D. Addition of Game or Computerized System

1. Before adding or eliminating any game; adding or modifying any computerized system that affects the proper reporting of gaming revenue; adding or modifying any computerized system of betting at a race book; or adding or modifying any computerized system for monitoring slot machines or other games, or any other computerized equipment, the licensee and casino operator shall:

a. amend its accounting and administrative procedures and its internal controls, as necessary;

b. submit to the division a copy of the amendment of the internal controls, signed by the licensee's or casino operator's chief financial officer or general manager, and a written description of the amendments;

c. comply with any written requirements imposed by the division regarding approval of computerized equipment; and

d. after compliance with Subparagraphs a-c of this Paragraph and approval has been issued by the division, implement the procedures and internal controls as amended.

E. Training

1. All personnel responsible for slot machine operations and related computer functions shall be adequately trained before they are allowed to perform gaming functions, maintenance functions, or computerized functions.

a. Each licensee and casino operator shall maintain records to document employee training.

b. Each licensee and casino operator shall create training programs for in-house training and ensure outsourced training adheres to its program requirements.

i. Designated in-house instructors shall meet the following requirements:

(a). full-time employee of the licensee or casino operator; and

(b). certified as an instructor by the manufacturer or its representative.

c. Each licensee and casino operator shall ensure personnel receive training on any new equipment and system prior to implementation. The training shall be in all areas to be used by the licensee or casino operator. Each licensee and casino operator must ensure employees are trained prior to adding or enabling capabilities to equipment or systems.

d. The licensee and casino operator has a continuing obligation to secure additional training whenever necessary to ensure all new employees receive adequate training before they are allowed to perform gaming functions, maintenance functions, or computerized functions.

La. Admin. Code tit. 42, § III-2715

Promulgated by the Department of Public Safety and Corrections, Gaming Control Board, LR 38:1633 (July 2012).

AUTHORITY NOTE: Promulgated in accordance with R.S. 27:15 and 24.