Md. Code Regs. 36.07.04.03

Current through Register Vol. 51, No. 24, December 2, 2024

Section 36.07.04.03 - Content of Internal Controls

A. A facility operator shall develop a written description of its administrative and accounting procedures including the system of internal controls over instant bingo operations.

B. A facility operator's internal controls are subject to review and approval under this regulation.

C. Internal controls shall, at a minimum, include:

(1) Administrative controls and record keeping that document the authorization of transactions;

(2) Accounting controls that provide reasonable assurance that:

(a) Transactions or financial events which occur in connection with instant bingo operations are:

(i) Executed in accordance with the facility operator's authorization protocols;

(ii) Recorded to permit preparation of financial statements in conformance with generally accepted accounting principles in the United States and the requirements of this chapter; and

(iii) Recorded to permit proper and timely reporting and calculation of proceeds and to maintain accountability for assets;

(b) Access to assets is permitted only in accordance with the facility operator's authorization protocols; and

(c) The recorded accountability for assets is compared with existing assets at reasonable intervals and appropriate action is taken with regard to a discrepancy;

(3) Procedures and controls for ensuring:

(a) That an instant bingo machine accurately and timely communicates all required activities and financial details to the instant bingo validation and accounting system;

(b) That all functions, duties and responsibilities are segregated and performed in accordance with sound financial practices by qualified personnel; and

(c) Through the use of a surveillance and a security department, that the facility is secure at all times during normal operation and during any emergency due to malfunctioning equipment, loss of power, natural disaster or any other cause;

(4) Access controls which address, at a minimum:

(a) Content of, and administrative responsibility over, the manual or computerized access control matrix governing employee access to restricted areas;

(b) Issuance of a temporary access credential; and

(c) Comprehensive key controls;

(5) A record retention policy;

(6) Procedures and controls over the movement of cash and the count room;

(7) Procedures and standards for conducting internal audits; and

(8) Other procedures and controls the Commission may require to be included in a facility operator's internal controls.

D. A facility operator shall maintain, in hard copy or electronic form, all superseded internal controls for at least five years subsequent to the date the internal controls were superseded.

Md. Code Regs. 36.07.04.03

Regulations .03 adopted as an emergency provision effective 40:20 Md. R. 1650, eff.8/26/2013 ; adopted permanently effective December 12, 2013 40:24 Md. R. 2019, eff.8/26/2013