Md. Code Regs. 36.10.13.20

Current through Register Vol. 51, No. 21, October 18, 2024

Section 36.10.13.20 - Internal Audit Department Standards

A. Except as set forth in §B, this regulation is only applicable to the holder of a Class A sports wagering facility license.

B. The Commission may require the holder of a Class B sports wagering facility license to comply with any or all of the requirements of this regulation.

C. At least 60 days before sports wagering operations are set to commence or another time approved Commission, a sports wagering licensee shall submit to the Commission for review and approval internal audit department operating standards and procedures that:

(1) Meet the requirements of Regulation .09E(6)(b) of this chapter;

(2) Conform to this regulation; and

(3) Ensure that an internal audit is conducted in accordance with generally accepted auditing standards in the United States.

D. A sports wagering licensee's internal audit department operating procedures and standards shall, at a minimum, require the internal audit department to:

(1) Work independently of the departments of the sports wagering licensee that are subject to audit;

(2) Assess whether the sports wagering licensee's internal controls comply with applicable law and Commission directives;

(3) Test the sports wagering licensee's compliance with its internal controls;

(4) Immediately report a deficiency in, or noncompliance with, the sports wagering licensee's internal controls to:

(a) The audit committee;

(b) The chief executive officer;

(c) Management; and

(d) The Commission;

(5) Recommend resolution for eliminating a deficiency in, or noncompliance with, the sports wagering licensee's internal control system;

(6) Meet periodically with the audit committee or director of internal audit;

(7) Perform audits of:

(a) Unless an alternate risk assessment and audit plan is submitted in writing and approved in writing by the Commission, all departments of the sports wagering licensee that are designated under §§C and D of this regulation; and

(b) A department of the sports wagering licensee designated by the Commission;

(8) Prepare an audit report for each audit conducted;

(9) Accurately document the audit process and results in an audit report that, at a minimum, shall include:

(a) Audit objectives;

(b) Audit procedures and scope;

(c) Findings and conclusions;

(d) A recommendation for addressing a deficiency in, or noncompliance with, the sports wagering licensee's internal controls;

(e) Resolution of all exceptions; and

(f) Management's response;

(10) Submit audit reports to the Commission on a schedule specified by the Commission; and

(11) Verify that:

(a) A deficiency or noncompliance revealed during an audit has been corrected; and

(b) An exception disclosed during an audit has been resolved.

E. If applicable, the audit department shall audit at least semiannually the functions and operations of the sports wagering licensee's:

(1) Cashiers' cage;

(2) Collection of cash storage boxes;

(3) Cash count;

(4) Revenue audit;

(5) Sports wagering operations department; and

(6) Key control;

F. If applicable, the audit department shall audit at least annually:

(1) Responsible gaming program;

(2) Security department;

(3) Currency transaction reporting;

(4) Suspicious activity reporting;

(5) Information technology controls;

(6) Surveillance department;

(7) Bettor tracking system; and

(8) Sports wagering platform.

G. The internal audit department shall conduct an audit on an unannounced basis when possible.

Md. Code Regs. 36.10.13.20

Regulation .20 amended effective 49:1 Md. R.16, eff. 1/13/2022; amended effective 50:26 Md. R. 1130, effective 12/12/2023, exp. 6/9/2024 (Emergency); amended effective 51:10 Md. R. 529, eff. 5/27/2024.