Internal Audit FAQ

What is an Internal Audit?

An internal audit is an independent appraisal of management performance. Many companies have anindependent audit function within the company to ensure the management is meeting its objectives.The NIGC MICS requires internal audit functions over certain gaming areas. We have been helping tribesto implement the internal audit functions in many tribes either by assisting existing internal audit staff or performing outsourced internal audit functions. The following are frequently asked questions fromour clients:

Is internal control just about compliance?

Definitely not. Internal control is designed to promote efficient and effective operations in the mostgeneral sense. Tribal managers should read the "COSO" report issued by the American Institute ofCertified Public Accountants. That document provides an excellent overview of the purpose of internalcontrol.

Does the Tribe have to have an internal auditor?

Yes. The NIGC MICS requires specified internal audit procedures over their gaming revenues. However,these procedures may be performed by an independent accountant. If an independent accountant isused, there must be segregation between those who perform the internal audit procedures and thoseperforming the annual compliance testing of the system of internal control.

If I have an internal audit department to who should they report?

This is a tricky question. Internal audit should be as independent from management control as possible.Their line of authority should not be to management of the operation for which they are responsible forauditing. Nevertheless their reports should be communicated to management and responses should bereceived from management.

Tribes vary. Some internal auditors report directly to Tribal Council; some report to an EnterpriseBoard or an Audit Committee of the Council; for casino operations, some report directly to the TribalGaming Commission. Seeking the best balance for independence is the rule of thumb to ensure thatthose responsible for the operations being audited are not those to whom the internal auditor reports.

The internal audit findings seem very picky. Why should I worry about them?

The internal control environment is set by the "tone at the top". In organizations where uppermanagement allows sloppy practice, a culture of "it doesn't matter" will pervade the organization.When that happens, loopholes in the control system inevitably develop and they will eventually beexploited. Pride of performance also comes from taking these issues seriously. Employees will boastthat they did not receive exception reports during a month. Exception reports are equally applicable tomanagement and members of Tribal Council or the Gaming Commission when they seek to circumventTribal policy.

This culture of pride of performance permeates an organization which cares about doing things right.Internal audit findings should not be threatening. They should be remedial to improve the effectivenessof operation.

Doesn't revenue audit perform the internal audit procedures?

No. Revenue audit employees perform very important verification procedures by checking on cage,vault and gaming paperwork to ensure that many vital procedures have been followed. An effectiverevenue audit department contributes enormously to the operation of the internal control system andgenerates reports providing tool for evaluating the management's performance and internal controls.The revenue auditor can also perform some of the monitoring of compliance procedures.

Doesn't my computerized slot audit system do all of the necessary internal audit procedures?

No. Computerized slot audit systems contribute significantly to the internal control over slotoperations. However, while the slot system can perform many mundane clerical procedures and canproduce reports for use by management, it cannot observe actual performance. The computer system itself also requires significant monitoring. The control environment changes when a computerizedsystem is in place. The internal audit function should also change to meet these new challenges.

Should non-gaming areas of the Tribe be subject to internal audit?

Yes, very definitely. Even though the NIGC MICS contain certain provisions that gaming areas mustbe subject to internal audit they do not cover non-gaming areas. We believe that these non-gamingrelated departments within the casino represent an area of considerable threat to Tribes and theircommercial operations. Primary areas to focus internal auditing procedures would be purchasing,payroll and food and beverage operation for casinos. A primary reason for this is the typicalinterrelationship between the casino and many of its employees and suppliers who may be Tribalmembers and therefore related parties.

Should we include Title 31 compliance requirements in the MICS? Does the Tribal casino need anindependent audit for compliance with the Title 31 money laundering provisions?

Yes and no. Title 31 Regulations do not fall within the scope of the MICS. They are separate regulationswith which the Tribe must comply. The Title 31 Regulations state that there must be a writtencompliance program. We think that it is a good idea to include this program within the Tribal MICS.

The Title 31 regulations require that there must be an independent review of Title 31 compliance. Aninternal staff member, such as the internal auditor, who is independent of the compliance process, canperform that independent review. Even though an external audit review is not required, many tribalcasinos choose to use an external party to perform this function.