What is an Internal Audit?
An internal audit is an independent appraisal of management performance. Many companies have an independent audit function within the company to ensure the management is meeting its objectives. The NIGC MICS requires internal audit functions over certain gaming areas. We have been helping tribes to implement the internal audit functions in many tribes either by assisting existing internal audit staff or performing outsourced internal audit functions. The following are frequently asked questions from our clients:
Is internal control just about compliance?
Definitely not. Internal control is designed to promote efficient and effective operations in the most general sense. Tribal managers should read the “COSO” report issued by the American Institute of Certified Public Accountants. That document provides an excellent overview of the purpose of internal control.
Does the Tribe have to have an internal auditor?
Yes. The NIGC MICS requires specified internal audit procedures over their gaming revenues. However, these procedures may be performed by an independent accountant. If an independent accountant is used, there must be segregation between those who perform the internal audit procedures and those performing the annual compliance testing of the system of internal control.
If I have an internal audit department to who should they report?
This is a tricky question. Internal audit should be as independent from management control as possible. Their line of authority should not be to management of the operation for which they are responsible for auditing. Nevertheless their reports should be communicated to management and responses should be received from management.
Tribes vary. Some internal auditors report directly to Tribal Council; some report to an Enterprise Board or an Audit Committee of the Council; for casino operations, some report directly to the Tribal Gaming Commission. Seeking the best balance for independence is the rule of thumb to ensure that those responsible for the operations being audited are not those to whom the internal auditor reports.
The internal audit findings seem very picky. Why should I worry about them?
The internal control environment is set by the “tone at the top”. In organizations where upper management allows sloppy practice, a culture of “it doesn’t matter” will pervade the organization. When that happens, loopholes in the control system inevitably develop and they will eventually be exploited. Pride of performance also comes from taking these issues seriously. Employees will boast that they did not receive exception reports during a month. Exception reports are equally applicable to management and members of Tribal Council or the Gaming Commission when they seek to circumvent Tribal policy.
This culture of pride of performance permeates an organization which cares about doing things right. Internal audit findings should not be threatening. They should be remedial to improve the effectiveness of operation.
Doesn’t revenue audit perform the internal audit procedures?
No. Revenue audit employees perform very important verification procedures by checking on cage, vault and gaming paperwork to ensure that many vital procedures have been followed. An effective revenue audit department contributes enormously to the operation of the internal control system and generates reports providing tool for evaluating the management’s performance and internal controls. The revenue auditor can also perform some of the monitoring of compliance procedures.
Doesn’t my computerized slot audit system do all of the necessary internal audit procedures?
No. Computerized slot audit systems contribute significantly to the internal control over slot operations. However, while the slot system can perform many mundane clerical procedures and can produce reports for use by management, it cannot observe actual performance. The computer system itself also requires significant monitoring. The control environment changes when a computerized system is in place. The internal audit function should also change to meet these new challenges.
Should non-gaming areas of the Tribe be subject to internal audit?
Yes, very definitely. Even though the NIGC MICS contain certain provisions that gaming areas must be subject to internal audit they do not cover non-gaming areas. We believe that these non-gaming related departments within the casino represent an area of considerable threat to Tribes and their commercial operations. Primary areas to focus internal auditing procedures would be purchasing, payroll and food and beverage operation for casinos. A primary reason for this is the typical inter relationship between the casino and many of its employees and suppliers who may be Tribal members and therefore related parties.
Should we include Title 31 compliance requirements in the MICS? Does the Tribal casino need an independent audit for compliance with the Title 31 money laundering provisions?
Yes and no. Title 31 Regulations do not fall within the scope of the MICS. They are separate regulations with which the Tribe must comply. The Title 31 Regulations state that there must be a written compliance program. We think that it is a good idea to include this program within the Tribal MICS.
The Title 31 regulations require that there must be an independent review of Title 31 compliance. An internal staff member, such as the internal auditor, who is independent of the compliance process, can perform that independent review. Even though an external audit review is not required, many tribal casinos choose to use an external party to perform this function.