1

Auditing in the Gaming

Industry
Presentedby: J asonA. Goudie, CPA, Director of Internal Audit HarrahsEntertainment, Inc.
Objectives of Presentation
Provide an overview of the gaming industry.
Provide an overview of casino operations.
Discuss the audit environment, risks and testing
approach used in the gaming industry.
Give examples of what can and has gone wrong.
Overview of the Gaming Industry
Some form of gaming is
located in nearly all states and
several countries around the
world.
Several types of gaming:
lotteries, bingo, race tracks,
sportsbooks and traditional
casinos are some examples.
Highly regulated industry:
Vigorous licensing
requirements
Various jurisdictions
Strict controls for
operations
2
Overview of the Gaming Industry
(cont)
Nevada
Two primary regulatory
agencies
Gaming Commission
(NGC)
Gaming Control Board
(GCB)
An overall responsibility
between both is to ensure
that taxes are correct and
remitted timely.
Primary Responsibilities
Gaming Commission
Enact all gaming regulations and to
serve as the final authorityon licensing
and disciplinarymatters.
Gaming Control Board
Protect and police the casinos.
Performinvestigations and audits of
the casinos.
Three branches are investigations,
enforcement and audit (largest branch).
Overview of the Gaming Industry
(cont)
Casinos are privileged enterprises.
There is a general rule that persons have a constitutional right to engage in
useful trades and occupations. The Nevada Supreme Court has repeatedly
upheld its 1931 decision that casinos are privileged enterprise, and not useful
trades or occupations.
(1)
Therefore it is a privilege to operate a casino, to work in a casino as a keyemployee
and to gamble in a casino. Since it is a privilege, the GCB or NGC can take this
privilege away.
Therefore the officers and principal owners of casinos must be licensed in order to
conduct gaming business in Nevada. There are two primarylicenses:
Restricted Operates no more than 15 slots and no table or poker games, and
must be incidental to the primarybusiness (Convenience Stores)
Unrestricted Operates more than 15 slots, or has table or poker games.
(1) (Casino Operations Management, byJ imKilbyandJ imFox).
Overview of the Gaming Industry
(cont)
The Regulation of Gaming
The State Legislature will enact statutesrelated to gaming.
The GCB and NGC are responsible for the regulations related to the Gaming
Industryin Nevada.
The statutes cover various types of gaming and certain other aspects of
gaming.
The regulations cover the requirements of gaming operations.
The regulations require MinimumInternal Control Standards (MICS).
The MICS detail the specific controls that must be in place in the
casino to be in compliance with the regulations.
Each casino must create their own Internal Control Submission
(ICS) which details how the casino will comply with the MICS.
3
Casino Operations
Primary Gaming Operations to a Nevada casino include:
Slots
Table Games (includes blackjack, craps, roulette, baccarat, etc)
Race and Sportsbook
Poker
Keno
Bingo
Casino Operations (cont)
Primary Non-Gaming Operations to a Nevada
casino include:
Hotel
Retail
Food and Beverage
Leases (primarily retail, restaurants or timeshare
business)
Entertainment
Casino Operations (cont)
Other Operations include:
Surveillance
Security
Cashiering and Credit
Regulatory Compliance
Player Rewards Programs
4
The Audit Function
One of the primary responsibilities of the
Internal Audit function is to assure
compliance with the ICS (and thus the MICS).
Other responsibilities include:
Operational Reviews
Financial Reviews
IT Reviews
Identification of Best Practices
Cost Savings Identification
Assist in Investigations
Assist External Auditors
Special Projects
The Audit Function (cont)
Internal Audit typically reports directly to
the Audit Committee of the Board of
Directors.
The CEO or CFO typically oversees the
function for administrative purposes.
The Audit Function (cont)
Primary gaming audits performed by IA:
Currency Transaction Reporting, Slots, Table Games,
Cashiering, Credit and Collections, Sensitive Keys,
Surveillance, Race and Sportsbook, Keno, Bingo,
Entertainment Tax, Information Technology
Primary non-gaming audits performed by IA:
Hotel, Food and Beverage, Retail, Leases, Rewards
Programs, Purchasing/Warehouse, Player Comps, Payroll,
Construction, Travel and Entertainment, Special Projects
and requests from management.
5
The Audit Function (cont)
CASH is KING!
Controls in a casino are primarily built
around safeguarding cash.
Cash is a very liquid asset and the casinos have
built a large industry based on that very liquid
asset.
Additionally, both the Federal Government and
State Regulations have specific controls required
for the handling of cash.
The Audit Function (cont)
Several laws and regulations have been passed to address the
risks of handling large volumes of cash and the potentially
suspiciousactivities that are related.
The two key requirements to follow are:
Title 31 (non Nevada states)
Regulation 6A in Nevada
Overall expectation is to make a reasonable attempt to monitor
accumulation of cash transactions over $10,000 within a 24 hour
period.
Report these transactions on a CTR Form(Currency Transaction
Form) to the IRS.
The Audit Function (cont)
Title 31 and Regulation 6A both require
basically the same controls.
Title 31 is effective for all gaming jurisdictions in the United
States (including Native American Gaming) except for
Nevada.
Regulation 6A is effective for Nevada, as the Federal
Government granted Nevada a waiver from Title 31, due to
the requirements of Regulation 6A.
Primary objectives are to prevent money laundering and to
provide additional information for taxes.
6
The Audit Function (cont)
Primary differences in Title 31 vs. Regulation 6A:
Title 31 aggregates all cash amounts during the 24 hour
period (performed back of the house) and Regulation 6A
aggregates transactions within a defined area over the 24
hour period (performed front of the house).
Regulation 6A requires the documentation of the accumulation
of transactions over $3,000 on a Multiple Transaction Log.
Cash for cash, check or wire transfer exchanges are
prohibited (over $3,000) in Nevada and Title 31 does not
prohibit these transactions.
The Audit Function (cont)
Suspicious Activity Reporting
Casinos are required to file a Suspicious Activity
Report (SAR) with the Financial Crimes Enforcement
Network (FinCEN) for any transaction conducted or
attempted, aggregating to at least $5,000 in funds or
other assets, that the casino knows, suspects or has
reason to suspect:
Involves funds from illegal activity or hiding funds from
illegal activity.
Designed to evade the appropriate reporting under Title
31 (or Regulation 6A in Nevada).
Has no business or lawful purpose.
Involves the use of the casino for criminal activity.
The Audit Function (cont)
CTR/SAR - Risks and Auditing
Largest risks are :
Reports (CTRs, SARs) should be submitted;
however, they are not.
Prohibited transactions occur. Remember this
is only applicable to Nevada.
Suspicious Activity Plan is not in place and/or
suspicious activity is not properly reported.
All required forms are completed correctly.
Compliance with the MICS or other regulations.
7
The Audit Function (cont)
Overall audit procedures generally performed in
gaming audits:
Ensure surveillance is adequate for all transactions.
Ensure independent reviews of transactions are
performed timely (i.e., Income Control)
Review access to all IT systems to ensure it is properly
controlled.
Discuss transactions with personnel to ensure an
adequate knowledge of operations.
Ensure the ICS properly address the MICS.
Proper revenue and tax reporting.
Ensure the procedures in operation match what is
documented in the Internal Control Submission (ICS).
The Audit Function (cont)
Audit Steps for CTR/SAR include:
Unannounced observations (use of surveillance).
Review training plans as well as the Suspicious
Reporting Plan.
Test personnel on the floor related to knowledge
of policies and regulations.
Trace detail transactions through systems and
manual documentation to ensure all required
forms are completed correctly.
Attempt to perform covert transactions to
determine the compliance of personnel with
required regulations.
The Audit Function (cont)
Slots and Table Games- Risks and Auditing
The largest revenue generators for casinos.
Drop and count of the coin/chips/tokens, currency
and cashless tickets.
J ackpots, Fills and Credits.
Manual Transactions, including voids, not verified
by the system.
Recognition of revenue and related liabilities.
8
The Audit Function (cont)
Audit steps for Slots and Table Games include:
These are separate audits, but I have combined due to
similar overall risk and audit procedures.
Variance analysis of revenue (including drop and hold).
Observations and testing of the drop process and the count
process for the coin/tokens, currency and cashless tickets.
(includes unannounced observations)
Testing of documentation and procedures related to the
jackpots, fills and credits performed during the audit period.
Review of procedures related to manual transactions as well as
observations and review of documents to ensure compliance.
Recalculation of revenue for certain test dates and ensuring
revenue is properly reported to the GCB.
The Audit Function (cont)
Cashiering, Credit and Collections - Risks and
Auditing
Maintains the majority of cash and chips/tokens for the
casino.
The majority of cash transactions are handled by the cage
cashiers.
Typically several cages are utilized to handle the
transactions in various locations within the casino.
Typically specific cage banksare kept on an impress basis,
which typically reduces risk.
Physical security of the cages.
Issuance of credit to patrons and collection of debts.
The cage is the core of the casino operations and the
majority of transactions flow through the cage
documentation.
The Audit Function (cont)
Audit steps for Cashiering, Credit and
Collections include:
Perform a cash count of all cash, chips and tokens
in the casino on a specific date and agree to
accounting records.
Review and reconcile the cage documentation .
Review the credit issuance policies and
compliance with the policies.
Review procedures for collection of debts from
patrons.
9
The Audit Function (cont)
Audit Risks and Procedures for Non-Gaming
Audits
Each area has specific risks and steps but these
are the common risks and steps in all audit areas:
Controls over cash.
Appropriate segregation of duties.
Access to IT systems.
Compliance with company policies.
We will perform general reviews of documentation as
well as review systems and manual procedures for
adequate segregation of duties.
We will perform unannounced/covert observations of
transactions to ensure compliance with laws, regulations
and company policies.
What Can Go Wrong?
Fraud, Theft and Embezzlement
Not everyone in the casino business is an
upstanding citizen and employee.
What Can Go Wrong?
Examples Theft of Chips
What happened?
A dealer on a dead 21-game allegedly took one or more $500
chips out of the table inventory each shift, and gave them to a
family member to redeem.
How was it discovered?
A local competitor repeatedly reported suspicious activity
involving an individual who exchanged $2,500+$500 chips each
week with no evidence of play. The activity was reported to the
Cage and Surveillance departments on several occasions.
When timely action was not taken, the competitor reported the
incidents as suspicious to the GCB, who immediately initiated an
investigation.
10
Incident Facts -
$600,000+was allegedly embezzled by a dealer removing the chips from
dead games over a period of perhaps years.
The activity occurred at a deadgame; traditionally in the industry,
Surveillance does not monitor dead games, favoring instead live games
where the risk is perceived to be higher.
The dealer did not follow dealer protocolfor hands placement, facing
forward, hands off the inventory when there was no game play.
Management did not counsel/discipline the employee for failure to
consistently follow dealer protocol standards.
The Cage/Surveillance did not appropriately respond to reports of potential
impropriety by initiating an investigation & increasing Surveillance monitoring
of the alleged dealer.
Subsequent to a change in Accounting management, daily flash reports to
analyze table hold were discontinued.
What Can Go Wrong?
Examples Manual Markers
What happened?
A floor supervisor allegedly colluded with several confederate
non-employees to allow them to take out markers against front
money at the games and subsequently destroy the markers or
note them as paid before dropping them in a drop box.
How was it discovered?
A dealer reported he/she observed a supervisor forging the
dealers signatures on markers on several occasions.
INCIDENT FACTS -
Approximately$600-900,000 was allegedlyembezzled through improper use of manual
markers.
The co-conspirators put $20,000 up on front moneyat the Cage and were then issued
manual markers against the front moneyin the floormans pit on multiple occasions.
The confederates played several hands, often accumulating more chips fromwinning
wagers, then bought back their markers without anyrisk to them. The floorman initiated
the re-payment process, forged dealer signatures on the manual buy-back documents
and then either destroyed the documents or deposited the forged documents into the
drop box after the dealer went on break or into the drop box of a dead game that had
prior playduring the shift, creating false redemptions.
Surveillance did not detect the absence of dealer involvement in buy-backs, nor did they
identifyuntimely and inappropriate placement of marker documents into the
correct/incorrect drop box by the supervisor.
Income Control did not record and reconcile manual marker issuances and
redemptions, so did not detect 33 missing manual markers and informmanagement.
Neither Table Games management, Regulatory Compliance, nor Accounting reviewed
the Cash/No Playreports nor table statistics reports that indicated potentially
suspicious activity.
11
WHAT WENT WRONG?
Well-defined dealer protocol procedures, trained employees, and appropriate management of
individual non-performance.
Regular table inventoryverifications (periodic throughout the shift with recording of counts on
Table Accounting Control Sheets (TACS) / shift-end).
Transactions: not documented and executed in accordance with prescribed procedures.
Adequate Surveillance camera coverage and monitoring with management feedback for
discrepancies.
Adequate management-to-employee ratios????
Experienced management team; knowledgeable of required procedures????
Adequate Income Control dailyaudit and reconciliation procedures.
Adequate independent reviews of CTR and suspicious transactions.
DailyAccounting Flash Reports(financial analysis) were not properlyutilized.
The End
Any Questions?