(A) Each casino operator licensee or applicant's internal control system shall include internal controls for internal audit standards.
(B) The casino operator licensee shall maintain a separate internal audit department whose primary function is to perform internal audit work that shall be independent with respect to the departments subject to audit. The casino operator licensee shall ensure that the standards, conventions, and rules governing audits in the United States are followed for all audits. The internal audit department shall be responsible for the following:
(1) The review and appraisal of the adherence of the casino operator licensee's systems of internal control to Chapter 3772. of the Revised Code and the rules adopted thereunder;
(2) Performing tests to ensure compliance with internal control procedures;
(3) The reporting to the casino operator licensee's management and the commission of instances of noncompliance with the internal control system;
(4) The reporting to the casino operator licensee's management and the commission of any weaknesses in the internal control system;
(5) The recommendation of procedures to eliminate any weaknesses in the internal control system; and
(C) The auditing department shall prepare documents to evidence all internal audit work performed as the work relates to the requirements in this rule, including all instances of noncompliance with internal control procedures:
(1) The internal audit department shall operate with audit programs that address the requirements of this rule;
(2) The internal audit department shall accurately document the work performed, the conclusions reached, and the resolution of all exceptions; and
(3) All audit reports shall be prepared, maintained, and provided to the commission on a schedule approved by the commission.
(D) Internal audit personnel shall perform audits of all major gaming areas of the casino operator licensee. The following shall be reviewed at least semi-annually:
(1) Wagering, including calculation and payout procedures;
(2) Net slot income;
(3) Table games income;
(4) Slot activity including jackpots, drop counts, cabinet access and the casino's compliance with its internal control procedures for slot machine accounting;
(5) Cage procedures;
(6) Information technology standards;
(8) Control of keys;
(9) Purchasing functions and contractual agreements to determine that the purchases and agreements are not in excess of their fair market value; and
(10) Any other internal audits as required by the commission, audit committee of the board of directors, or any other entity designated by the commission.
(E) The audit reports shall include the following information:
(1) Audit objectives;
(2) Audit procedures and scope;
(3) Findings and conclusions; and
(4) Management's response.
(F) The internal audit department shall perform follow-up examinations to verify that corrective action has been taken regarding all instances of noncompliance cited by internal audit, the independent accountant, and the commission. The verification shall be performed within three months of the issuance of the audit report.
(G) Whenever possible, internal audit observations shall be performed on an unannounced basis.
(H) All exceptions disclosed during audits shall be investigated and resolved, with the results being documented and retained for five years.
(I) All internal audit findings shall be reported to management, who shall be required to respond to internal audit findings stating corrective measures to be taken to avoid recurrence of the audit exception. The management responses shall be included in the internal audit reports that are delivered to the casino operator licensee's management, the commission, audit committee of the board of directors, or other entity designated by the commission.