In the older gambling areas clearly demonstrates the need for strict planning, rigorous internal control and careful auditing. The author describes regulatory and auditing practices that have been used in an activity where an infinite variety of fraud can be expected Auditors can apply the concepts to the degree required in other not so risky situations.

The Act for the Regulation of Gaming on Indian Lands public Law 100- 497, october 17, 1988) is another milestone in the expanding gaming industry. This Act effectively allows Indian tribes, on a state by state basis, to engage in any gaming activity already permitted by that state.

Indian tribes will find that they have plenty of competition for gaming revenues. Nevada, New Jersey and Puerto Rico have been in the casino business for a number of years. In recent years, South Dakota and Iowa have legalized casinos on a limited basis and selected towns in Colorado have just approved casino gaming.

Riverboat casinos have been approved in illinois, Iowa, and MississipPi. Missouri, Pennsylvania and Louisiana are also considering riverboats as one of a number of legalized gaming operations. Shipboard casinos are currently operating on cruise ships sailing out Of Galveston, Texas, Mississippi Gulf ports, Florida, and San Francisco.

Detroit, michigan also had a casino initiative but it failed at the polls. For example, North Dakota hardly seems like a gaming mecca, vet today there are over 350 organizations licensed for gambling in that state, with active gambling sites approaching 520. North Dakota's Treasury Department say that gross wagers are now well over $260 million a year.

The major understatement of gaming activity may be in the area of "Charitable Gaming." Gaming and Wagering Business magazine reports that charitable gaming is legal in 32 states. Charitable gambling runs the gamut from bingo and pull-tab operations to blackJack games and craps.

MAXIMIZING THE COST/BENEFIT CONSTRAINT

The financial constraints facing the new Indian commission and other new state agencies regulating the many gaming activities may limit their capacity to fully monitor all gaming licenses. However, these organizations may be able to maximize their coverage with minimal expenditures if they follow the path taken by the Nevada Gaming Control Board (GCB). GCB has been able to hold down staff and expenditures by implementing minimum internal control standards (MICS) for the gaming industry. The Board has followed this up by also' implementing minimum external audit testing of those controls for both internal audit staffs and external independent auditors.

NEED FOR MINIMUM LEVELS OF ACCOUNTING CONTROLS

over several years, the GCB has developed controls for all aspects of gaming, and specifically in a casino environment. GCB was also instrumental in the development of the AICPA's audit and accounting guide, Audits of Casinos. " Experience has shown GCB that even with proper internal controls, but without sufficient testing of these controls, frauds and skimming schemes do take place. For example, between october 1974 and May 1976, over $7 million of slot department revenues were improperly taken from four Las Vegas casinos. Casino executives argue that today, given current internal slot machine controls, and control testing, these frauds can be spotted quickly.

Examples of gambling fraud are not limited to Nevada. For example, law enforcement agencies in North Dakota have alleged that widespread cheating has occurred. Given the problems facing a small state such as North Dakota, the Indian Gaming ACt could present similar problems, but on a larger scale. Concerns over the ability of the National indian Gaming commission to effectively monitor and enforce regulations have already come to light. The concern is that lack of proper monitoring will allow entry by criminal elements. A protected federal witness who said he had direct ties to organized crime told a Senate investigating committee that he personally knew of mob infiltration into gambling operations of 12 Indian tribes.

In 1972, slot fraud resulted in the removal of all slot machines from ArmY bases. Congressional inquiries and subsequent audits of slot machine operations disclosed that grossly inadequate internal controls engendered an environment of mismanagement and potential fraudulent practices, which were a particular embarrassment to the Army.

A LOOK AT MINIMUM INTERNAL CONTROL STANDARDS

Gaming operations are subject to a greater than normal risk of loss from employee or customer dishonesty because a) it is not practical to record all individual game table transactions, b) cash receipts or equivalents are not recorded until they are removed from drop boxes and counted, and c) revenues produced are not from sales of products or services that are readily measurable. Minimizing these risks requires the development of procedures that can control the authorization, accountability, and safekeeping of the gaming operations' major asset, cash. These procedures include paper controls, physical safeguards, and human controls.

Application of paper controls leaves a certain amount of documentary, evidence that can be tested by inspection of transaction documents and records along with appropriate signatures and stamps. Physical safeguards, including safes and cashiers' cages, provide self-evident controls. People controls represent activities including supervision or accountability for transactions.

People controls, i.e., people-to-people checks, frequently leave no audit trail of documentary evidence and are more difficult to observe continuously. Misunderstanding of these types of controls can often lead to attempts to circumvent controls with the resulting possibility of fraud. The high frequency of non-documented cash transactions in casinos means that people controls play a larger role than in many other industries. Assurance that these controls are working can only be achieved by corroborative inquiries and actual observation of routine operations.

NEW JERSEY AND NEVADA REGULATIONS CONTRASTED

Because of the importance of internal controls in the gaming industry most states have developed specific regulations dealing with reporting requirements, general internal control guidelines, and certain minimum required procedures to be followed by the casino operators. However, these requirements vary from state to state. For example, comparison of regulations between Nevada and New Jersey indicates substantially different approaches. Nevada's accounting regulation (Regulation 6) is only 16 pages, whereas New Jersey's (Regulation 19:45) is over 100 pages.

One distinction is that the Nevada regulations provide more flexibility by allowing the GCB to set policy concerning many of the specific controls. For example, neither the MICS nor the requirement for the external auditor's testing of MICS are in the Nevada regulations. This approach allows GCB more flexibility for making changes in controls without having to pursue the political process of amending the regulations.

Nevada also allows each licensee to develop internal controls that fit its circumstances as long as they fall within standardized subscribed control procedures. While New Jersey, follows Nevada's approach, New Jersey, demands far more detail and standardization, a result of the New Jersey legislation and regulations. This can be illustrated by comparing Nevada's and New Jersey's approaches for control testing. The New Jersey Casino Control Commission currently requires a team of five inspectors to be on the casino floor around the clock at the casino's expense. In 1982, these inspectors cost each casino more than $100,000 per month. At the same time, the New Jersey Division of Gaming Enforcement is also required to make random observations of casino operations. These observations deal with internal control system effectiveness, but the emphasis is on criminal activity and its prosecution. Each casino is also required to maintain a closed-circuit-TV surveillance system.

New Jersey's internal control and procedures certainly provide better reliance for revenue amounts, but they are very costly and restrict gaming operations to very large enterprises. Nevada, on the other hand, has state agents perform the same tasks as in New Jersey, but Nevada agents operate on a random and surprise basis. While Nevada's regulations do not specifically define internal control guidelines, GCB establishes a minimum standard.

The wide range of internal controls that had previously existed, along with the disparity in testing these controls by external auditors, resulted in GCB's issuance in 1989 of a Guideline entitled, Minimum Internal Control Standards" (MICS) and "Independent Accountant Minimum Internal Control Standards Compliance Questionnaire for Group I and Group H Licensees.

The GCB believes that use of the questionnaire should remedy the disparity in the amount and scope of testing of MICS. It will also ensure that each licensee's compliance with MICS is consistently evaluated by the external auditors to (he degree intended by regulation.

The guidelines require external auditors to use "criteria established by the chair" in determining whether a casino licensee is in compliance with MICS. The questionnaire represents a series of checklists put together by the GCB's Audit Division, to be used by the external auditors in determining whether the licensee's operations are in compliance with MICS. The checklists cover the operating areas of table games, slots, manual keno, computerized keno, bingo, manual race and sports book, computerized race and sports book, card games, and cage and credit.

EXTERNAL AUDITOR MICS TESTING

As part of MICS, the external auditor is required to make at least one unannounced observation of each gaming area of slot drop, table games drop, slot count, and table games count. "Unannounced" means that no officer, director, or employee is given advance information regarding the date or time of such observation. Arrangements should be made between the licensee and the auditor to ensure proper identification of the auditor, while providing for prompt access to the count rooms.

The reason for these visits is to give the auditor the opportunity of viewing normal controls as they exist. If this procedure had been in place in earlier years, the $7 million slot machine skimming fraud that took place in Las Vegas surely would not have been possible. GCB also requires that drop and count observations must not be performed in conjunction with the external auditor's normal year-end procedures.

Minimum agreed upon GCB procedures for external auditors also include observation of licensee's employees as they perform their duties. Auditors tend to find this procedure an enjoyable perk of the job, because in many cases they are allowed to gamble in order to observe these procedures. Again, the objective is to view implemented controls in an ordinary environment; the auditor is required to act like a normal gaming patron. The extent of testing of the MICS is determined by the percentage of annual gross gaming revenues from each department of the casino.

AUDITOR'S MICS TESTING OF SLOTS

The slot department produces more than 50% of the revenue of most casinos. Familiarity with transactions involving slot machines should demonstrate that revenue cannot be recognized until coins are taken from the machine and counted. Between the playing of a coin and the recording of its count, there are, without proper internal controls, many opportunities for skimming.

The usual recording practice is, on a periodic basis and usually early in the morning, to have a team of employees open each slot machine and remove coins from the drop bucket. The team then takes the coins to a count room where the coins are counted, wrapped and sent to the cage. GCB requires each gaming establishment to state the exact time and day that the slot drop begins. This helps the auditor and enforcement agents in their work.

The MICS compliance questionnaire developed by the GCB includes tests of the effectiveness of controls for safeguarding revenues generated by the slot department. Basically these procedures look at controls for slot revenues from five standards: 1) drop standards; 2) equipment standards; 3) slot count and wrap standards; 4) Jackpots and slot fills; and 5) theoretical/actual hold standards.

Drop Standards

Minimum internal slot drop standards have been developed to prevent skimming between the time the money is taken from the slot machine and when it is placed in the count room. They are designed to prevent collusion between drop teams and to safeguard assets while being moved from the machine to the count room. Such procedures are almost entirely based on people-to-people controls. Minimum tests of these controls are used as evidence that:

* There are a minimum of three persons involved in the removal of the slot drop with at least one being independent of the slot department; and

* Security personnel keep track of buckets of money from the time they are taken from the machine until they are placed in the count room.

Equipment Standards

The major means of skimming, once the slot money is in the count room, involves the weight scales and mechanical coin counter in the count room. Another common skimming action is for individuals to walk out with coins. Therefore internal controls within the count room call for guarding and safe- keeping equipment used for counting coins. Therefore testing is required of both physical controls as well as people controls. The external auditor's testing of these controls includes the following:

* Evaluating controls over the weight scale and the mechanical coin counter. Control procedures include having individuals independent of the cage, vault, slot, and count team functions present whenever this equipment is accessed.

* Documenting the testing of equipment by either the internal or external auditors on a regular quarterly basis.

* Verifying the slot count, with at least two individuals, to determine the accuracy of the weight scale with varying weights or with varying amounts of previously counted coins of each denomination to ensure the scale is properly calibrated.

Slot Count and Wrap Standards

Once again people controls play a large role in the count room. GCB minimum controls require a scanning camera as a protection from count room employees walking off with coins. Control testing includes making sure of the following:

* There is no access to the count room unless at least three members of the slot count team are present.

* Slot count team personnel do not include any supervisory personnel from the slot department.

* The amount of the slot drop from each machine is recorded in ink or mechanically printed on a slot count document and two members sign the slot count document attesting to the accuracy of the initial weight/count.

* Coins from each slot drop are wrapped and reconciled in a manner that precludes their being commingled with coins from the next slot drop.

* Team members count and compare the calculated wrapped coins with the initial weight/count, record the comparison, and note any variances on the summary report.

Jackpot Payouts and Slot Fills

Jackpot payouts and slot fills represent the major paperwork in the slot department. Jackpot payouts are payments in excess of the slot drop. For example, if a $100 Jackpot is hit, lights and sounds will result but payment will be made by slot personnel. Slot fills occur when a machine actually runs out of coins. Slot personnel have to open the machine and replenish it. Every Jackpot payout and fill initiates the use and completion of a form and thus results in a paper control that can be verified.

GCB specifically requires the external auditor to test whether these paper controls are being performed. The Board actually states the minimum scope associated with testing these controls. For both Jackpot payouts and slot fills, the external auditor is required to select 10 slips per day for two days. Each day selected should be in a different month. Testing involves the review of each form for verification of: 1) date and time; 2) machine number; 3) dollar amount of the payout or fill; 4) reel symbols; 5) signatures of at least two employees verifying and witnessing the payout or slot fill; and for 6) Jackpots over a predetermined amount requiring the signature and verification of supervisory or management personnel independent of the slot department.

Theoretical/Actual Hold

Because of the limited documentation in regard to casino revenues and the resulting inability to apply substantive tests of details, analytical review procedures are important in testing casino revenues. Testing slot revenues is accomplished by comparison of the slot machine's theoretical hold results to the actual results.

The theoretical hold of a slot machine is the intended hold percentage or win as computed by reference to its payout schedule and reel strip settings. Deviation of the actual hold percentage from the theoretical hold percentage is a sign of either mechanical, electrical, or other performance problems.

The GCB views this analysis of theoretical/actual hold for each machine as a primary tool of internal control over slot revenue. Its minimum requirement is that the external auditor test and provide evidence of the following:

1. Each slot machine has a functioning "coin-in" meter.

2. Each slot machine "coin-in" meter is read at least weekly.

3. The accounting department reviews meter readings for reasonableness using pre-established parameters.

4. All unreasonable readings are evaluated and corrective action taken.

5. A theoretical/actual hold comparison report is produced at least on a monthly basis.

6. Statistical reports are reviewed by both slot department management and management personnel independent of the slot department on at least a monthly basis.

7. Large variances between theoretical hold and actual hold are investigated, resolved, and the findings documented in a timely manner.

Again, the essence of GCB's position is that each department have a minimal level of internal controls and that the external auditors test these controls to see if they are effective. If casinos do not satisfy these minimum levels, the external auditor is required to report to the GCB outlining the problem areas. The Board will then require the casino to correct these violations or will shut it down.

CONCLUSION

The continued interest in gaming activity is producing many forms of regulation. most states do not have the resources, expertise, ability, or funding to implement procedures or oversee proper monitoring of the new types of gaming that are expected to proliferate, from passage of new gaming laws or the Indian Gaming Law.

Years of experience in Nevada have clearly shown that a lack of guidance and standards for controls have led to opportunities for major skimming or other fraudulent acts. Creation of standardized minimal internal and external controls along with requirements for increased involvement of and reporting by external auditors, such as those now existing in Nevada, can go a long way toward providing a sound basis for regulating the gaming industry.

John R. Mills, CPA, is an Associate professor, Accounting and Information systems Department college of Business Administration at the University of Nevada at Reno.