Licensee's System of Internal Controls

(1) At least 60 days prior to commencing operations a gaming licensee shall submit to the commission its proposed minimum system of internal procedures and administrative and accounting controls (internal controls) in accordance with 205 CMR 138.02(4). An Operations Certificate shall not be issued to a gaming licensee for the commencement of gaming operations in accordance with 205 CMR until the submission is approved in accordance with 205 CMR 138.02(2). The commission or its designee may perform any inspection necessary in order to determine conformance with the approved internal controls. (2) The commission shall refer the proposal submitted in accordance with 205 CMR 138.02(1) to the Executive Director who shall review the submission for compliance with M.G.L. c.23K, 205 CMR 138.00 and other applicable sections of 205 CMR. Upon completion of review the Executive Director shall either approve the submission or advise the gaming licensee in writing of anydeficiency, and mayinclude anyother recommendations and/or required changes intended to ensure that a robust system of internal controls is implemented. The gaming licensee may either accept a recommendation or required change in writing or advise the Executive Director in writing as to the reason for its disagreement. The gaming licensee may dispute any determination or recommendation made bythe Executive Director to the commission which shall resolve the issue. The commission or the Executive Director may revisit any provision of the internal controls at any time and direct adjustment if necessary, and provide for a reasonable implementation period, to ensure that a robust system of internal controls is in effect. Upon approval by the Executive Director the gaming licensee shall be issued a writing evidencing the approval of its internal controls including any associated conditions. (3) At least 15 business days prior to changing any provision of the approved internal controls a gaming licensee shall submit the proposed change, including an explanation therefor, and new certifications from its chief legal and financial officers consistent with 205 CMR 138.02(4)(i) and (j), to the commission. The commission shall refer the proposed change to the Executive Director who shall review the proposal to determine whether it complies with 205 CMR 138.00. Changes to the system of internal controls will generally be permitted if the proposed change does not lessen the applicable administrative, accounting, or physical control. Upon completion of review the Executive Director shall either approve the proposed change or advise the gaming licensee in writing as to why the proposal does not comply with 205 CMR 138.00. The gaming licensee may appeal the Executive Director's determination to the commission which shall resolve the issue. Approved changes shall be maintained as part of the approved internal controls. Modifications to internal controls may not be implemented until approved by the Executive Director or the commission. Provided, however, if the Executive Director does not object or otherwise respond to the submission in writing within 15 business days of receipt of the submission, the gaming licensee may make the proposed change subject to further direction by the Executive Director in accordance with 205 CMR 138.02(3). (4) The internal controls shall include the following: (a) Administrative controls which include, as their primary objective, policies and procedures designed to assure that all activities and transactions of the gaming licensee are instituted and completed in accordance with the applicable policy and/or procedure. (b) Accounting controls, as detailed in 205 CMR, which include, as their primary objective, procedures to assure that all activities and transactions of the gaming licensee are accurately reported and recorded in accordance with generally accepted accounting principles. (c) Reporting controls which shall include policies and procedures for the timely reporting of economic and social impact reports, and standard financial and statistical reports and information in accordance with 205 CMR. (d) Surveillance controls as detailed in 205 CMR 141.00: Surveillance of the Gaming Establishment. (e) Physical controls which include, as their primaryobjective, the safeguardingof company assets to include safeguards in the form of organizational safeguards, such as segregation of duties between incompatible functions, and physical safeguards such as restricted access to assets and routine security devices such as cameras and locking doors. (f) A network security plan as described in 205 CMR 143.12: Network Security. (g) A plan to ensure compliance with 205 CMR 140.00: Gross Gaming Revenue and Tax Remittance and Reporting. (h) All applicable policies and procedures required pursuant to 205 CMR 138.04 through 138.70. (i) A certification by the gaming licensee's chief legal officer that the submitted procedures conform to M.G.L. c. 23K, 205 CMR 138.00, and any applicable regulations referenced therein; and (j) A certification by the gaming licensee's chief financial officer that the submitted procedures provide adequate and effective controls, establish a consistent overall system of internal procedures and administrative and accounting controls, and conform to generally accepted accounting principles and 205 CMR. (5) Nothing in 205 CMR 138.00 shall be interpreted so as to limit a gaming licensee's use of technology, provided that, if the gaming licensee intends to utilize any new technology not identified in its initial proposal, it shall submit the changes to its system of internal controls to incorporate the use of any such new technology to the commission which shall refer the proposed change to the Executive Director who shall review the proposal in accordance with 205 CMR 138.02(3). (6) (a) If a gaming licensee desires to incorporate a provision in its internal controls that is not in conformance with 205 CMR 138.00, or to exclude a provision required by 205 CMR 138.00, it may petition to do so by including its proposal in its internal controls filing, or petition to change a provision of the internal controls in accordance with 138.02(3), along with a citation to the applicable provision of 205 CMR 138.00 and a written explanation as to why the variance is being requested. The Executive Director may allow the variance upon a finding that the proposal is at least equivalent to the relevant provision contained in 205 CMR 138.00 and/or that the proposal is likely to achieve the same outcome as if the provision contained in 205 CMR 138.00 were incorporated. Such variance shall be identified in the written approval issued in accordance with 205 CMR 138.02(2) and a report filed with the commission that identifies the provision of 205 CMR 138.00 that a variance was granted from and provides the general reason the variance was granted. Provided, however, that a gaming licensee may not seek a variance from any of the provisions of 205 CMR 138.40 through 138.47. (b) In the event that a gaming licensee will be temporarily unable to abide by a provision of its system of internal controls, the Director of the IEB, or his or her designee, may upon request by the gaming licensee grant a limited temporary variance from a provision of the gaming licensee's system of internal controls, provided that such variance shall be for a set period of time not to exceed 48 hours, that the provision at issue shall relate to the gaming operation of the gaming establishment, and that it be based on good cause shown such that the health, safety or welfare of the public or the integrity of gaming will not be adversely impacted. Provided, that a gaming licensee may not seek a limited temporary variance from any of the provisions of 205 CMR 138.40 through 138.47. Where the circumstances warrant, such a variance may be renewed by the Director of the IEB, or his or her designee, for one additional 48-hour period. All such requests and determinations shall be documented and submitted to the Executive Director for review as promptly as possible. (7) Upon approval in accordance with 205 CMR 138.02(2) and (3), the gaming licensee shall implement and abide by its system of internal controls. The commission and the IEB may take any steps necessary to determine whether the internal controls are being followed and to enforce compliance. The gaming licensee shall periodically compare its approved system of internal controls, as written, to the system actually in place and operating for the purpose of identifying areas of non-compliance, if any, so as to take immediate corrective action. The periodic comparison shall be performed by either independent auditors or internal auditors. (8) The gaming licensee shall maintain in its records and at all times a complete set of its system of internal controls in effect at that time. (9) When possible, all filings and records required to be submitted to the commission in accordance with 205 CMR 138.00 shall be done electronically unless otherwise directed by the commission. (10) To the extent a third-party is involved in or provides any of the internal controls required in 205 CMR 138.00, the gaming licensee's controls must document the roles and responsibilities of the third-party and must include procedures to evaluate the adequacy of and monitor compliance with the third-party's system of internal controls. (11) A gaming licensee that is also licensed as a Sports Wagering Operator shall comply with 205 CMR 138.00 as well as 205 CMR 238.00: Uniform Standards of Accounting Procedures and Internal Controls for Sports Wagering. Where compliance with provisions of both regulations is not possible, the Gaming Licensee shall comply with 205 CMR 138.00 with respect to gaming operations and 205 CMR 238.00 with respect to Sports Wagering Operations and identify its intent to do so in a written system of Internal Controls.