Minimum Internal Control Standards for Class II Gaming, 60492-60508 [E8-23081]

Agencies

• DEPARTMENT OF THE INTERIOR
• National Indian Gaming Commission

[Federal Register Volume 73, Number 198 (Friday, October 10, 2008)]
[Rules and Regulations]
[Pages 60492-60508]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: E8-23081]



Federal Register / Vol. 73, No. 198 / Friday, October 10, 2008 / 
Rules and Regulations

[[Page 60492]]


-----------------------------------------------------------------------

DEPARTMENT OF THE INTERIOR

National Indian Gaming Commission

25 CFR Parts 542 and 543

RIN 3141-AA37


Minimum Internal Control Standards for Class II Gaming

AGENCY: National Indian Gaming Commission (``NIGC'' or ``Commission''), 
Interior.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: This rule supersedes certain specified sections of the current 
Minimum Internal Control Standards and replaces them with a new part 
titled Minimum Internal Control Standards for Class II Gaming. Since 
the implementation of Minimum Internal Control Standards (MICS), it 
became obvious that the MICS require technical adjustments and 
revisions so that they can effectively protect tribal assets, while 
still allowing tribes to utilize technological advances in the gaming 
industry. This rule applies only to Class II games.

DATES: This regulation is effective November 10, 2008, except for the 
amendments to Sec. Sec.  542.7 and 542.16, which are effective October 
13, 2009. The incorporation by reference of certain publications listed 
in the rule is approved by the Director of the Federal Register as of 
November 10, 2008. Existing operations must develop tribal internal 
controls (TICS) within six months of the effective date and must 
implement those controls within 6 months of the development of the 
TICS. New operations (those that are not open on the effective date) 
must develop and implement the TICS when they open.

FOR FURTHER INFORMATION CONTACT: Joe H. Smith, Director of Audits, 
telephone 202-632-7003. This is not a toll free call.

SUPPLEMENTARY INFORMATION:

Withdrawal of Classification Standards and Amendment to Definition of 
Facsimile

    The Commission has withdrawn the Classification standards it 
proposed on October 24, 2007. ``Classification Standards for Bingo, 
Lotto, Etc. as Class II Gaming When Played Through an Electronic Medium 
Using `Electronic Computer, or Other Technologic Aids.' '' 72 FR 60483. 
The Commission has also withdrawn the amendment to the definition of 
``electronic or electromechanical facsimile,'' also proposed on October 
24, 2007. ``Definition for Electronic or Electromechanical Facsimile.'' 
72 FR 60482. See the Commission's notices of withdrawal, published 
simultaneously.

Background

    On October 17, 1988, Congress enacted the Indian Gaming Regulatory 
Act (``IGRA'' or ``Act''), 25 U.S.C. 2701-21, creating the National 
Indian Gaming Commission (``NIGC'' or ``Commission'') and developing a 
comprehensive framework for the regulation of gaming on Indian lands. 
25 U.S.C. 2702. The NIGC was granted, among other things, the authority 
to promulgate such regulations and guidelines as it deems appropriate 
to implement the provisions of IGRA, 25 U.S.C. 2706(b)(10), as well as 
oversight and enforcement authority, including the authority to monitor 
tribal compliance with the Act, Commission regulations, and tribal 
gaming ordinances.
    The Commission believes that the importance of internal control 
systems in the casino operating environment cannot be overemphasized. 
While this is true of any industry, it is particularly true and 
relevant to the revenue generation processes of a gaming enterprise, 
which, because of the physical and technical aspects of the games and 
their operation and the randomness of game outcomes, makes exacting 
internal controls mandatory. The internal control systems are the 
primary management procedures used to protect the operational integrity 
of gambling games, account for and protect gaming assets and revenues, 
and assure the reliability of the financial statements for Class II and 
III gaming operations. Consequently, internal control systems are a 
vitally important part of properly regulated gaming. Internal control 
systems govern the gaming enterprise's governing board, management, and 
other personnel who are responsible for providing reasonable assurance 
regarding the achievement of the enterprise's objectives, which 
typically include operational integrity, effectiveness and efficiency, 
reliable financial statement reporting, and compliance with applicable 
laws and regulations.
    The Commission believes that strict regulations, such as the MICS, 
are not only appropriate but necessary for it to fulfill its 
responsibilities under the IGRA to establish necessary baseline, or 
minimum, Federal standards for all Tribal gaming operations on Indian 
lands. 25 U.S.C. 2702(3). Although the Commission recognizes that many 
Tribes had sophisticated internal control standards in place prior to 
the Commission's original promulgation of its MICS, the Commission also 
continues to believe that promulgation and revision of these standards 
is necessary and appropriate to effectively implement the provisions of 
the IGRA and, therefore, within the Commission's clearly expressed 
statutory power and duty under Section 2706(b)(10) of the Act.
    On February 22, 2007, the Commission held a meeting of its 
Classification Standards Advisory Committee. At this meeting the tribal 
representatives on the committee presented to the Commission a draft of 
descriptive technical standards for Class II gaming. As the technical 
standards were being developed the Commission realized that many of the 
provisions being considered for inclusion were not technical standards 
but rather internal controls. After reviewing the technical standards 
draft, the Commission decided that for the technical standards to be 
effective, it would have to make changes to its existing minimum 
internal control standards (MICS). The updating of MICS will be done in 
phases with the first phase limited to those areas that have a direct 
impact on the technical standards that are being issued 
simultaneously--specifically bingo and other games similar to bingo.
    Currently, MICS for both Class II and Class III gaming are 
contained in 25 CFR part 542. As there are some essential differences 
between Class II and Class III gaming, the Commission decided that 
there should be separate MICS for Class II and Class III gaming. 
Therefore, the Commission is adopting a new part 543 that would be 
limited to Class II gaming.
    To complete this task, the Commission requested that its standing 
MICS Advisory Committee embark on an aggressive schedule to complete 
the new draft part 543 to be published concurrently with the publishing 
of technical standards. Additionally, members of the Classification 
Standards Advisory Committee assisted in drafting MICS revisions to 
ensure that any changes were consistent with the draft technical 
standards. The Commission had originally planned to reflect the 
structure of part 542 in the drafting of new part 543. The controls in 
part 542 are categorized by the type of game they apply to or by an 
area within the gaming operation. However, during a MICS Advisory 
Committee meeting held on June 25, 2007, in Dallas, Texas, tribal 
representatives on the MICS Committee urged the Commission to adopt a 
format for the new MICS regulations different than the one originally 
proposed by the Commission. This alternative format focused on the type 
of game rather than the function that is being performed. This format 
represented a departure

[[Page 60493]]

from the longstanding practice of establishing controls specific to 
functions. Following this meeting, the Commission decided to go forward 
with the suggested alternative format. This new format is a one-size-
fits-all set of controls governing the game of bingo and games similar 
to bingo, whether played manually or electronically, without regard to 
how the game actually functions.
    The tribal representatives to the MICS Committee utilized a working 
group, referred to by them as the Tribal Gaming Working Group (TGWG), 
to solicit information from tribal regulators, operators, and 
manufacturers. Tribal representatives requested that they be allowed 
time to consult with this group before providing advice to the 
Commission. The Commission agreed and between June and September 2007, 
the TGWG met several times in person and conducted numerous conference 
calls. The Commission did not participate in the establishment of this 
working group. However, Commission staff was invited to attend all of 
the meetings and participate in some of the conference calls. The 
Commission felt it was important to make staff available to this 
working group to answer questions about the goals of the Commission in 
drafting regulation revisions. Commission staff participated in this 
capacity during in-person meetings on July 15, 2007, in Seattle, 
Washington; on July 24, 2007, in Arlington, Virginia; and on August 13 
and 27, 2007 in Las Vegas, Nevada.
    The Commission is grateful to the tribal representatives on the 
MICS Advisory Committee and to those who assisted the tribal 
representatives for all of their hard work and for the high quality 
draft minimum internal control regulations that resulted from their 
efforts. The rule is largely adopted from the final draft MICS, 
delivered to the Commission by the tribal representatives of the 
Advisory Committee on September 4, 2007.
    The full committee, including the Commission, met to discuss the 
draft on September 12, 2007, in Arlington, Virginia. During this 
meeting the Commission raised questions about the draft regulations and 
received responses from the tribal representatives. The Commission also 
allowed members of the audience to make comments on the draft MICS as 
well as the process for developing them.
    There are places, of course, where the Commission felt it could not 
accept the MICS Committee's recommendations. As such, the Commission 
proposed rules that were at times more stringent and at times less 
stringent than those recommended by the Committee.
    While it will eventually be necessary to bring many of the controls 
currently contained in part 542 into new part 543, in order to have 
separate and independent MICS for Class II and Class III gaming, the 
Commission felt it was necessary to structure this migration in phases. 
The most immediate concern was the controls related to bingo and other 
games similar to bingo. These controls were addressed first so that the 
Class II MICS would not conflict with proposed technical standards. 
Accordingly, the proposed rule addresses only the game of bingo, other 
games similar to bingo, and directly related information technology 
controls. Many of the provisions of part 542 will remain effective and 
applicable to class II games until such time as replacement regulations 
are enacted by the Commission.
    The second phase of this process of developing a comprehensive set 
of Class II MICS will address forms of Class II gaming other than bingo 
and games similar to bingo, such as pull-tabs and poker, and will 
codify the rules governing the processes that support the games, such 
as drop and count, cage, credit and internal audit. Furthermore, just 
as with part 542, the concept of tier classification will be preserved, 
so that smaller gaming operations will be subject to a set of MICS 
better tailored to the risks found in small gaming operations and the 
resources available for addressing them.

Regulatory Matters

Regulatory Flexibility Act

    The Regulatory Flexibility Act generally requires an agency to 
prepare a regulatory flexibility analysis of any rule subject to notice 
and comment rulemaking requirements under the Administrative Procedure 
Act or any other statute, unless the agency certifies that the rule 
will not have a significant economic impact on a substantial number of 
small entities. Small entities include small businesses, small 
organizations, and small governmental jurisdictions.
    For purposes of assessing the impact of the MICS on small entities, 
``small entity'' is defined as: (1) A small business that meets the 
definition of a small business found in the Small Business Act and 
codified at 13 CFR 121.201; (2) a small governmental jurisdiction that 
is a government of a city, county, town, school district or special 
district with a population of less than 50,000; and (3) a small 
organization that is any not-for-profit enterprise that is 
independently owned and operated and is not dominant in its field.
    Indian tribes and tribal casinos do not meet this definition. 
Tribes are excluded from the governmental jurisdictions listed under 
(2), and tribally owned casinos are not ordinary commercial activities 
but are tribal governmental operations.
    In determining whether a rule has a significant economic impact on 
a substantial number of small entities, the impact of concern is any 
significant adverse economic impact on small entities, because the 
primary purpose of the regulatory flexibility analyses is to identify 
and address regulatory alternatives ``which minimize any significant 
economic impact of the proposed rule on small entities.'' 5 U.S.C. 603 
and 604. Thus, an agency may certify that a rule will not have a 
significant economic impact on a substantial number of small entities 
if the rule relieves regulatory burden, or otherwise has a positive 
economic effect on all of the small entities subject to the rule.
    As a practical matter, the economic impacts of the MICS will fall 
primarily upon the Indian tribes. The MICS impose some direct costs 
upon gaming tribes--regulatory compliance costs, for example. 
Accordingly, the Commission certifies that this action will not have a 
significant economic impact on a substantial number of small entities.

Small Business Regulatory Enforcement Fairness Act

    This rule is not a major rule under 5 U.S.C. 804(2), the Small 
Business Regulatory Enforcement Fairness Act. This rule does not have 
an annual effect on the economy of $100 million dollars or more. This 
rule will not cause a major increase in costs or prices for consumers, 
individual industries, federal, state or local government agencies or 
geographic regions and does not have a significant adverse effect on 
competition, employment, investment, productivity, innovation, or the 
ability of U.S. based enterprises to compete with foreign-based 
enterprises. The Commission has determined that the cost of compliance 
with this regulation shall be minimal for several reasons. First, part 
542 has been in effect since 1999 and requires that all Indian gaming 
operations be in compliance with the MICS. Second, considering that the 
Indian gaming industry spent approximately $419 million in 2006 on 
regulation and given the testimony of various tribal and industry 
leaders, it can be assumed that almost all gaming operations are 
compliant with part 542

[[Page 60494]]

or more stringent tribal internal control standards. Given the 
widespread compliance with part 542, the cost of complying with new 
part 543 should be minimal. Finally, the Commission contracted for a 
cost-benefit analysis for this rule as part of a package of four rules. 
The Commission decided not to go forward with the rules that would have 
a significant economic impact on the tribes. The study concluded that 
the cost of the MICS would not be significant. Specifically, the report 
states that the promulgation of MICS and technical standards is 
estimated to cost 7.8 million annualized over ten years. Accordingly, 
the MICS are not a major rule within the meaning of 5 U.S.C. 804.2, the 
Small Business Regulatory Enforcement Fairness Act. The Commission's 
cost-benefit analysis is available for review at the Commission's web 
site, www.nigc.gov, or by request using the addresses or telephone 
numbers, above.

Paperwork Reduction Act

    This regulation requires an information collection under the 
Paperwork Reduction Act, 44 U.S.C. 3501 et seq., as did the regulation 
it replaces. There is no change to the paperwork requirements created 
by this rule.

Unfunded Mandates Reform Act

    The Commission, as an independent regulatory agency within the 
Department of the Interior, is exempt from compliance with the Unfunded 
Mandates Reform Act, 2 U.S.C. 1502(1); 2 U.S.C. 658(1).

Takings

    In accordance with Executive Order 12630, the Commission has 
determined that this rule does not have significant takings 
implications. A takings implication assessment is not required.

Civil Justice Reform

    In accordance with Executive Order 12988, the Office of General 
Counsel has determined that the rule does not unduly burden the 
judicial system and meets the requirements of sections 3(a) and 3(b)(2) 
of the Order.

National Environmental Policy Act

    The Commission has determined that this rule does not constitute a 
major federal action significantly affecting the quality of the human 
environment and that no detailed statement is required pursuant to the 
National Environmental Policy Act of 1969, 42 U.S.C. 4321 et seq.

Comments to Class II Minimum Internal Control Standards

    We requested written comments from the public on the proposed Class 
II Minimum Internal Control Standards (72 FR 60495) during the comment 
period that opened on October 24, 2007, and closed on March 9, 2008. 
This proposed rule was published on the same day as three other 
proposed rules related to the regulation of Class II gaming. During the 
comment period, we received many comments that were not specific to the 
MICS but rather referred to the package of Class II rules proposed on 
October 24, 2007. Only a few of these comments were specific to the 
MICS. However, we considered the general comments as applying to the 
MICS as well as to the rest of the package. The comments are grouped 
based on the common topics addressed. The Commission carefully reviewed 
all comments and where appropriate revised the final rule to reflect 
those comments. The comments and the NIGC responses follow.

Comments Regarding Publication of the Proposed Class II MICS

    Comment: The publishing of 5 proposed regulations simultaneously 
violates the federal trust responsibility and contravenes Executive 
Order 13175.
    Response: The Commission published 4 proposed rules simultaneously 
as part of one package related to class II gaming. Since the rules all 
pertained to the regulation of Class II gaming activities the 
Commission determined that it was important for all interested parties 
to consider all of the parts at once. The other regulation published by 
the Commission was the facility licensing regulations that were not 
part of the previously mentioned package. We disagree that following 
the notice and comment requirements of the Administrative Procedures 
Act violates the trust responsibility.
    Further, Congress has made abundantly clear that it intended the 
Commission to be an independent regulatory agency and, as such, exempt 
from the requirements of these Executive Orders and the Unfunded 
Mandates Reform Act. The Senate report accompanying the passage of IGRA 
provides Congress's intention clearly and unambiguously: the bill 
``established a National Indian Gaming Commission as an independent 
agency within the Department of Interior.'' S. Rep. No. 100-446, at 1 
(1988). When it amended IGRA in 2005, Congress reiterated its 
intention:

    Additionally, it is to be noted that the NIGC is an independent 
regulatory agency. This status has ramifications, including, that 
the agency is not governed by Executive Order 13175, which compels 
agencies other than independent regulatory agencies to consult 
tribal officials in the development of regulatory policies that have 
tribal implications. The Executive Order encourages independent 
agencies to observe its precepts, however, and the Committee notes 
with approval that the Commission, through its current consultation 
policy, has endeavored to do so.

S. Rep. No. 109-122 at 3 (2005).

    Comment: Several comments suggested that the NIGC may have violated 
the Government Performance and Results Act (``GPRA'') by embarking on 
several rulemaking exercises without an overall plan in violation of 
Public Law 109-221.
    Response: The Commission agrees that Public Law 109-221, the Native 
American Technical Corrections Act of 2006, provides that the NIGC 
shall be subject to the GPRA. On September 30, 2007, the NIGC submitted 
a draft performance and accountability report to the Office of 
Management and Budget for review. The Commission made revisions to its 
GPRA plan and on September 18, 2008, mailed it to tribal leaders for 
comment.

Comments Regarding NIGC Authority to Promulgate MICS

    Comment: A few commenters suggested that the Commission lacks the 
authority to promulgate Class II MICS, one analogizing the situation to 
that in Colorado Indian Tribes v. NIGC, where the DC Circuit ultimately 
found the Commission lacked the authority to enforce Class III MICS.
    Response: The Commission disagrees. IGRA does give the Commission 
the authority to adopt Class II MICS. Congress was expressly concerned 
that gaming under IGRA be ``conducted fairly and honestly by both the 
operators and the players'' and that the ``Indian tribe is the primary 
beneficiary of the gaming operation.'' 25 U.S.C. 2702(2). To carry out 
this mission Congress granted the Commission the power to monitor, 
inspect, and examine Class II gaming. 25 U.S.C. 2706(b)(1)-(4), and to 
promulgate such regulations as it deems appropriate to implement the 
provisions of IGRA. 25 U.S.C. 2706(b)(10). The creation of MICS 
provides the basis for which the Commission can monitor, inspect, and 
examine. The Class II MICS create procedures the Commission can verify 
are being followed as well as creating a revenue trail. Without a set 
of national standards it would be very difficult for the Commission to 
exercise its power in a meaningful manner and therefore fulfill its 
mission.

[[Page 60495]]

Comments Regarding NIGC Consultation With Tribes

    Comment: Several comments pertained to the level of consultation 
conducted in connection with the regulations stating that the NIGC did 
not conduct meaningful consultation and that the consultation conducted 
was in violation of the NIGC's consultation policy. Further, commenters 
stated that the use of an advisory committee was not an acceptable 
substitute for consultation.
    Response: The NIGC published its Government-to-Government Tribal 
Consultation Policy on March 24, 2004, 69 FR 16973. In that policy, the 
Commission recognized the government-to-government relationship that 
exists between the NIGC and federally-recognized tribes and stated that 
the primary focus of the NIGC's consultation policies would involve 
consulting with individual tribes and their recognized governmental 
leaders. The Commission's consultation policy also calls for providing 
early notification to affected tribes of any regulatory policies prior 
to a final agency decision regarding their formulation or 
implementation.
    The Commission conducted extensive consultations that included the 
formation of a tribal advisory committee, face-to-face meetings with 
tribal governments, and regional meetings with tribal gaming 
associations. Additionally, the Commission followed the formal 
rulemaking process under the Administrative Procedures Act thereby 
providing tribes another opportunity to submit written comments.
    As to the quality of consultation, some comments were critical of 
the Commission for not allotting sufficient time for individual 
consultation sessions. The Commission understands and appreciates this 
concern. The Commission would note, however, that it goes to great time 
and expense traveling to large, regional and national gaming 
association meetings to make itself available for consultations, and 
this minimizes the burdens of time and expense for the tribes. The 
Commission would point out as well that with approximately 225 tribes, 
balance of time spent between consultations and the Commission's other 
duties and obligations is often a difficult one to make. Further, the 
Commission believes that the criticism concerning the quality of 
consultation about the technical standards, however, is an unfair one, 
when only 25% of tribes accepted invitations for consultation between 
September 2005 and December 2007 and only a minority of those that 
accepted actually chose to discuss the MICS. That said, the Commission 
recognizes that there are many views about what consultation is and how 
it may best be done. The Commission is not married to its consultation 
practices and has already begun a dialogue and collaboration with 
tribal leaders, through the National Congress of American Indians and 
the National Indian Gaming Association, about finding mutually 
satisfactory methods of consultation.
    Comment: Several comments stated that the proposed rule represented 
a material departure from the consensus documents submitted by the 
Tribal Advisory Committee.
    Response: We disagree. The proposed rule accepted almost all of the 
suggestions by the Tribal Advisory Committee. Further, in the final 
regulation the Commission has made changes further closing the distance 
between the proposed rule and the alternative proposed by the Tribal 
Advisory Committee. As stated in the preamble, the Commission greatly 
values and appreciates the work on the MICS done by the tribal advisory 
committee and the working group of tribal leaders, tribal regulators, 
and manufacturers who advised them. During drafting, the Commission did 
state to the Committee and its working group that the Committee's role 
was advisory and that the Commission could, as the final decision-
maker, choose to depart from the draft provided. The Commission 
believes that this was appropriate insofar as this is consistent with 
its federal regulatory oversight mission. Nonetheless, the draft that 
the advisory committee supplied makes up verbatim most of what the 
Commission has adopted.

Comments Regarding the Length of the Comment Period

    Comment: Several comments stated that the comment period was not 
long enough.
    Response: The October 24, 2007, notice of proposed rulemaking 
stated that the comment period would end on December 10, 2007. Based 
upon early comments received, the Commission elected to extend the 
comment period to March 9, 2008. This is a period of 138 days. The 
Commission believes this is a sufficient comment period.

Comments Regarding Implementation of Class II MICS

    Comment: Several comments stated that tribes will not be able to 
implement a wholly separate set of MICS in a gaming operation that 
conducts both Class II and Class III gaming activities without a 
complete overhaul of the operating procedures and comprehensive 
retraining of the entire staff. The logistical, organizational, and 
operational complexities, not to mention the time and expense that will 
be required to implement new Class II MICS is unworkable.
    Response: The Commission appreciates the concern and recognizes 
that the control systems of a gaming enterprise are typically defined 
by function, e.g., table games, gaming machines, counter games and card 
games. However, recent technological advances in game development have 
somewhat blurred these distinctions. It is the expectation of the 
Commission that, from a practical perspective, except for the specific 
revenue centers of the Class II MICS (bingo, pull-tabs, card games) the 
remaining sections, which are generally relevant to the accounting for 
or facilitation of the noted games will out of necessity remain 
substantively identical to their companion standards in the Class III 
MICS (part 542). The dominant exception is that controls directly 
related to a Class III game will be omitted. Consequently, we disagree. 
The Commission believes the regulations ultimately arising from the 
next phase will have minimal impact on the gaming operation conducting 
both Class II and Class III gaming.
    Comment: Incorporating the sections of part 542 listed in 543.1 
will create conflicts given that the defined terms used in the proposed 
543 may be very different from the defined term in 542. The Commission 
should take the time necessary to integrate the sections of part 542 
with the new part 543 before promulgating the final rule.
    Response: The Commission agrees, however, the risk of having gaps 
in regulation outweigh any confusion that would be caused by 
referencing part 542. It is the expectation of the Commission that this 
interim period during which the remaining part 543 sections are adopted 
will be as brief as possible.
    Comment: One comment proposed that if the Commission is unwilling 
to postpone these rules until all relevant sections of part 542 can be 
transferred that section 543.1 be amended to state, ``To the extent 
that there is a discrepancy between the language or terms contained in 
this part 543 and that contained in the sections of part 542 
incorporated by reference in section 543.1 of this part, the applicable 
language or terms contained in this part 543 shall apply.''

[[Page 60496]]

    Response: The Commission disagrees. The Commission believes that 
the risk of confusion is minimal and fully anticipates that the 
remaining sections will be proposed before TICS are required to be 
implemented.
    Comment: The proposed rule states in section 543.3(c)(3) that 
``shall in accordance with the tribal gaming ordinance, establish that 
tribal internal control standards are established and implemented.'' 
This could mistakenly be read to require revision to the tribal gaming 
ordinance.
    Response: We disagree. This provision is necessary to ensure that 
tribes follow their ordinance requirements in the promulgation of TICS. 
We note that the commenter was able to understand this provision 
correctly and are sure that other tribes and tribal gaming regulatory 
agencies will likewise be able to understand its intent.

Comments Regarding Specific Definitions

    Comment: Several comments suggested that the final definitions used 
in 543.2 of the MICS and 547.3 of the technical standards should 
conform to one another unless there is an appropriate reason for 
different terms.
    Response: We agree. Where possible the Commission has used 
consistent terms. However, it is important to recognize that the two 
regulations possess differing objectives. Part 547 is intended to 
define the technical specification of a Class II gaming device and 
support systems; whereas part 543 is intended to set minimum standards, 
consistent with industry best practices, specific to the authorization, 
recognition, and recordation of the gaming and gaming related 
transactions. Consequently, users of the documents should be well aware 
of the definition section accompanying each rule.
    Comment: Any defined terms not used in the final version text 
should be deleted.
    Response: Except for Tier A and Tier B, we agree. Terms defined in 
Section 543.2 that are not utilized in this regulation have been 
deleted. The definition of Tier A and Tier B is necessary to an 
understanding of the applicability of certain subsections contained 
within section 543.7.
    Comment: Statutorily defined terms like ``Commission'' do not need 
to be included in a section of specific terms.
    Response: We disagree. The inclusion of the term ``Commission'' 
helps distinguish the federal commission from the tribal gaming 
commissions. Additionally, we do not see how the inclusion of this 
definition harms tribes or causes confusion in anyway.
    Comment: Since the term ``agreed-upon procedures'' is used many 
times in part 543, consideration should be given to defining the term. 
By defining the term, it would be possible to clarify that the CPA's 
client could be any or all of the tribal government, the tribal gaming 
regulatory authority or the gaming operation. This definition is 
consistent with applicable provisions of the Statements on Standards 
for Attestation Engagements issued by the Auditing Standards Board.
    Response: The Commission believes the current language is effective 
in defining the scope of the engagement.
    Comment: Since the term ``CPA'' is used frequently in part 543, 
consideration should be given to defining the term and making it clear 
in the definition that the term refers to either individuals or firms, 
as the case may be.
    Response: We disagree. Each state has a oversight body, generally 
referred to as a State Board of Accountancy, that is responsible for 
adopting regulations to carry out the laws governing the practice of 
public accountancy in that jurisdiction. It makes final licensing 
decisions and takes disciplinary actions against people who violate the 
licensing laws. Although much similarity exists from one state to 
another regarding the qualifications and licensing requirements of a 
Certified Public Accountant, to obtain an exact definition of the term 
within a particular state, the referenced oversight body should be 
consulted.
    Comment: Since the term ``internal control systems'' is used 
frequently in part 543, consideration should be given to defining the 
term and making it clear in the definition that internal control 
systems (i) include ``policies'' and ``procedures,'' as well as 
``systems.''
    Response: We disagree. The Institute of Internal Auditors defines 
internal controls as follows: The process effected by an entity's board 
of directors, management, and other personnel designed to provide 
reasonable assurance regarding the achievement of objectives in the 
following categories: (1) Operational controls--relating to the 
effective and efficient use of the entity's resources; (2) Financial 
reporting controls--relating to the preparation of reliable published 
financial statements; and (3) Compliance controls--relating to the 
entity's compliance with applicable laws and regulations.
    Within the context of the MICS, it is important to recognize that 
the regulation is not intended to define a comprehensive system of 
internal controls for a gaming enterprise. The objective is to identify 
a basic set of controls that the federal authority has determined to be 
necessary to satisfy its obligation as stipulated in Section 2702 of 
the Declaration of Policy of the IGRA. Conceptually, a similar 
motivation drives the tribal gaming regulatory authority in the 
creation of its minimum internal control standards, except that the 
scope may be broader and include all areas of the organization. 
However, even with the anticipated more expansive version of minimum 
internal controls codified by the tribal regulatory authority, such 
controls would generally be inadequate to define a gaming operation's 
breadth of policies and procedures in which issues such as efficiency 
and customer service are captured. Furthermore, it is the gaming 
operation's policies and procedures that frequently clarify how the 
property intends to comply with a regulatory requirement.
    Comment: Since the last three sentences of the definition of 
``internal audit'' are substantive provisions and readers who review 
section 543.3(f) may not realize that related substantive provisions 
have been organized in the definitions section, consideration should be 
given to relocating the last three sentences of the definition to an 
appropriate location in section 543.7(f).
    Response: The definition of internal audit and internal auditor has 
been revised to clarify the role of the internal auditor.
    Comment: The phrase ``or other component'' should be deleted from 
the definition of ``kiosk'' because kiosks are stand alone systems that 
are not ``components'' of anything or, if the phrase is retained, 
clarifying of what system a kiosk is a component.
    Response: We disagree. The kiosk is normally at the very least a 
component of an accounting system. Retention of the phrase confers 
flexibility for application of future technological advances.
    Comment: The term MICS should be defined and clarified so that it 
does not mean any variance to such a standard or a more stringent 
standard that may be established by a tribal internal control standard.
    Response: We disagree. The MICS is defined by part 543 in its 
entirety. Section 543.3 is intended to communicate that an alternative 
procedure to that contained in the federal rule is acceptable as long 
as it does not conflict with the rule it is intended to replace. 
Essentially, the Commission recognizes that a procedure, although 
different, could satisfy all elements of a part 543

[[Page 60497]]

standard. Furthermore, it is entirely permissible for the tribal gaming 
regulatory authority to require a control that is more stringent than 
that in the MICS.
    Comment: The term ``CPA NIGC MICS Compliance Checklist'' should be 
shortened to ``NIGC Checklist.''
    Response: We disagree. The NIGC provides various documents to 
assist tribal gaming regulators, operators and practitioners. Some are 
in the form of checklists; therefore, the title of this item is 
intended to differentiate it from others.
    Comment: The definition of the term ``PIN'' contained in 
543.7(g)(1)(iv) should be moved to the definition section.
    Response: The Commission agrees. The definition has been moved from 
543.7(g)(1)(iv) to 543.2.
    Comment: None of the sections of part 543 are based on tiers and 
all tiers must comply with all provisions of the current part 543. 
Therefore, the definitions of Tier A, B, and C should be deleted.
    Response: We disagree. The first phase of the task of developing a 
comprehensive set of minimum internal controls for Class II gaming does 
not contain the drop and count, internal audit and surveillance 
sections that have different applications based on Tier classification; 
however, the next phase of the rule making will include these 
standards. Therefore, it is worthwhile to leave the Tier definition in 
the rule. Additionally, the definition of Tier A and Tier B is 
necessary to an understanding of the applicability of subsection 
543.7(i)(3)(X), which is relevant to only Tier C.
    Comment: The term ``tribal internal control standards'' should be 
defined because it is used throughout part 543 but it is not defined.
    Response: Part 543 in its entirety establishes minimum internal 
controls for tribal operations. Attempting to further define the 
tribes' specific internal controls would be difficult since tribes vary 
in the method by which they implement the phrase. For example, some 
tribal gaming regulatory authorities have formal due process procedures 
whereby their minimum internal control standards are adopted as 
governmental regulations; others require a council resolution to create 
the rule; and some merely approve the internal control systems 
submitted to the gaming operation. The position of the NIGC is that the 
agency should not dictate to the tribe the methodology by which the 
tribe creates its rules governing the conduct of gaming on its lands; 
only that the rule must equal or exceed the level of control 
established by the federal regulation.

Comments Regarding Section 543.3

    Comment: The heading to this section should be changed to 
substitute the term ``tribal government'' for the term ``I.''
    Response: We agree. The term has been changed.
    Comment: The terms ``ensure'' and ``implement'' should be deleted 
so that it is left to the discretion of the tribal government to 
determine whether, when, and how to enforce the tribal minimum internal 
standards which have been adopted.
    Response: The Commission disagrees. The federal regulation is 
intended to require tribes to ensure tribal internal controls are 
established and implemented that accomplish three objectives: (1) 
Provide a level of control that equals or exceeds those set forth in 
part 543; (2) establish standards to detect and deter unlawful 
activity; and (3) set a deadline, as specified in the above referenced 
section, for the gaming operation to come into compliance with the 
tribal internal controls. Although the Commission recognizes the 
tribes' primary oversight role, the federal rules objective is to set a 
minimum threshold applicable to all tribal gaming; consequently, 
failure to comply would result in an ineffective regulation.
    Comment: It should be made clear that variances are allowed under 
this part. It should not simply incorporate by reference the provisions 
in 542.18.
    Response: The Commission will consider specifically setting out the 
variance section as well as all other sections that are presently 
incorporated by reference in its next revision of the MICS.
    Comment: Section 543.3(c) requires that tribal internal control 
standards comply with 31 CFR part 103. Authority for the implementation 
and enforcement of 31 CFR part 103 rests with the Department of 
Treasury. We believe it is beyond the Commissions authority to require 
compliance with other agencies' regulations.
    Response: We agree. This provision has been changed to require that 
the tribal gaming regulatory authority develop standards for 
identifying and reporting possible illegal activity. A program similar 
to that required by 31 CFR part 103 would satisfy this requirement.
    Comment: It should be made clear that the regulations impose 
requirements on the tribal gaming regulatory authority not directly on 
the gaming operation.
    Response: The regulation requires the tribal gaming regulatory 
authority to establish and implement tribal internal control standards 
that provide a level of control that equals or exceeds those set forth 
in this part and establish a deadline consistent with the timelines 
within this section for its gaming operation(s) to comply with the 
tribal internal controls. Consequently, the application of the federal 
rule to the gaming enterprise is through the tribal gaming regulatory 
authority.
    Comment: There should be a time gap between the date the tribal 
gaming regulatory authority establishes the new tribal internal control 
standards and the date the gaming operation must comply with those 
standards. Under this approach, the date the gaming operation would be 
required to comply with the new tics would be pegged to the date those 
standards are adopted and the date would apply to both existing and new 
operations.
    Response: The rule does identify specific timelines. From the date 
the rule is published in the Federal Register, the tribal gaming 
regulatory authority has six months to develop or revise its tribal 
internal control standards to comply with this Part and, upon 
implementation the regulatory authority shall establish a timeframe for 
its respective gaming operation(s) to come into compliance. 
Furthermore, at the discretion of the tribe, the period for the gaming 
operation(s) to come into compliance may be extended an additional six 
months. A gaming property that is opened after the date this rule is 
published in the Federal Register must be compliant upon opening.
    Comment: In order to add flexibility, the requirement that the 
report be issued to the tribe, the tribal gaming regulatory authority, 
and the manager should be changed to only mandate that the report 
should be issued to whoever engages the CPA and anyone else that entity 
designates.
    Response: We agree. The Commission concurs and has modified the 
regulation accordingly.
    Comment: The responsibility for submitting the report should be 
placed on the tribal gaming regulatory authority not the tribe.
    Response: We disagree. Since the tribe is ultimately responsible 
and since the tribal gaming regulatory authority is a component of 
tribal government, the distinction is not necessary.
    Comment: The term ``fiscal year'' is more precise than the term 
``business year.''
    Response: We disagree. Fiscal year is generally defined as the 
twelve consecutive months used by a business entity to account for and 
report on its

[[Page 60498]]

business operations. Business year is generally defined as the fiscal 
year based on the cycle of the given business rather than a calendar 
year. Although the terms are essentially synonymous, as used in the 
subject regulation, the Commission believes ``business year'' is more 
appropriate.
    Comment: The checklist or internal testing procedure is done by the 
internal auditor so it is redundant to require the CPA to do it.
    Response: We disagree. The checklist is relevant to the CPA, unless 
the practitioner determines that, and in accordance with relevant 
professional standards for attestation engagements, reliance can be 
placed on the work of the internal auditor. The extent of that reliance 
would determine the scope of checklists that the internal auditor might 
perform.

Comments Regarding Section 543.7

    Comment: The term ``critical proprietary software'' in 543.7 is not 
defined. The Commission should consider changing the term to ``game 
software.''
    Response: We agree. The Commission concurs with the comment and has 
modified the regulation accordingly, see 543.7(e)(2).
    Comment: It is not clear what entity is responsible for verifying 
game software.
    Response: The regulation anticipates that the tribal gaming 
regulatory authority will adopt a rule requiring personnel independent 
of the bingo department to test the signature of the game to ensure it 
is consistent with that previously approved. However, in practice, the 
Commission is aware that frequently the tribal regulator will assume 
responsibility for this task, which is common to the gaming industry.
    Comment: The Commission should clarify what procedure the tribal 
gaming regulatory authority should use to verify authenticity and 
consider if this is feasible for a tribal gaming regulatory authority.
    Response: We disagree. The detailed procedures necessary to confirm 
the authenticity of a game program may vary. This is consistent with 
section 547.8(f) of the technical standards.

Comments on Section 543.16

    Comment: Section 543.16(e) appears to be a technical standard 
instead of an internal control.
    Response: We disagree. The standard pertains to procedural 
requirements specific to the review of computer access records and 
unsuccessful log on attempts.
    Comment: In Section 543.16(f) it is unclear to what the term 
``version number'' refers.
    Response: We disagree. In the noted standard, the term refers to 
software applications; therefore, we believe the meaning to be evident.

Comments Regarding Alternative Procedures

    Comment: One commenter suggested that time and money could be saved 
by allowing alternative procedures in the MICS.
    Response: We disagree. Essentially the regulations do allow for 
alternative procedures by allowing for variances.
    Comment: The Commission should allow self-regulated tribes to 
approve alternative procedures to those in the Class II MICS.
    Response: The MICS are common in established gaming jurisdictions 
and, to be effective in establishing a minimum baseline for the 
internal operating procedures of tribal gaming enterprises, the rule 
must be concise, explicit, and uniform for all tribal gaming operations 
to which they apply. Furthermore, to nurture and promote public 
confidence in the integrity and regulation of Indian gaming and ensure 
its adequate regulation to protect tribal gaming assets and the 
interests of tribal stakeholders and the public, the Commission's MICS 
regulations must be reasonably uniform in their implementation and 
application and regularly monitored and enforced by tribal regulators 
and the NIGC to ensure tribal compliance. Regardless, self-regulated 
tribes may adopt variances.

Comments Regarding Application of MICS to Small and Charitable Gaming 
Operations

    Comment: Several comments stated that the threshold for applying 
the MICS to small or charitable gaming is too low. Raising the 
threshold to $3 million dollars would not eliminate the requirement for 
internal controls since small and charitable operations must operate 
under appropriate standards, however it would save in regulatory 
expenditures allowing tribal governments to retain more gaming dollars 
for governmental services and infrastructure.
    Response: The Commission agrees to some extent and therefore has 
raised the threshold to $2 million. We note that the threshold 
contained in the Class II technical standards will remain at $1 million 
as proposed because the cost of compliance will be a one-time cost.

Comments Regarding MICS References to Classification and Technical 
Standards

    Comment: Several comments stated that the MICS should not reference 
proposed classification standards or proposed technical standards.
    Response: The Commission agrees. Because the classification 
standards are being withdrawn simultaneously with the publishing of 
these regulations, all references to classification standards have been 
removed. The MICS did not include any references to the technical 
standards.

Comments on Game Classification

    Comment: One commenter stated that part 543 assumes that the bingo 
games will be similar to slot machines and such provisions are improper 
because Class II games cannot include ``slot machines of any kind.''
    Response: These regulations are not intended to be used to classify 
machines as either Class II or Class III. It is possible for Class III 
games to be compliant with these MICS. Therefore, compliance with these 
MICS is not an indicator or evidence that a game is Class II.

List of Subjects in 25 CFR Parts 542 and 543

    Accounting, Auditing, Gambling, Incorporation by reference, 
Indian--lands, Indian--tribal government, Reporting and recordkeeping 
requirements.


0
Accordingly, for the reasons described in the preamble, the Commission 
amends its regulations at 25 CFR chapter III as follows:

PART 542--MINIMUM INTERNAL CONTROL STANDARDS

0
1. The authority citation for part 542 continues to read as follows:

     Authority: 25 U.S.C. 2702(c), 2706(b)(10).


Sec.  542.7  [Removed and Reserved]

0
2. Section 542.7 is removed and reserved effective October 13, 2009.


Sec.  542.16  [Removed and Reserved]

0
3. Section 542.16 is removed and reserved effective October 13, 2009.

0
4. Add new part 543 to read as follows:

PART 543--MINIMUM INTERNAL CONTROL STANDARDS FOR CLASS II GAMING

Sec.
543.1 What does this part cover?
543.2 What are the definitions for this part?
543.3 How do tribal governments comply with this part?

[[Page 60499]]

543.4-543.5 [RESERVED]
543.6 Does this part apply to small and charitable gaming 
operations?
543.7 What are the minimum internal control standards for bingo?
543.8-543.15 [RESERVED]
543.16 What are the minimum internal controls for information 
technology?

     Authority: 25 U.S.C. 2701 et seq.


Sec.  543.1  What does this part cover?

    This part, along with Sec. Sec.  542.14 through 542.15, 542.17 
through 542.18, 542.20 through 542.23, 542.30 through 542.33, and 
542.40 through 542.43 of this chapter establishes the minimum internal 
control standards for the conduct of Class II bingo and other games 
similar to bingo on Indian lands as described in 25 U.S.C. 2701 et seq. 
Throughout this part the term bingo includes other games similar to 
bingo.


Sec.  543.2  What are the definitions for this part?

    The definitions in this section apply to all sections of this part 
unless otherwise noted.
    Accountability. All financial instruments, receivables, and patron 
deposits constituting the total amount for which the bankroll custodian 
is responsible at a given time.
    Actual bingo win percentage. The percentage calculated by dividing 
the bingo win by the bingo sales. Can be calculated for individual 
prize schedules or type of player interfaces on a per-day or cumulative 
basis.
    Agent. An employee or licensed person authorized by the gaming 
operation, as approved by the tribal gaming regulatory authority, 
designated for certain authorizations, decisions, tasks and actions in 
the gaming operation. This definition is not intended to eliminate nor 
suggest that appropriate management contracts are not required, where 
applicable, as referenced in 25 U.S.C. 2711.
    Amount in. The total value of all financial instruments and 
cashless transactions accepted by the Class II gaming system.
    Amount out. The total value of all financial instruments and 
cashless transactions paid by the Class II gaming system, plus the 
total value of manual payments.
    Bingo paper. A consumable physical object that has one or more 
bingo cards on its face.
    Bingo sales. The value of purchases made by players to participate 
in bingo.
    Bingo win. The result of bingo sales minus prize payouts.
    Cage. A secure work area within the gaming operation for cashiers 
which may include a storage area for the gaming operation bankroll.
    Cash equivalents. The monetary value that a gaming operation may 
assign to a document, financial instrument, or anything else of 
representative value other than cash. A cash equivalent includes, but 
is not limited to, tokens, chips, coupons, vouchers, payout slips and 
tickets, and other items to which a gaming operation has assigned an 
exchange value.
    Cashless system. A system that performs cashless transactions and 
maintains records of those cashless transactions.
    Cashless transaction. A movement of funds electronically from one 
component to another, often to or from a patron deposit account.
    Class II game. A game as described in 25 U.S.C. 2703(7)(A).
    Class II Gaming System. All components, whether or not technologic 
aids in electronic, computer, mechanical, or other technologic form, 
that function together to aid the play of one or more Class II games 
including accounting functions mandated by part 547 of this chapter.
    Commission. The National Indian Gaming Commission.
    Count. The act of counting and recording the drop and/or other 
funds.
    Count room. A secured room where the count is performed.
    Coupon. A financial instrument of fixed wagering value, usually 
paper, that can only be used to acquire non-cashable credits through 
interaction with a voucher system. This does not include instruments 
such as printed advertising material that cannot be validated directly 
by a voucher system.
    Drop. The total amount of financial instruments removed from 
financial instrument storage components in Class II gaming systems.
    Drop period. The period of time that occurs between sequential 
drops.
    Electronic funds transfer. A transfer of funds to or from a Class 
II gaming system through the use of a cashless system, which are 
transfers from an external financial institution.
    Financial instrument. Any tangible item of value tendered in Class 
II game play including but not limited to bills, coins, vouchers, and 
coupons.
    Financial instrument acceptor. Any component that accepts financial 
instruments.
    Financial instrument storage component. Any component that stores 
financial instruments.
    Game software. The operational program or programs that govern the 
play, display of results, and/or awarding of prizes or credits for 
Class II games.
    Gaming Equipment. All electronic, electro-mechanical, mechanical or 
other physical components utilized in the play of Class II games.
    Independent. The separation of functions so that the person or 
process monitoring, reviewing or authorizing the controlled 
transaction(s) is separate from the persons or process performing the 
controlled transaction(s).
    Inter-tribal prize pool. A fund to which multiple tribes contribute 
from which prizes are paid to winning players at a participating tribal 
gaming facility and which is administered by one of the participating 
tribes or a third party, (e.g. progressive prize pools, shared prize 
pools, etc.).
    Internal audit. The audit function of a gaming operation that is 
independent of the department subject to the audit. Internal audit 
activities should be conducted in a manner that permits objective 
evaluation of areas examined.
    Internal auditor. The person(s) who perform an independent audit. 
Independence is obtained through the organizational reporting 
relationship, as the internal audit department must not report to 
management of the gaming operation. Internal audit personnel may 
provide audit coverage to more than one operation within a tribe's 
gaming operation holdings.
    Kiosk. A self serve point of sale or other component capable of 
accepting or dispensing financial instruments and may also be capable 
of initiating cashless transactions of values to or from a patron 
deposit account or promotional account.
    Manual payout. The payment to a player of some or all of a player's 
accumulated credits (e.g. short pays, cancelled credits, etc.) or an 
amount owed as a result of a winning event by an agent of the gaming 
operation.
    MICS. Minimum internal control standards in this part.
    Non-cashable credit. Credits given by an operator to a patron; 
placed on a Class II gaming system through a coupon, cashless 
transaction, or other approved means; and capable of activating play 
but not being converted to cash.
    Patron deposit account. An account maintained on behalf of a 
patron, for the purpose of depositing and withdrawing cashable funds 
for the primary purpose of interacting with a gaming activity.
    Patron deposits. The funds placed with a designated cashier by 
patrons for the patrons' use at a future time.
    PIN. A personal identification number.
    Player interface. Any component(s) of a Class II gaming system, 
including an electronic or technological aid (not limited to terminals, 
player stations, handhelds, fixed units, etc.) that

[[Page 60500]]

directly enable(s) player interaction in a Class II game.
    Player tracking system. A system typically used by a gaming 
operation to record the amount of play of an individual patron.
    Prize payout. A transaction associated with a winning event.
    Prize schedule. A set of prizes available to players for achieving 
pre-designated patterns in Class II game(s).
    Progressive prize. A prize that increases by a selectable or 
predefined amount based on play of a Class II game.
    Promotional account. A file, record, or other data structure that 
records transactions involving a patron or patrons that are not 
otherwise recorded in a patron deposit account.
    Promotional prize payout. Merchandise or awards given to players by 
the gaming operation which is based on gaming activity.
    Random number generator (RNG). A software module, hardware 
component or combination of these designed to produce outputs that are 
effectively random.
    Server. A computer which controls one or more applications or 
environments.
    Shift. An eight-hour period, unless otherwise approved by the 
tribal gaming regulatory authority, not to exceed 24 hours.
    Short pay. The payment of the unpaid balance of an incomplete 
payout by a player interface.
    Tier A. Gaming operations with annual gross gaming revenues of more 
than $1 million but not more than $5 million.
    Tier B. Gaming operations with annual gross gaming revenues of more 
than $5 million but not more than $15 million.
    Tier C. Gaming operations with annual gross gaming revenues of more 
than $15 million.
    Tribal Gaming Regulatory Authority. The entity authorized by tribal 
law to regulate gaming conducted pursuant to the Indian Gaming 
Regulatory Act.
    Voucher. A financial instrument of fixed value that can only be 
used to acquire an equivalent value of cashable credits or cash through 
interaction with a voucher system.
    Voucher System. A component of the Class II gaming system or an 
external system that securely maintains records of vouchers and 
coupons; validates payment of vouchers and coupons; records successful 
or failed payments of vouchers and coupons; and controls the purging of 
expired vouchers and coupons.


Sec.  543.3  How do tribal governments comply with this part?

    (a) Compliance based upon tier. [Reserved]
    (b) Determination of tier. [Reserved]
    (c) Tribal internal control standards. Within six months of October 
10, 2008, each tribal gaming regulatory authority must, in accordance 
with the tribal gaming ordinance, establish or ensure that tribal 
internal control standards are established and implemented that must:
    (1) Provide a level of control that equals or exceeds those set 
forth in this part; and
    (2) Contain standards to identify, detect and deter money 
laundering in furtherance of a criminal enterprise, terrorism, tax 
evasion or other unlawful activity. The standards should be designed to 
facilitate the keeping of records and the filing of reports with the 
appropriate federal regulatory and law enforcement authorities.
    (3) Establish a deadline, which must not exceed six months from the 
date the tribal gaming regulatory authority establishes internal 
controls by which a gaming operation must come into compliance with the 
tribal internal control standards. However, the tribal gaming 
regulatory authority may extend the deadline by an additional six 
months if written notice citing justification is provided to the 
Commission no later than two weeks before the expiration of the six 
month period.
    (d) Gaming operations. Each gaming operation must develop and 
implement an internal control system that, at a minimum, complies with 
the tribal internal control standards.
    (1) Existing gaming operations. All gaming operations that are 
operating on or before November 10, 2008, must comply with this part 
within the time requirements established in paragraph (c) of this 
section. In the interim, such operations must continue to comply with 
existing tribal internal control standards.
    (2) New gaming operations. All gaming operations that commence 
operations after April 10, 2009, must comply with this part before 
commencement of operations.
    (e) Submission to Commission. Tribal regulations promulgated 
pursuant to this part are not required to be submitted to the 
Commission pursuant to Sec. 522.3(b) of this chapter.
    (f) CPA testing. (1) An independent certified public accountant 
(CPA) must be engaged to perform ``Agreed-Upon Procedures'' to verify 
that the gaming operation is in compliance with the minimum internal 
control standards (MICS) set forth in this part or a tribally approved 
variance thereto that has received Commission concurrence. The CPA must 
report each event and procedure discovered by or brought to the CPA's 
attention that the CPA believes does not satisfy the minimum standards 
or tribally approved variance that has received Commission concurrence. 
The ``Agreed-Upon Procedures'' may be performed in conjunction with the 
annual audit. The tribe must submit two copies of the report to the 
Commission within 120 days of the gaming operation's fiscal year end. 
In performing the compliance audit, the CPA must use the Statements on 
Standards for Attestation Engagements No. 10 at Sections 101 (``Attest 
Engagements'') and 201 (``Agreed-Upon Procedures Engagements'') 
(collectively ``SSAE's''), July 12, 2007, American Institute of 
Certified Public Accountants Inc, (AICPA). SSAE No. 10 at Sections 101 
and 201 are incorporated by reference into this section with the 
approval of the Director of the Federal Register under 5 U.S.C. 552(a) 
and 1 CFR part 51. To enforce any edition other than that specified in 
this section, the Commission must publish notice of change in the 
Federal Register and the material must be available to the public. You 
may obtain a copy from the American Institute of Certified Public 
Accountants, 220 Leigh Farm Rd., Durham, NC 27707, 1-888-777-7077, at 
https://www.aicpa.org. You may inspect a copy at the National Indian 
Gaming Commission, 1441 L Street, NW., Suite 9100, Washington, DC 
20005, 202-632-7003. All approved material is available for inspection 
at the National Archives and Records Administration (NARA). For 
information on the availability of this material at NARA, call 202-741-
6030 or go to https://www.archives.gov/federal_register/code_of_
federal_regulations/ibr_locations.html. The CPA must perform the 
``Agreed-Upon Procedures'' in accordance with the following:
    (i) As a prerequisite to the evaluation of the gaming operation's 
internal control systems, it is recommended that the CPA obtain and 
review an organization chart depicting segregation of functions and 
responsi