1. A. A facility operator shall develop a written description of its administrative and accounting procedures including the system of internal controls over instant bingo operations.
2. B. A facility operator’s internal controls are subject to review and approval under this regulation.

3. C. Internal controls shall, at a minimum, include:

   1. (1) Administrative controls and record keeping that document the authorization of transactions;

   2. (2) Accounting controls that provide reasonable assurance that:

      1. (a) Transactions or financial events which occur in connection with instant bingo operations are:

         1. (i) Executed in accordance with the facility operator’s authorization protocols;
         2. (ii) Recorded to permit preparation of financial statements in conformance with generally accepted accounting principles in the United States and the requirements of this chapter; and
         3. (iii) Recorded to permit proper and timely reporting and calculation of proceeds and to maintain accountability for assets;
      2. (b) Access to assets is permitted only in accordance with the facility operator’s authorization protocols; and
      3. (c) The recorded accountability for assets is compared with existing assets at reasonable intervals and appropriate action is taken with regard to a discrepancy;

   3. (3) Procedures and controls for ensuring:

      1. (a) That an instant bingo machine accurately and timely communicates all required activities and financial details to the instant bingo validation and accounting system;
      2. (b) That all functions, duties and responsibilities are segregated and performed in accordance with sound financial practices by qualified personnel; and
      3. (c) Through the use of a surveillance and a security department, that the facility is secure at all times during normal operation and during any emergency due to malfunctioning equipment, loss of power, natural disaster or any other cause;

   4. (4) Access controls which address, at a minimum:

      1. (a) Content of, and administrative responsibility over, the manual or computerized access control matrix governing employee access to restricted areas;
      2. (b) Issuance of a temporary access credential; and
      3. (c) Comprehensive key controls;
   5. (5) A record retention policy;
   6. (6) Procedures and controls over the movement of cash and the count room;
   7. (7) Procedures and standards for conducting internal audits; and
   8. (8) Other procedures and controls the Commission may require to be included in a facility operator’s internal controls.
4. D. A facility operator shall maintain, in hard copy or electronic form, all superseded internal controls for at least five years subsequent to the date the internal controls were superseded.

Authority: Criminal Law Article, §§ 12-301. 1 and 12-308; State Government Article, §9-110; Annotated Code of Maryland

Effective date:

Regulations .01— .19 adopted as an emergency provision effective August 26, 2013 (40:20 Md. R. 1650); adopted permanently effective December 12, 2013 (40:24 Md. R. 2019)

Regulation .06A amended effective October 22, 2018 (45:21 Md. R. 976)

Regulation .14B amended effective May 25, 2026 (53:10 Md. R. 459)