N.Y. Comp. Codes R. & Regs. tit. 9, § 5315.9 – Internal audit requirements.

(a) A gaming facility licensee shall establish an internal audit department, which shall be supervised by a person referred to in this section as an audit department executive. The internal audit department shall be independent, as defined by the International Standards for the Professional Practice of Internal Auditing. The audit department executive shall be responsible for, without limitation, the following:
1. (1) review and appraisal of the adequacy of internal control;
2. (2) compliance with internal control procedures;
3. (3) reporting to the commission of instances of noncompliance with the system of internal controls;
4. (4) reporting to the commission of any material weaknesses in the system of internal controls; and
5. (5) recommendation of procedures to eliminate any material weaknesses in the system of internal control.
(b) An internal audit department shall audit, at least annually, a gaming facility licensee’s compliance with laws, rules, regulations and internal controls relating to:
1. (1) the operation of table games and gaming devices;
2. (2) cage and count-room operations;
3. (3) the calculation of gross gaming revenue and taxes paid thereon;
4. (4) the operation of the gaming facility’s licensing program;
5. (5) the operation of the gaming facility’s player rewards program;
6. (6) 31 CFR part 1021; and
7. (7) other requirements as specified by the commission.
(c) All audits conducted pursuant to subdivision (b) of this section shall be conducted according to professional internal auditing standards promulgated by the Institute of Internal Auditors.
(d) Notwithstanding subdivisions (a) through (c) of this section, a gaming facility licensee may, with written approval from the commission, engage an independent certified public accountant to provide internal audit services. Such independent certified public accountant may not provide both internal audit services and audit the gaming facility licensee’s financial statements. The gaming facility licensee shall be responsible for the oversight and conduct of internal audit.
(e) The audit department executive, upon request by the commission, shall submit to the commission any report, work paper or other documents maintained by the internal audit department no later than 48 hours after such request.
(f) No later than 30 days after the start of a gaming licensee’s fiscal year, the audit department executive shall file a report with the commission summarizing all audits performed by the audit department, including findings and management responses.
(g) No later than 15 days preceding the start of the gaming facility licensee’s fiscal year, the audit department executive shall file such gaming facility’s audit plan with the commission for the upcoming year.