Wyo. Code R. 038-0002-7
Online Sports Wagering
Chapter 7: Audit and Internal Controls
Effective Date: 10/05/2021 to Current
Rule Type: Current Rules & Regulations
Reference Number: 038.0002.7.10052021
Section 1. Internal Control Standards Purpose. The procedures of the internal control standards are designed to ensure all of the following:
(a) Unless otherwise provided for by the Commission, before beginning online sports wagering operations, a sports wagering operator, a sports wagering vendor, or both, must submit its administrative and accounting procedures, in detail, in a written system of internal controls for Commission review and written approval. A written system of internal controls must include a detailed narrative description of the administrative and accounting procedures designed to satisfy the requirements of these rules.
(b) The written system of internal controls must address the following items, at a minimum: (i) Automated and manual risk management procedures; (ii) Employee management, including access controls and segregation of duties; (iii) Information regarding identifying and reporting fraud and suspicious conduct; (iv) Controls ensuring regulatory compliance; (v) Description of Anti-Money Laundering (AML) compliance standards including procedures for detecting structuring to avoid reporting requirements; (vi) Description of all software applications that comprise the sports wagering system; (vii) Description of all types of wagers available to be offered by the sports wagering operator or sports wagering vendor; (viii) Description of the method to prevent past-post wagers from being placed; (ix) Description of all integrated third-party platforms; and (x) Any other information which may be required by the regulatory body through the issuance of Commission Directives.
(c) To the extent a third-party is involved in or provides any of the internal controls required in these rules, the sports wagering operator's or sports wagering vendor's controls, or the controls of both of them must document the roles and responsibilities of the third-party and must include procedures to evaluate the adequacy of and monitor compliance with the third-party's internal control procedures.
Section 3. Amendments to Internal Controls. Unless otherwise provided by the Commission, all of the following provisions apply to amendments to the internal control procedures:
(a) Amendments to any portion of the internal control procedures must be submitted to the Commission for approval. If within thirty (30) days the Commission has not approved, denied, or otherwise provided written notice, a sports wagering operator or sports wagering vendor, or both, may implement the amended internal controls as submitted with the Commission retaining its authority to require further amendment, approval, or denial;
(b) The Commission may, in writing, approve, deny, or require a revision to the amendment to the internal control procedures. If the sports wagering operator or sports wagering vendor is notified of a required revision, the sports wagering operator or sports wagering vendor must work with the Commission to address the revision;
(c) If the Commission requests additional information, clarification, or revision of an amendment to an internal control and the sports wagering operator or sports wagering vendor, or both, fail to satisfy the request within thirty (30) days after the Commission request, the Commission shall consider the amendment denied and it cannot be implemented or, if previously implemented under subsection (a) of this section, the sports wagering operator or sports wagering vendor has fifteen (15) days to cease implementation of that amendment. If the sports wagering operator or sports wagering vendor subsequently wants to pursue the amendment, it must resubmit the request along with the additional information previously requested by the Commission.
(a) In the event of an emergency, the sports wagering operator or sports wagering vendor, or both, may temporarily amend an internal control procedure. The director or his or her designee must be notified that an emergency exists before temporarily amending an internal control procedure.
(b) A sports wagering operator or sports wagering vendor, or both, must submit the temporary emergency amendment of the internal control procedures to the director or his or her designee within twenty-four (24) hours of the amendment. The submission must include the detailed emergency procedures that will be implemented and the time period the emergency procedures will be temporarily in place. Any concerns the Commission has with the submission must be addressed with the sports wagering operator or sports wagering vendor, or both.
Section 5. Failure to Comply with Requirements. If the Commission determines that the administrative or accounting procedures or written internal control procedures of the sports wagering operator or sports wagering vendor, or both, do not comply with the requirements of these rules or requires improvement, the Commission shall notify the sports wagering operator or sports wagering vendor, or both, in writing. Within fifteen (15) days after receiving the notification, the sports wagering operator or sports wagering vendor must amend its procedures and written internal control procedures accordingly and must submit, for Commission approval, a copy of the written internal control procedures, as amended, and a description of any other remedial measure taken.
(a) Sports wagering operators and sports wagering vendors must comply with all internal controls.
(b) If a sports wagering operator or sports wagering vendor fails to comply with any provision of its internal controls, the Commission may initiate a disciplinary action.
(a) Sports wagering operators shall have their internal control procedures independently audited at least once every two (2) years with the results documented in a written report. This includes internal control procedures conducted by a sports wagering vendor on behalf of the sports wagering operator. Reports shall be maintained and available to the Commission.
(b) Such independent audits may be conducted by the Commission, or a Commission approved third-party auditor. The Commission may, in its discretion, allow for an internal audit department within the sports wagering operator or parent company of the sports wagering operator, which is independent of the sports wagering operation, to serve as a third-party auditor for use in completing this audit.
(c) The Commission, or third-party auditor shall be responsible for auditing the sports wagering operator's compliance with the statute and these rules, including those standards adopted in appendix A of GLI-33, the internal control system, and any other applicable rules and regulations.
(d) Documentation, including checklist, programs, reports, corrective actions, and other items, shall be prepared to evidence all independent audit work performed as it relates to the requirements of this section, including all instances of noncompliance.
(e) Independent audit reports shall include objectives, procedures and scope, findings and conclusions, and recommendations.
(f) Independent audit findings shall be reported to management. Management shall be required to respond to the independent audit findings and the stated corrective measures to be taken to avoid recurrence of the audit exception. Such management responses shall be included in the final independent audit report.
(g) Follow-up observation and examinations shall be performed to verify that corrective action has been taken regarding all instances of noncompliance cited by the independent audits, or by the Commission. The verification shall be performed within six (6) months following the date of notification.
(h) Where approved by the Commission, it is acceptable to leverage the results of prior audits conducted within the audit period by the same third-party auditor in another sports wagering jurisdiction. Such leveraging shall be noted in the audit report. This leveraging does not include any internal control procedures unique to the state, which will require new audits.
(a) Sports wagering operators and sports wagering vendors must maintain complete, accurate, and legible records of all transactions related to their online sports wagering operations, including transactions pertaining to revenues, expenses, assets, liabilities, and equity in conformance with generally accepted accounting principles.
(b) The Commission may direct sports wagering operators and sports wagering vendors to alter the manner in which the records are maintained if a sports wagering operator's or sports wagering vendor's records are not in accordance with generally accepted accounting principles or if the records are not in sufficient detail.
(c) The accounting records must be maintained using a double entry system of accounting with transactions recorded on the accrual basis and supported by detailed subsidiary records.
(d) The detailed subsidiary records must include, at a minimum, all of the following:
(i) Detailed general ledger accounts identifying all revenue, expenses, assets, liabilities, and equity;
(ii) A record of all investments, advances, loans, and accounts receivable balances due the establishment;
(iii) A record of all loans and other accounts payable;
(iv) A record of all accounts receivable written off as uncollectible;
(v) Journal entries prepared;
(vi) Tax work papers used in preparation of any state or federal tax return if applicable;
(vii) Records supporting the accumulation of the costs for complimentary services and items. A complimentary service or item provided to individuals in the normal course of a sports wagering business must be recorded in an amount based upon the full retail price normally charged for the service or item or as is otherwise consistent with generally accepted accounting principles;
(viii) Records required by the internal control system; and
(ix) Other records that the Commission requires to be maintained.
(e) The sports wagering operator and sports wagering vendor must maintain all records supporting the online sports wagering revenue.
(f) If a sports wagering operator or sports wagering vendor, or both, fails to maintain the records used by it to calculate the online sports wagering revenue, the Commission may compute and determine the amount upon the basis of an audit conducted by the Commission using available information.
(a) Upon application for a permit, and annually thereafter, each sports wagering operator shall submit to the Commission, within ninety (90) days of the operator's fiscal year end, its most recent financial audit.
(b) The financial audit must be performed by an independent certified public accountant currently authorized to practice in Wyoming and presented in accordance with generally accepted accounting principles and contain the opinion of the independent certified public accountant as to its fair preparation and presentation in accordance with generally accepted accounting principles.
(c) The Commission shall determine the date of filing and the number of copies of audits or reports required under this rule. The audits or reports must be received by the Commission or postmarked no later than the required filing date.
(d) The reporting year-end of the sports wagering operator is December 31 unless otherwise approved by the Commission.
Section 10. Commission Access to System Data. Sports wagering operators and sports wagering vendors must detail the controls that are in place to assure that all data the Commission requires to be maintained under the statutes or these rules is appropriately segregated and controlled to prevent unauthorized access. Sports wagering operators and sports wagering vendors must provide the Commission with access to all such data, upon request, within a time provided for by the Commission. A sports wagering operator or sports wagering vendor must retain such data for a minimum of five (5) years.
(a) Each sports wagering operator or sports wagering vendor must maintain, in a place secure from theft, loss, or destruction, adequate records of its business and accounting operations.
(b) A sports wagering operator or sports wagering vendor must make the records available to the Commission, upon request, within a time provided for by the Commission. A sports wagering operator or sports wagering vendor must hold the records for not less than five (5) years. The records must include, but not be limited to, all of the following:
(i) All correspondence with, or reports to, the Commission or any local, state, or federal governmental agency; and (ii) All correspondence concerning the business of a sports wagering operator or sports wagering vendor.
(c) A sports wagering operator or sports wagering vendor must keep and maintain, in a manner and form required by the Commission, accurate, complete, and legible records of any books, records, or documents pertaining to, prepared in, or generated by, the sports wagering operator or sports wagering vendor, including but not limited to, all of the following:
(d) A sports wagering operator or sports wagering vendor must organize and index all required records in a manner that enables the Commission to locate, inspect, review, and analyze the records with reasonable ease and efficiency.
Section 12. Reports of Online Sports Wagering Operations. The sports wagering operator or sports wagering vendor must be able to prepare reports supporting online sports wagering revenue, wagering liability, winnings, and any other reports considered necessary by the Commission or as required by the internal controls. The reporting must be done on a form and in the manner prescribed by the Commission. Additional reporting requirements may be specified by the Commission through the issuance of Commission Directives. Any information provided under this section is confidential and proprietary and is exempt from disclosure.