Audit Report. State Lottery Agency. December 2002

Transcription

1 Audit Report State Lottery Agency December 2002

2 This report and any related follow-up correspondence are available to the public. Alternate formats may also be requested by contacting the Office of Legislative Audits as indicated at the bottom of the next page or through the Maryland Relay Service at Please address specific inquiries regarding this report to the Audit Manager listed on the inside back cover by telephone at (410) Electronic copies of our audit reports can be viewed or downloaded from the Internet via The Department of Legislative Services Office of the Executive Director, 90 State Circle, Annapolis, Maryland can also assist you in obtaining copies of our reports and related correspondence. The Department may be contacted by telephone at (410) or (301)

3 December 4, 2002 Senator Nathaniel J. McFadden, Co-Chair, Joint Audit Committee Delegate Samuel I. Rosenberg, Co-Chair, Joint Audit Committee Members of Joint Audit Committee Annapolis, Maryland Ladies and Gentlemen: We have audited the State Lottery Agency for the period beginning February 1, 2000 and ending January 31, Our audit disclosed that certain questionable matters pertaining to lottery operations have been referred to the Office of the Attorney General Criminal Investigations Division. In one case, the Agency estimated that instant tickets valued at $232,000 had been improperly activated over a 15-month period. Winning tickets cashed from these improperly activated tickets were estimated to be at least $112,000. This situation occurred, in part, because the Agency did not segregate certain employee duties, as recommended in our two preceding audit reports. In another case, activities of certain lottery agents related to cashing winning tickets has been referred to the Criminal Investigations Division. The Agency placed reliance on the on-line gaming contractor s operations without establishing appropriate contract and performance oversight. For example, the Agency did not obtain an annual audit of the automated gaming systems controls, independently monitor system outages, perform documented reviews of system security reports, nor routinely monitor the recording of winning lottery numbers in the gaming system. On three separate occasions, the contractor entered incorrect winning lottery numbers into the automated system that necessitated payouts aggregating $86,000 for non-winning tickets. Certain issues either were not referred as required to State officials, or were not adequately disclosed. Board of Public Works approval was not sought for contracts and modifications totaling $1.4 million. Also, the promotional (free) lottery tickets issued were not adequately controlled or properly disclosed in the Agency s annual budget requests. Furthermore, the Agency s request for legislative approval of a new lottery game did not fully disclose all pertinent information about its likely success. The game lasted only six months and the Agency estimates losses of $1.4 million.

4 Finally, our audit identified several deficiencies pertaining to the Agency s financial accounting operations. The Agency s monthly cash balance reconciliations contained unexplained adjustments, certain disbursement processing duties were not properly separated, the bank account used to pay certain lottery winnings was not properly reconciled, and detail records were no longer being maintained for annuity investments purchased by the Agency but held by custodians. The Agency also needs to improve its information system security. We determined that the Agency s accountability and compliance level was unsatisfactory, in accordance with the rating system we established in conformity with State law. The primary factors contributing to the unsatisfactory rating were the number and significance of our audit findings, especially those findings pertaining to the lack of lottery game oversight and contract administration, and the number of repeat findings. Respectfully submitted, Bruce A. Myers, CPA Legislative Auditor 2

5 Table of Contents Executive Summary 7 Background Information 11 Agency Responsibilities 11 Financial Information 11 Current Status of Findings From Preceding Audit Report 11 Findings and Recommendations 13 Instant Ticket Activations * Finding 1 Failure to Segregate Duties Resulted in Instant Tickets 13 Estimated at $232,000 Being Improperly Activated and Related Prizes of at Least $112,000 Being Cashed Agent Plus Program Finding 2 Considering the Potentially Fraudulent Activities and 16 Questionable Transactions, the Agency Should Reevaluate the Extent to Which the Program Should be Continued Lottery Game Oversight Finding 3 Procurement Transactions Totaling Approximately $ Million Were Executed Without Required Approvals From the Board of Public Works * Finding 4 The Agency Did Not Ensure That Appropriate Internal 20 Controls Were in Place Over the Automated Gaming System Finding 5 The On-Line Gaming Contractor Entered Incorrect Winning 21 Numbers in the Automated System Resulting in Approximately $86,000 in Payouts for Non-Winning Tickets Finding 6 The Value of Promotional (Free) Tickets Issued Was Not 22 Disclosed in the Agency s Annual Budget Requests and the Agency Had Not Established Adequate Accountability Over Such Tickets * Denotes item repeated in full or part from preceding audit report. 3

6 Finding 7 The Agency Did Not Fully Disclose All Relevant Concerns 24 to the Legislature in Seeking Approval for a New On-line Game That Ultimately had Estimated Losses of $1.4 Million Finding 8 The Agency s Procedures for Monitoring On-line Lottery 25 Games Were Inadequate * Finding 9 The Agency Did Not Take Appropriate Action in Response to 26 Invalid Taxpayer Identification Numbers Reported by the Internal Revenue Service Finding 10 The Agency did not Properly Disclose Lotto Prize Payments 27 in its Promotional Literature Contract Administration * Finding 11 The Agency Relied on the Contractor to Report When System 28 Outages Occurred and Certain Nonperformance Penalties Were Improperly Reduced or Reasons for Waivers Were Not Documented Finding 12 The Agency s Advertising Contract Did Not Prohibit the 30 Contractor from Awarding Subcontracts to Affiliated Entities and the Advertising Contractor Used a Subcontract With Which it Also Entered Into a Joint Business Venture * Finding 13 The Agency Did Not Adequately Monitor its Advertising 31 Contractor to Ensure That all Significant Provisions Were Adhered to Lottery Agent Oversight Finding 14 The Agency Did Not Ensure That Agents Had Established 32 Separate Bank Accounts as Required Finding 15 Lottery Agents Received Commissions That Were Not 33 Subject to the State s Intercept Program for Unpaid Debts Financial Accounting Operations * Finding 16 Internal Controls Over Purchasing and Disbursement 34 Transactions Were Inadequate * Denotes item repeated in full or part from preceding audit report. 4

7 * Finding 17 The Working Fund Was Not Properly Reconciled 34 * Finding 18 Adequate Procedures and Controls Were Not Established 35 Over the Records Related to Delinquent Amounts Due From Lottery Agents Finding 19 Unexplained Adjustments Were Made to Cash Reconciliations 36 and Adequate Control Was Not Established over Subscription Receipts Finding 20 Prize Payment Checks Were Unnecessarily Returned 37 to the Agency for Distribution and Access to These Checks Was Not Adequately Restricted Finding 21 Detail Records of Investments Held by Agency Custodians 38 Were Not Maintained and Reconciliations Were Not Reviewed by Supervisory Personnel Information System Security and Control Finding 22 Certain Network Security Was Not Adequate 40 Finding 23 System Controls Over File Access, Program Changes, 41 Passwords and User Account Were Deficient Finding 24 The Agency s Information Systems Contingency Plan 42 Was Incomplete and Outdated Audit Scope, Objectives and Methodology 43 Agency Response Appendix * Denotes item repeated in full or part from preceding audit report. 5

8 (This Page Intentionally Left Blank) 6

9 Executive Summary Legislative Audit Report on the State Lottery Agency December 2002 As a result of our audit, we determined that the Agency s accountability and compliance level was unsatisfactory, in accordance with the rating system we established in conformity with State law. Failure to segregate duties, as recommended in our two preceding audit reports, resulted in the improper activation of approximately $232,000 in instant tickets and the improper payment of related prizes of at least $112,000. This matter has been referred to the Office of the Attorney General - Criminal Investigations Division. Employees with access to the instant ticket inventory should not be able to activate instant tickets and the Agency should restrict the number of employees that can activate these tickets. The Agency should determine the extent of improperly activated tickets and ensure that any questionable transactions are identified. Potentially fraudulent activities and questionable transactions involving the Agent Plus Program have been referred to the Office of the Attorney General - Criminal Investigations Division. The Agency should determine the full extent of any improprieties related to the Program and ensure that such issues are adequately pursued. In addition, the Agency should reevaluate the extent to which the Program should be continued. Procurement transactions relating to the instant ticket games that totaled approximately $1.4 million were executed without required approval from the Board of Public Works. The Agency should obtain Board of Public Works approval as required for all future procurements of this nature. 7

10 The Agency did not ensure that adequate internal controls existed over the automated system operated by its on-line gaming contractor. For example, the Agency had not conducted a review of the computer software used to select winning Keno winners as recommended in our four preceding audit reports, and the Agency did not obtain an annual audit of the automated gaming systems controls. The Agency should conduct a review of the Keno system, obtain annual independent audits of the controls over its on-line gaming system, and ensure deficiencies noted are corrected in a timely manner. The on-line gaming contractor entered incorrect winning numbers in the automated system that resulted in payments of approximately $86,000 for nonwinning tickets. The Agency had not adequately investigated to determine if fraud was involved or if other instances had occurred. The Agency should take steps to ensure that winning numbers are correctly recorded on the system, investigate these incidents, and recover the $86,000 from the contractor. Questionable activity should be reported to the appropriate parties (such as the Office of the Attorney General). The Agency did not disclose the value of promotional (free) tickets issued in its annual budget requests nor establish adequate accountability over promotional lottery tickets issued. The Agency should include in its annual budget request the estimated value of promotional tickets to be issued and account for the purpose and disposition of all promotional tickets issued. The Agency did not fully disclose all relevant information to the Legislative Policy Committee in seeking approval for the Let It Ride game, which ultimately had estimated losses of $1.4 million before it was terminated. The Agency should fully disclose all pertinent information to the Legislative Policy Committee when requesting approval for new lottery games. The total loss from Let It Ride should be determined and reported to the Committee. 8

11 Procedures for monitoring on-line lottery games were inadequate. For example, the Agency did not perform documented reviews of daily security reports provided by the contractor and controls over lottery game drawings were deficient. The Agency should evaluate the controls for all on-line games and initiate necessary improvements to help maintain game integrity. Although required by Internal Revenue Service regulations, the Agency did not take appropriate action when invalid taxpayer identification numbers for agents and lottery winners were identified. The Agency should establish the necessary procedures to investigate invalid taxpayer identification numbers and initiate back-up tax withholding as necessary to avoid potential liabilities. The Agency relied on the contractor to report when system outages occurred and did not document or use adequate rationale for its decisions to waive certain nonperformance penalties. The Agency should independently verify the system outages reported by the contractor and adequately document its rationale for waiving penalty assessments. Internal control and record keeping deficiencies existed in the areas of Agent bank accounts, disbursement processing, working fund, accounts receivable, cash receipts, investments and information system security. The Agency should take the recommended actions to improve controls in these areas. 9

12 (This Page Intentionally Left Blank) 10

13 Agency Responsibilities Background Information The State Lottery Agency administers and operates various lottery games for the purpose of generating revenue primarily for the State's General Fund and the Maryland Stadium Authority. The State Lottery Commission, which consists of five members appointed by the Governor with the advice and consent of the State Senate, has oversight responsibility for the Agency's operations. Financial Information According to the Agency's audited financial statements for the fiscal year ended June 30, 2002, the Agency's gross revenues totaled approximately $1.31 billion of which: $733 million was deducted for prize claims; $85 million was distributed for agent commissions and claims fees; $49 million was used to pay Agency operating expenses; $27 million was transferred to the Maryland Stadium Authority in accordance with the State Government Article, Section of the Annotated Code of Maryland; $416 million (the remaining amount) was credited to the General Fund of the State. The Agency engages an independent accounting firm to perform an annual audit of its financial statements, monthly audits of special-purpose financial statements, and to provide certain technical assistance in accounting matters. In the related audit reports for the fiscal years ended June 30, 2000, 2001 and 2002, the firm stated that the Agency's financial statements presented fairly, in all material respects, its financial position, results of its operations and its cash flows for the years then ended, in conformity with generally accepted accounting principles. Current Status of Findings From Preceding Audit Report We reviewed the current status of the 14 fiscal/compliance findings from our preceding audit report dated September 15, We determined that the Agency satisfactorily addressed 6 of these findings. The remaining 8 findings are repeated in this report. In its response to our preceding audit report, the Agency generally agreed to implement the recommendations related to those findings. 11

14 (This Page Intentionally Left Blank) 12

15 Instant Ticket Activations Findings and Recommendations Background In our two preceding audit reports dating back to March 1999, we commented that the Agency s internal controls over its inventory of instant tickets (scratchoffs) were inadequate. Specifically, we commented that certain Agency warehouse employees with access to the instant tickets also had the ability to activate the tickets on the on-line gaming system. That is, these employees could record ticket book numbers on the system and cash winning tickets. We recommended that these duties be separated. In response to both of those reports, the Agency indicated that appropriate action would be taken to separate the duties. However, our review this audit disclosed that the Agency had not acted promptly to correct the audit deficiencies and to adequately safeguard the instant ticket inventory. While the vast majority of instant ticket book activations are performed by lottery agents, under certain circumstances, the Agency activates the books. Instant ticket books contain multiple tickets and generally have a retail value of $300 per book. During fiscal year 2002, the Agency s instant ticket sales totaled approximately $300 million. Based on our review of the on-line gaming contractor s records, the value of instant ticket books activated by the Agency totaled at least $1.4 million during the period from November 1997 through May Finding 1 Failure to segregate duties, as recommended in our two preceding audit reports, resulted in instant ticket books being improperly activated. The Agency estimated that $232,000 in instant ticket books were improperly activated and prizes for winning tickets of at least $112,000 were cashed. This matter has been referred to the Office of the Attorney General - Criminal Investigations Division. Based on information received by the Agency in August 2001 from a lottery agent regarding unusual patterns of instant tickets being cashed, the Agency conducted a preliminary review, which indicated that instant ticket books were being improperly activated within its warehouse. The Agency questioned a warehouse employee related to this matter, and the employee was later terminated effective August 28, We were advised that the Agency notified its legal counsel and 13

16 initially verbally advised the Office of the Attorney General Criminal Investigations Division (CID) of this matter, and that a formal referral was subsequently made to the CID on December 18, The Agency advised us that the value of tickets improperly activated was estimated to be $232,000 and that related winning tickets cashed were estimated to be at least $112,000 for the period from May 2000 to August However, our review disclosed similar transactions that occurred dating back to at least December 1997; as such, the level of ticket books improperly activated and/or improperly cashed could be higher than Agency estimates. After discussions with the Agency, we performed certain other procedures related to instant ticket data primarily for the period from January 1999 through May We identified a number of additional concerns, including certain system deficiencies as follows: The ability to activate instant ticket books was not appropriately restricted. Based on a June 30, 2001 report we received from the on-line gaming contractor, 24 Agency employees were authorized to activate instant ticket books, the majority of which had access to the instant ticket books. Of these employees, 12 had actually activated instant game books. As of August 21, 2002, the Agency had not fully investigated the propriety of all activations made by these employees. Although the gaming contractor could generate reports that identified who was authorized to activate books, the Agency did not periodically request this information. Agency senior management advised us that only the warehouse supervisor should have been activating books at this time. While the on-line gaming contractor was responsible for processing forms submitted by the Agency that granted employees the capability to activate ticket books, the Agency had not supplied the contractor with the names of supervisory employees who could authorize these system activation capabilities. A former warehouse supervisor was terminated on May 4, 2001, but the individual s user-id and related password were not immediately deactivated. Consequently, we found that this user-id and password was used to activate 481 instant ticket books valued at approximately $144,000 after the supervisor s last day of work. Although Agency senior management advised us that employees of the online gaming contractor should not be granted the capability to activate instant ticket books, our review disclosed that five of the contractor s employees had such ability as of June 30, In fact, according to the 14

17 gaming contractor s records, one of these employees had activated 81 instant ticket books valued at approximately $24,000. A number of instant ticket books were activated on other than regular business days (such as weekends). For example, one Agency employee had activated 69 instant ticket books on weekends. According to Agency senior management, such activity should be minimal. Periodic physical inventories were not conducted by the Agency to account for all instant ticket books. A similar comment was made in our preceding audit report. Furthermore, the destruction of instant ticket books (such as, due to game expiration) at the warehouse was not observed by two employees and properly documented as required by Agency procedures. The information developed during our review was provided to the Office of the Attorney General CID. The Agency has taken certain corrective actions to improve procedures over instant ticket books since the misappropriation was identified. For example, the Agency advised that the number of employees with the ability to activate instant ticket books was reduced to two employees who do not have access to the instant ticket inventory. Nevertheless, additional actions are still necessary. Recommendation 1 We again recommend that employees with access to the instant ticket book inventory not have the capability to activate instant ticket books. In addition, we recommend that the Agency restrict the number of employees that can activate these books to only those required based on their job function and monitor this process (such as, obtain periodic reports from the gaming contractor). We also recommend that the Agency provide the contractor with a list of supervisory employees that can authorize activation capabilities. Moreover, we recommend that, in the future, the Agency deactivate user-ids on a timely basis when employees leave Agency service. We further recommend that the Agency determine the extent of improperly activated ticket books and ensure that any questionable transactions are fully identified and referred to the Office of the Attorney General Criminal Investigations Division. Additionally, we again recommend that the Agency ensure that periodic inventories of instant ticket books are conducted, properly reconciled with the related records and documented. Finally, we recommend that the destruction of instant ticket books be witnessed by two employees and documented. 15

18 Agent Plus Program Background In conjunction with a law that increased the amount of winnings that could be paid by a lottery agent, the Agency initiated the Agent Plus Program in July Under this Program, designated lottery agents are authorized to cash individual winning lottery tickets in amounts up to $5,000, instead of the $600 limitation established for other lottery agents. This designation is significant because the Agency pays the agent a commission of 3 percent of the ticket value for each winning ticket cashed. In accordance with Internal Revenue Service (IRS) requirements, for gambling winnings of more than $600, agents are responsible for obtaining relevant income tax information (such as name, address and social security number) from the winners and forwarding this information to the Agency for subsequent reporting to the IRS. As of August 1, 2002, the Agency had authorized 194 Agent Plus retailers throughout the State. During calendar year 2001, Agent Plus retailers cashed winning tickets totaling approximately $54 million and received commissions of approximately $1.6 million, according to Agency records. Based on information received by the Agency, an investigation was initiated by the Agency s Counsel into potentially fraudulent activities and questionable transactions identified under the Agent Plus program. This matter was subsequently referred to the Office of the Attorney General - Criminal Investigations Division. Finding 2 Considering the potentially fraudulent activities and questionable transactions, the Agency should reevaluate the extent to which the Agent Plus Program should be continued. Analysis Based on information obtained during our audit, several major concerns were identified, including the following: Certain individuals with large lottery winnings who attempted to cash their tickets at Agency headquarters were apparently directed by certain Agency claims personnel (using a lottery agent s business card) to instead cash their tickets at a specified Agent Plus location. This resulted in commissions being paid to the agent that would not have been paid if the tickets were cashed at the Agency, ultimately reducing general fund revenues. During 16

19 calendar year 2000, this agent received commissions (from ticket sales and tickets cashed at its three locations) totaling approximately $413,000. Substantial documentation was available to indicate that certain Agent Plus retailers had avoided income tax reporting requirements. Under one scenario, agents could have a winner agree to receive less than face value of the actual winning ticket and then submit the claim to the Agency under an invalid social security number for the full face value of the ticket, taking the difference as profit. For example, Agency records reflect that four taxpayer identification numbers were each used to cash between 108 and 182 winning tickets (each ticket valued between $601 and $5,000) over approximately a three and a half-year period ending June (We also commented in Finding 9 that the Internal Revenue Service levied penalties against the Agency due to the failure to submit valid taxpayer identification numbers). Lottery winners receiving more that $600 are required to provide sensitive information, such as social security numbers, to Agent Plus retailers for subsequent submission to the Agency and taxing authorities. This results in individuals outside the Agency (such as store clerks) having access to sensitive personal information which could result in the misuse of this information (such as identity fraud) by agents or their employees. We also noted that while the Agency had a process for approving Agent Plus retailers, no formal regulations, procedures or guidelines related to the operation of the Program (such as criteria for Program eligibility, procedures for verifying tax information) had been developed. Recommendation 2 We recommend that the Agency determine the full extent of any improprieties related to the Program and ensure that such issues are referred to the Office of the Attorney General Criminal Investigations Division. In view of the aforementioned issues, we also recommend that the Agency reevaluate the extent to which the Agent Plus Program should be continued. We further recommend that the results of this reevaluation be provided to the appropriate legislative oversight committees. Finally, if it is determined that the Program will be continued, we recommend that formal regulations be proposed and adopted to govern the Program. 17

20 Lottery Game Oversight Background The Agency s responsibilities for the operation of the State s lottery games require continuous oversight and marketing of lottery gaming operations as well as the development of new games for the public. To help fulfill its responsibilities, the Agency has entered into an agreement with an on-line gaming contractor. This contractor is responsible for the design, development, and implementation of games, and the daily operation and maintenance of the gaming system. The Agency initially contracted with the current contractor in December 1995, and through the exercise of options, the contract extends through July 5, Related contractual costs could total $119 million and, according to Agency records, the contractor was paid $9.8 million during fiscal year The Agency also procures instant ticket vending machines and instant tickets for numerous instant ticket games. Finding 3 Procurement transactions totaling approximately $1.4 million were executed without required approvals from the Board of Public Works. Analysis The Agency did not obtain Board of Public Works approval for several procurement transactions totaling approximately $1.4 million under two of its contracts as follows: The Agency procured instant ticket vending machines from one contractor in June and October 2001 at a cost of approximately $1 million (including associated maintenance costs) without obtaining Board approval as required. Furthermore, since these machines contained information technology equipment (computer software) the Agency should have also requested the approval of the Department of Budget and Management (DBM) prior to making this computer-related procurement. The Agency believed that these machines could be procured as commodities through the Department of General Services, which are not subject to Board approval. On two previous occasions December 17, 1997 and February 9, 2000 the Agency had submitted and received Board of Public Works approval for purchases of these types of machines. Under its contract for the printing of instant tickets, the Agency exercised an option on June 29, 2001 to purchase 50 instant ticket game dispensing units at an increased cost of $164,000 without obtaining Board approval as required. While the option in the original contract anticipated the purchase 18

21 of a certain sized unit at a cost of $3,399 each, a larger unit was actually purchased at a cost of approximately $5,000 each, thus increasing costs by approximately $80,000. In addition associated maintenance costs increased by approximately $84,000. This represents a contract modification requiring Board approval since costs increased by more than $50,000. These 50 units were provided by the Agency s printing contractor who had purchased the units from another vendor and were not subject to a competitive bid process. Consequently, there was a lack of assurance the State received the lowest possible price for these units. During the meeting in which the original contract was approved, a member of the Board of Public Works expressed concern that the option allowed the Agency to purchase up to 600 instant ticket game dispensing units for approximately $2 million without a competitive bid process. The Agency did not request Board of Public Works approval for at least $251,000 in contract modifications to its instant ticket printing contract as required. Specifically, the contract established printing prices for certain quantities; however, higher prices were charged and paid when printing quantities were less than the contract minimum. In this regard, four invoices totaling $251,000 were paid by the Agency between August and November 2001 that contained printing charges at a unit cost that was higher than for the contract minimum. In one of these instances, the Agency could have saved $43,000 if it had increased the number of tickets requested to meet the contract minimum. According to Agency records, payments to the instant ticket printing contractor totaled approximately $6 million during fiscal year State regulations specify the circumstances under which procurement transactions are to be submitted to the Board of Public Works for approval, including contract modifications that exceed $50,000. We confirmed with Board personnel that the aforementioned transactions should have been submitted for Board approval. Recommendation 3 We recommend that, in the future, the Agency obtain Board of Public Works approval as required, as well as Department of Budget and Management approval when warranted. We further recommend that the Agency formally advise the Board of the aforementioned transactions. 19

22 Finding 4 The Agency did not ensure that appropriate internal controls were in place over the automated gaming system operated by the contractor. Analysis The Agency did not ensure that appropriate internal controls existed over the automated gaming system operated by the on-line gaming contractor. Specifically, we noted the following: The Agency did not obtain an annual independent audit of the controls over data processing services that are provided by its on-line gaming contractor as provided for in generally accepted auditing standards established for service organizations. Although the Agency contracted with an accounting firm to perform reviews of the contractor s data processing controls, the Agency had not specified the procedures to be performed (such as a review of controls over the activation of instant tickets). The reviews performed were not as comprehensive as an audit, because the firm did not express an opinion on the system controls; determine if the controls were suitably designed to achieve the control objectives; nor determine if the controls were complied with in a satisfactory manner. Finally, the reviews were only required to be performed in the second and fourth years of the fiveyear contract. The Agency did not independently verify that the on-line gaming contractor corrected internal control deficiencies identified by the firm s reviews. Instead, the Agency relied on subsequent reviews to determine if corrective actions were implemented. In that regard, four control deficiencies identified in the firm s August 1999 report were again repeated in the firm s April 2002 report as well as other deficiencies. While the firm informed Agency management that, as of August 1, 2002, corrective actions had been taken for approximately one-fourth of the April 2002 control deficiencies, the Agency had not verified this information. A similar condition was commented upon in our two preceding audit reports. In our four preceding audit reports, we have commented that the Agency had not conducted a review to determine the propriety of the computer software used to select winning Keno game numbers. Such a review is necessary because the software is completely under the control of the contractor and is solely used to select the winning numbers for the game. In response to our previous audits, the Agency has responded that these 20

23 reviews would be made. According to the Agency s records, Keno sales totaled approximately $356 million during fiscal year Considering that the Agency relies on the contractor s systems for operating the lottery games, and in view of the potential fraud previously identified regarding the activation of instant game tickets, we believe that annual independent audits of the automated gaming system, as well as a review of the Keno software, are necessary to help maintain game integrity. Recommendation 4 We recommend that the Agency amend the contract with the firm to require that annual independent audits of the controls over its on-line gaming system be obtained as provided for in generally accepted auditing standards established for service organizations. We also recommend that the Agency require the contractor to correct internal control deficiencies in a timely manner. In addition, we again recommend that the Agency independently verify that the appropriate corrective actions have been implemented. Finally, we again recommend that the Agency ensure that periodic reviews are conducted of the Keno system to determine the propriety of the contractor s software programs that are used to select winning numbers. Finding 5 The on-line gaming contractor entered incorrect winning lottery numbers in the automated system on three occasions that resulted in payouts of $86,000 for non-winning tickets. The Agency was not routinely monitoring this process and had not adequately investigated these occurrences. Analysis The on-line gaming contractor erroneously recorded incorrect winning lottery numbers in the automated system on three separate occasions that necessitated payouts of approximately $86,000 on non-winning tickets. The Agency was not routinely monitoring the recordation process to ensure the correct numbers were being entered into the system. Rather, the Agency relied on the contractor to comply with established procedures to prevent such incidents and to report errors to the Agency should they occur. Furthermore, the Agency had not adequately investigated these three incidents to determine if fraud was involved, nor had it determined whether other incidents occurred but were not reported. Although the contract stipulated that the contractor was liable for payments made as a result of its errors, the Agency did not attempt to recover the non-winning ticket payouts. 21

24 The first incident occurred September 2, 2001 and resulted in improper payments totaling approximately $70,000. Similar instances occurred in January and February When incorrect winning numbers are entered, the Agency honors the related tickets as well as tickets with the correct winning numbers. Agency management advised us that the contractor had bypassed established procedures that were designed to prevent such incidents from occurring. Recommendation 5 We recommend that the Agency establish procedures to verify the proper recording of winning ticket numbers on the automated gaming system by the contractor. We also recommend that the Agency conduct investigations to determine whether the three incidents had occurred due to fraud, and whether other incidents have previously occurred that have not been reported. Any questionable activity should be referred to the appropriate parties (such as, the Office of the Attorney General). Finally, we recommend that the Agency recover from the contractor all incorrect payouts made as a result of contractor error, including the $86,000. Finding 6 The value of promotional (free) tickets issued was not disclosed in the Agency s annual budget requests submitted to the General Assembly. The Agency had also not established adequate accountability over promotional tickets issued. Analysis Activity related to promotional (free) tickets issued by the Agency was not disclosed to the General Assembly. In addition, the Agency did not sufficiently account for this activity. The Agency issued free tickets (instant tickets, certain on-line games and Lotto subscriptions) for promotional purposes to certain entities (for example, radio stations). Specifically, we noted the following: The Agency did not include in its annual budget submission to the General Assembly the estimated total value (cost plus prize value) of promotional tickets to be issued during the fiscal year. This is significant since prizes paid related to the promotional tickets issued represent a reduction in the available cash balance that could be transferred to the State s General Fund. Furthermore, the Agency Director advised us that there was no internal budget maintained as to how many promotional tickets would be issued each fiscal year. While our audit procedures indicated that instant tickets distributed for promotional purposes exceeded $618,000 during our 22

25 audit period, and it is estimated that related prizes paid from these tickets exceeded $400,000, the Agency was unable to provide us with the value of promotional tickets for the other lottery games. Prior to October 2001, the Agency did not maintain a centralized record to account for promotional tickets issued. Consequently, we could not readily determine the propriety of promotional tickets issued prior to that date. Furthermore, our review of the report currently maintained disclosed that it did not always reflect the purpose of the promotion (frequently indicated unknown or left blank) nor did it account for the disposition of the tickets as to used or returned. For example, the report reflects that 13,000 promotional tickets valued at $13,000 were provided to the Agency s advertising contractor on November 29, Based on a letter on file at the Agency, 685 of the tickets were returned on December 17, 2001; however, this was not recorded in the report. Although the Agency had established procedures that required a specific individual to approve the issuance of promotional instant game scratch-off tickets, we noted that other employees frequently approved the issuance of promotional tickets for instant games. In addition, while Agency management advised us that its intention was for its written procedures to cover all promotional tickets (including on-line games and Lotto subscriptions), the written procedures only specifically addressed instant games. Recommendation 6 We recommend that the Agency include in its annual budget submission the estimated value of promotional tickets to be issued during the year. We also recommend the Agency maintain a centralized record of promotional tickets issued which documents the purpose of the promotion and accounts for the disposition of the tickets. Finally, we recommend that the Agency ensure that promotional tickets for instant games are only approved for issuance by authorized individuals and that comprehensive procedures are established for promotional tickets related to all lottery games. 23

26 Finding 7 The Agency did not fully disclose all relevant concerns to the Legislative Policy Committee in seeking approval for a new lottery game (Let It Ride). The game was later terminated as a result of poor sales. The Agency estimates that the total loss from the game was $1.4 million. Analysis The Agency requested Legislative Policy Committee approval on January 11, 2001 (as required by The Joint Chairman s Report) to introduce a new on-line game (Let It Ride) without fully disclosing information that may have affected the Committee s decision to approve the game. Specifically, the Agency did not disclose to the Committee the findings from an independent study that was prepared prior to the initiation of the game, which indicated that the game was complicated and confusing and that substantial investment in educational orientation and on-going support with retailers and players was necessary. In this regard, the Agency advised the Committee that its research indicated the game had broad appeal among all types of lottery players. The Agency also projected that the new on-line game would generate approximately $1 million per week in sales in fiscal year At that time, the Department of Legislative Services expressed concern in a letter to the Committee that the sales projections were optimistic and that the game options were complex and could be intimidating. The game was initiated on April 30, 2001 and subsequently terminated six months later on October 27, 2001 because of poor sales. This game generated total sales of $2.5 million during its first six months, in comparison with Agency estimates of $22 million for a similar period. In addition, while an interim Agency accounting report for this game indicated that expenditures exceeded revenues by an estimated $1.4 million through September 2001, the actual results were unknown. Specifically, the game was not terminated until four weeks after the report was prepared and a final accounting was never prepared. Recommendation 7 We recommend that, in the future, the Agency fully disclose all pertinent information (including the findings of independent studies) to the Legislative Policy Committee when requesting approval for new lottery games. We also recommend that the Agency determine and document the total loss from the Let It Ride game and that this information be reported to the Committee. 24

27 Finding 8 The Agency did not sufficiently monitor on-line lottery games to ensure game integrity. Analysis The Agency s procedures designed to help maintain the integrity of its on-line lottery games were in some cases inadequate, or were not enforced as follows: The Agency did not perform a documented review of daily security reports provided by the on-line gaming contractor. Information on these reports indicates if the contractor is following Agency prescribed procedures and controls to ensure game integrity. For example, the report indicates if agent terminals are properly deactivated prior to game drawings so that numbers cannot be generated after the winning numbers were selected, to prevent improper pay-outs. The security reports also identify the winning numbers entered on the system by the contractor. We previously commented in this report in Finding 5 that the contractor had entered incorrect winning numbers on the system resulting in improper prize payments on several occasions. The Agency randomly selected the drawing machines that would be used for some lottery games, but not for others. For some games (Pick 3 and Pick 4) there are two drawing machines to select from, but only one machine for other games (Lotto and Cash-in Hand). According to Agency management, the purpose of randomly selecting the machines is to help ensure that the drawing machines were not altered to affect the outcome of the winning numbers. Only three pre-game test draws were performed prior to the Lotto draw of winning numbers even though Agency procedures require four pre-game test draws. Pre-game test draws are performed to help ensure that the game balls are not altered in a way that could affect the outcome. Agency procedures state that if the same number appears in each of the pre-game test draws, then the Agency is to disqualify that set of balls and select another set. We noted one instance in which the same number appeared on each of the pre-game test draws. However, the set of balls was not disqualified and the same number again appeared in the final set of winning numbers. We were unable to readily determine how often this occurred. 25

28 The Agency s Security Unit did not observe any Lotto drawings during calendar year These drawings are held twice a week. According to Agency procedures, the Unit is required to periodically monitor drawings to help maintain the integrity of Agency games. Recommendation 8 We recommend that the Agency promptly perform a complete evaluation of controls for all on-line games and that the necessary improvements be made to help ensure game integrity, including a documented review of daily security reports. Finding 9 The Agency did not take appropriate action in response to the Internal Revenue Service s report that identified invalid taxpayer identification numbers. Analysis The Agency did not adequately investigate invalid taxpayer identification numbers provided by lottery agents who received commissions and by individuals who won lottery prizes. Internal Revenue Service (IRS) regulations require that follow-up notices be sent to all payees with invalid taxpayer identification numbers, that certain invalid taxpayer identification numbers be tracked for a three-year period and, in some cases, back-up withholding be initiated (that is, withhold 31 percent of payments). A calendar year 1999 report generated by the IRS (the most recent report available at the time of our review) disclosed 87 lottery agent and 754 lottery winner taxpayer identification numbers that were invalid. The Agency did not send any follow-up notices to obtain correct taxpayer identification numbers for the lottery agents and winners with invalid numbers. Furthermore, our review disclosed that 36 of the 87 lottery agents were still active as of January 2002 and were paid commissions totaling $1.9 million for calendar years 1999 through The Agency requested and received an abatement of penalties totaling $45,000 related to calendar year 1999 that had been imposed by the IRS. The abatement was primarily based on representations that the Agency had exercised due diligence in obtaining taxpayer identification numbers. Nevertheless, the required follow-up notices were not sent. 26

29 The Agency is responsible for the preparation of IRS Forms 1099 (for lottery agents) and Forms W2-G (for lottery winners). These forms require the taxpayer identification number as a means of ensuring that lottery winnings are included on recipient tax returns. To eliminate future penalties from the IRS, the Agency should ensure that every effort is made to obtain valid taxpayer identification numbers for subsequent reporting on the appropriate IRS forms. A similar situation was commented upon in our preceding audit report. Recommendation 9 We again recommend that the Agency strictly comply with the IRS regulations. Specifically, we again recommend that the Agency investigate all invalid taxpayer identification numbers reported by the IRS and initiate backup withholding where appropriate. Finding 10 The Agency did not clearly disclose in its promotional literature how Lotto prize payments are determined for winners who select the lump-sum cash payment option. The description included in the Agency s promotional literature and on its website that explains how payouts are determined for Lotto winners who elect the lumpsum cash payment option rather than the annual annuity payments option was ambiguous and could be interpreted in two different ways. The actual payments made to the six Lotto winners who chose that option during the audit period were determined based on a third method. The literature could be interpreted to suggest that a winner s cash payment would be based on the available cash in the prize pool (that is, cash from Lotto sales). On the other hand, the promotional literature could also be interpreted to suggest that the winner would receive the cash equivalent of the annuity value of the advertised jackpot. The cash payment amount differs based on the interpretation. For the six aforementioned winners, the differences between the cash payment based on the cash in the prize pool, and the cash equivalent of the annuity jackpot, ranged from $160,595 to $934,770. The Agency s actual cash option payments to these six winners were amounts that were in between this range. According to the Agency, the payments were generally based on the advertised cash option amounts for these drawings, which considers estimated sales and other factors. In total, these payments were approximately $1 million more than if the calculations would have been based on the available cash in the prize pool and approximately $2 million less than if they 27