Sensitive Key Controls.
A primary goal that any company has, especially casinos, is safeguarding company assets. For the casino industry, this not only includes physical cash and coins, but also controlled documents, gaming and non-gaming inventories, and customer data. One component that is significant in casino operations is sensitive key controls. Key controls encompass a variety of topics including, who has access to both the casino floor areas and back office areas, where keys are maintained, key logs, key listing, key inventories, and the destruction of keys.
Since key controls impact every area and every department of the casino operations, having a strong auditing plan is a must. As with any audit, key control audits need to be done at each level of casino ops and at various frequencies.
The audit review process should include the following:
- Review of the documented internal controls, which may include the following:
- What are considered sensitive keys
- Who has access to sensitive keys
- How keys should be destroyed
- What documentation is required for key controls
- Emergency key access instructions
- Review of all key listing maintained at the key boxes that show the key number, key description, what positions are required to access to the keys, and emergency key access personnel.
- Auditing key inventories. This audit should not only include an inventory of the keys that access uncounted funds from the casino floor but also keys that control access to company inventories, controlled forms, and key boxes. All sensitive and non-sensitive keys should be accounted.
- Review of key logs, both manual and electronic
- Review of system access logs to verify who has access to which keys (electronic key box environment)
- Observation of key in and out checkout procedures
- Observations of drop and counts where key control should be at its highest ensuring keys are kept with the appropriate personnel at all times.
- Review of duplicate keys including where they are maintained and the logs that are kept.
- Review of the ordering, receiving, and destruction of keys.
- At the completion of the key inventory, a reconciliation of physical inventory records, which should be maintained showing where and how, many keys were distributed, should be conducted.
The review process can be very extensive and depending on the function of the department, the review can occur quite frequently.
Casino department management, who maintain key boxes (in a manual process), should be reviewing the key logs each shift prior to the transferring of key responsibilities to another shift and at the end of the day prior to them being sent to compliance/income control. This independent review should ensure the logs are properly completed and all sensitive keys are properly accounted for prior to submission to compliance/income control. In an electronic key box environment, the key logs should be generated daily and reviewed by income control/compliance.
Property compliance/internal control should be reviewing key logs daily to ensure all sensitive keys were checked in and checked out within the same gaming day and the appropriate personnel is involved in the checking in/out process. Property compliance should be conducting quarterly inventories of all sensitive and non-sensitive keys.
