Office of the Legislative Auditor - Financial Audit Division

Minnesota State Lottery
Internal Controls, Compliance, and Information Technology Audit

 

Financial Audit Division Report 16-16

Released November 4, 2016

---

Minnesota voters approved a constitutional amendment in 1988 that allowed the state to create and operate a lottery.¹ The Lottery offers two types of games: lotto games (such as Powerball, Mega Millions, Gopher 5, Daily 3) and scratch games with a variety of ticket types, prices, and themes. In fiscal year 2016, the Lottery’s sales were about $593 million, and it contributed nearly $96 million of its net proceeds to the state’s Environment and Natural Resources Trust Fund and its General Fund.
In conducting the audit, we had the following objectives:

• Determine whether the Lottery had adequate internal controls over its information technology.
• Determine whether the Lottery had adequate internal controls over its financial activities.
• Determine whether the Lottery complied with the legal requirements we selected for testing.
• Determine whether the Lottery resolved prior audit findings.²

Conclusions

The Minnesota State Lottery had generally adequate internal controls over its information technology, but it had some weaknesses as noted in Findings 1 through 7. The Lottery had generally adequate internal controls over its financial activities, but it had some weaknesses as noted in Findings 7 through 9. In addition, the Lottery generally complied with the legal requirements we tested, except as stated in Finding 8. In addition, we provide an analysis in Appendix A of two prior Lottery practices we think are legally questionable. The Lottery ended both practices July 1, 2016.³

The Minnesota State Lottery resolved all five of the prior findings, as shown in Appendix B.

Key Findings

• The Minnesota State Lottery did not have sufficient formal, documented policies and procedures for all information technology control areas. (Finding 1)
• The Minnesota State Lottery did not always have sufficient evidence of the review and approval of changes made to its computer systems. (Finding 2)
• The Minnesota State Lottery did not have an adequate plan to recover its information technology operations in the event of a disaster. (Finding 3)
• The Minnesota State Lottery did not periodically ensure it appropriately limited people’s access to its information systems and physical facilities. (Finding 4)
• The Minnesota State Lottery did not adequately limit employee access to retailers’ not public information. (Finding 7)

---

¹ Minnesota Constitution, art. XIII, sec. 5. The Lottery was created by the Legislature in 1989 (see Laws of Minnesota 1989, chapter 334, art. 3) and operates under laws codified in Minnesota Statutes 2015, 349A.
² Office of Legislative Auditor’s Financial Audit Division Report 13-12, Minnesota State Lottery, issued June 20, 2013.
³ Benjamin Freedland, General Counsel, Minnesota State Lottery, memorandum to Executive Team, Lottery Prize Policy Changes, June 21, 2016.