November 21, 2024
Representative Rick Hansen, Chair, called the Legislative Audit Commission meeting to order at 10:00 a.m. Chair Hansen stated the meeting’s purpose was to hear the Office of the Legislative Auditor’s (OLA’s) presentation of the performance audit, Minnesota State Lottery.
Chair Hansen introduced Lori Leysen, Deputy Legislative Auditor for the Financial Audit Division; Gabbie Johnson, Audit Team Lead; and Joe Sass, IT Audit Coordinator. Ms. Leysen said that the audit covered both information technology (IT) and non-IT-related areas for a comprehensive look at the Minnesota State Lottery’s (Lottery’s) vendor oversight, gaming systems, retailers who sell lottery tickets, and prior audit findings. She said the overall conclusion is that the Lottery did not have adequate internal controls, but generally complied with the legal criteria tested. The audit resulted in 11 findings. She then turned to Mr. Sass for the specific details.
Mr. Sass explained the findings for the IT-related audit areas, saying the audit found no significant issues with physical security of the Lottery’s headquarters. He added, however, that OLA identified IT-related findings regarding access control, password security, best practices for the Lottery’s vulnerability and configuration management program, and incident response and disaster recovery procedures. Mr. Sass outlined OLA’s recommendations for the Lottery, and then turned to Ms. Johnson for details about the non-IT-related portion of the audit.
Ms. Johnson discussed other OLA findings, including Lottery retailers not having full background checks for disqualifying criminal convictions, retailers with expired contracts continuing to sell tickets, and the Lottery not charging retailers for lost or stolen tickets in some cases. Ms. Johnson then covered OLA’s recommendations, and handed over the presentation to Ms. Leysen for details about the survey of Lottery employees.
Ms. Leysen said OLA surveyed Lottery employees to determine the extent of some concerns that arose during the audit regarding Lottery leadership and supervisors. The survey found that many employees had concerns about the workplace culture, including concerns with executive leadership and human resources. Ms. Leysen explained OLA’s recommendations in this area, and concluded the presentation.
Chair Hansen asked members of the Legislative Audit Commission for questions. Ms. Johnson, Ms. Leysen, and Mr. Sass answered questions regarding any evidence of breach of security at the Lottery, security policy adherence, survey responses, retailer eligibility requirements, and incident response and disaster recovery planning. Members discussed several concerns regarding criminal background checks of retailers.
Judy Randall, Legislative Auditor, joined the presentation to clarify OLA’s interpretation of the law regarding criminal background checks for Lottery retailers. OLA concluded that the background checks should be nationwide. Ms. Randall said that OLA and the Lottery have different interpretations of the law, and that clarification in the upcoming legislative session would be helpful.
Chair Hansen invited the following Minnesota State Lottery representatives to address the commission: Adam Prock, Executive Director; Ben Freedland, Assistant Director and General Counsel; and Sue Nelson, Chief Information Officer. Mr. Prock said that the Lottery is committed to resolving the findings in OLA’s audit, but also explained why the Lottery disagreed with two of OLA’s findings: the verification and background checks of retailers, and charges to retailers for lost or stolen tickets. He said the Lottery would work with legislators in the coming session to add clarifying language to applicable statutes and rules. Mr. Prock, Mr. Freedland, and Ms. Nelson then responded to questions regarding the Lottery’s process for completing background checks and why and when they made their process changes, unremediated findings from the previous audit, the employee survey, and the Lottery’s incident response and recovery plan.
With no further discussion, Chair Hansen adjourned the meeting at 11:24 a.m.
Representative Rick Hansen, Chair
Jade Lange, Recording Secretary
