Mirage woes prompt audit review

By Liz Benston

Friday, June 13, 2003 | 10:49 a.m.

Deloitte & Touche is disputing a suggestion by Nevada regulators that it's at fault for failing to discover that its client, The Mirage, didn't file thousands of anti-money laundering reports with the federal government.

Deloitte, the largest external auditor of Nevada casinos whose clients include all of the major Strip properties, says it didn't fall short of its duties because the state Gaming Control Board has historically allowed outside auditors to rely on the work of casinos' internal auditors.

The auditing giant also is pressing the Control Board to adopt rules this year that would give more responsibility to external auditors in complying with Regulation 6A, a state rule that requires larger Nevada casinos to report transactions of $10,000 or more to the federal government.

The changes would mark the latest fallout of the Mirage scandal. In February the resort discovered that a former employee in charge of Regulation 6A compliance failed to mail nearly 15,000 cash transaction reports to the federal government. Supervisors, internal auditors and external auditors failed to discover the error, indicating a breakdown in the resort's regulatory controls, said a complaint filed against The Mirage by the Control Board.

The Mirage has agreed to pay a $5 million fine to regulators, a deal that awaits final approval this month from the Nevada Gaming Commission.

In a separate criminal complaint against the former Mirage employee, the Nevada attorney general claims the employee admitted lying to supervisors and auditors about having mailed the forms.

"I don't think (Deloitte) dropped the ball at any time," said Tom Roche, national gaming industry director at Deloitte & Touche in Las Vegas and a former member of the Control Board.

As a result of the scandal, Deloitte has begun to conduct quarterly independent audits of anti-money laundering reports generated at all MGM MIRAGE properties in Las Vegas -- audits that are above and beyond what is now required by the Control Board, he said.

The board is expected to begin the process of revising a host of casino compliance standards this summer, including Regulation 6A. The agency typically gathers industry input before making revisions. It hasn't yet examined the issue of tighter external auditing of 6A compliance and therefore hasn't taken a position, Control Board auditing chief Gregory Gale said. External auditing firms now have a fairly limited role under Regulation 6A that isn't clearly defined, Roche said.

Such firms have primarily relied upon the work of internal auditors rather than conducting their own independent investigations, which aren't specifically required by the board, he said. That leaves open the possibility that errors aren't caught the second time around, he said.

"The board has reviewed hundreds of (external audit reports) and has never brought that up as a violation," Roche said. "If there's that expectation on the board's part, they need to specifically delineate that in the guidelines."

The Control Board's complaint implied that The Mirage's external auditors improperly relied on the findings of internal auditors, who had not discovered the violation.

Deloitte conducted only one walk-through of the resort's internal audit department in 2001 and failed to conduct any walk-throughs in 2002, the complaint said.

The walk-through would include a spot check into whether the necessary forms were filed and a review of internal auditor findings. The external auditor also is required to document the walk-through on a checklist published by the board.

Board guidelines state that external auditors must conduct semi-annual reviews of Regulation 6A compliance.

Roche maintains that the board doesn't require walk-throughs for 6A purposes.

He said the board doesn't require external auditors to conduct independent checks of cash transaction reports but only to look over internal audit records.

The 2001 check was made on Jan. 23 and determined that all the necessary cash reporting forms generated that day had been filed, Roche said. The check was performed with the knowledge that it was more than what was mandated by regulators, he added.

Regulators later concluded that The Mirage failed to file reports from April 20, 2001, through Oct. 6, 2002, and from Nov. 23, 2002, through Jan. 6, 2003. It also failed to file one report in 2000.

External auditors may differ from the board in their interpretation of the rules, Gale said. The board may consider adopting more specific language to clear up confusion, such as a requirement that external auditors spot check a specific number of reports or examine postage receipts for mailed reports, he said.

"What we don't want to do is have something so detailed and so long," Gale said. "There must be some professional judgment involved. We don't want to tell these professionals every thing they need to do to do their job." Neither Deloitte nor The Mirage's previous auditor, Arthur Andersen, were charged with any violations in connection with the Mirage investigation.

The Mirage violated Regulation 6A by failing to ensure that Andersen and Deloitte performed semi-annual walk-throughs of the internal audit department, the board's complaint said. Roche, in the meantime, is suggesting that other companies join MGM MIRAGE in subjecting their 6A procedures to extra audits.

"Clients are coming to me saying, 'Do we need to be doing something more for our firm?' " he said.