Risk Assessment Review 11/11

CALIFORNIA LOTTERY Audit Report RISK ASSESSMENT REVIEW As of June 30, 2011 J C OHN HIANG California State Controller November 2011 November 30, 2011 John Mass, Chairperson California Lottery Commission 600 North Tenth Street Sacramento, CA 95811 Dear Mr. Mass: The State Controller’s Office (SCO) has completed a risk assessment of the California Lottery’s (Lottery) operations as part of its ongoing responsibilities under the California State Lottery Act. The risk assessment included operations and activities as of June 30, 2011. The assessment was performed to review and evaluate the Lottery’s operations and activities in terms of the various risks to which those operations and activities are exposed, and to prioritize the operations and activities into risk categories to facilitate future SCO audit plans. The SCO identified 142 operations and activities and developed a list of risk factors with which to prioritize operations and activities into five risk categories. As a result of the risk assessment, the operations and activities have been categorized as follows: 23 as high risk; 34 as medium-high risk; 38 as medium risk; 27 as medium-low risk; and 20 as low risk The SCO will periodically assess the effect of any future changes in Lottery’s operations and activities or related risk factors that may occur. Such an assessment will facilitate adjustments to audit priorities and future audit plans. If you have any questions about this analysis, please contact Andrew Finlayson, Chief, State Agency Audits Bureau, at (916) 324-6310. Sincerely, Original signed by JEFFREY V. BROWNFIELD Chief, Division of Audits JVB/sk John Mass, Chairperson -2- November 30, 2011 cc: John Menchaca, Commissioner California Lottery Commission Alex E. Fortunati, Commissioner California Lottery Commission Linh Nguyen, Acting Director California Lottery Michael T. Ota, Deputy Director Finance Division California Lottery Roberto Zavala, Chief Internal Audits California Lottery California Lottery Risk Assessment Review Contents Audit Report Summary ............................................................................................................................. 1 Background ......................................................................................................................... 1 Objectives, Scope, and Methodology ................................................................................ 1 Conclusion ........................................................................................................................... 4 Restricted Use ..................................................................................................................... 4 Schedule 1—High Risk Operations and Activities ................................................................ 5 Schedule 2—Medium-High Risk Operations and Activities ................................................ 7 Schedule 3—Medium Risk Operations and Activities .......................................................... 10 Schedule 4—Medium-Low Risk Operations and Activities ................................................. 13 Schedule 5—Low Risk Operations and Activities ................................................................ 15 California Lottery Risk Assessment Review Audit Report Summary The State Controller’s Office (SCO) performed a risk assessment of the California Lottery’s (Lottery) operations as part of its ongoing responsibilities under the California State Lottery Act. The assessment was performed to review and evaluate the Lottery’s operations and activities in terms of the various risks to which those operations and activities are exposed, and to prioritize the operations and activities into risk categories to facilitate future SCO audit plans. The SCO identified 142 operations and activities and developed a list of risk factors in order to prioritize operations and activities to five risk categories. As a result of the risk assessment, the operations and activities have been categorized as follows: 23 as high risk; 34 as medium-high risk; 38 as medium risk; 27 as medium-low risk; and 20 as low risk. Background By authority of the California Constitution, Government Code section 12410 states, “The Controller shall superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provision of law for payment.” In addition, Government Code section 12411 stipulates that “ . . . the Controller shall suggest plans for the improvement and management of revenues.” Proposition 37, the California State Lottery Act of 1984 (Lottery Act), amended the California Constitution to authorize the establishment of a statewide lottery, to create the California Lottery Commission, and to give the commission broad powers to oversee the operation of a statewide lottery. Pursuant to Government Code section 8880.67, the SCO may conduct other special post-audits of the Lottery, as the State Controller deems necessary. The Controller or his/her agents conducting an audit under this chapter shall have access and authority to examine any and all records of the California Lottery Commission. Objectives, Scope, The purpose of the risk assessment is to review and evaluate the California Lottery’s (Lottery) operations and activities in terms of the and Methodology various risks to which those operations and activities are exposed, and to prioritize the operations and activities into risk categories to facilitate future SCO audit plans. This risk assessment included operations and activities as of June 30, 2011. This engagement is a survey and not an audit. As such, it does not constitute an audit under generally accepted auditing standards. -1- California Lottery Risk Assessment Review The risk assessment is a systematic process of gathering, assessing, and integrating professional judgment conditions that impact the financial and operational activities of the organization. This process provides a logical methodology to determine the priority listing of Lottery operations and activities, based on risk. The SCO developed a list of all operations and activities of the Lottery that could be audited. This list was determined by: 1. Performing a review of the following: Prior risk assessment ranking schedules for the operations and activities noted in the previous SCO Risk Assessment report, dated March 2008 The Lottery’s Organization Charts for Fiscal Year 2010-2011 The Lottery’s contract list to determine if contracts should be included in the Risk Assessment list of operations and activities The Lottery’s Internal Audits Office risk assessment to determine if the operations and activities should be included in our risk assessment 2. Interviewing Lottery management personnel to confirm that the list contained all of the operations and activities in their respective divisions. The procedures performed to access the risk associated with each operation and activity included: Identifying and developing critical factors in order to evaluate the operations and activities identified above; Assigning each identified operation and activity a score for each risk factor; Computing a composite risk score for each operation and activity; Ranking the operations and activities in descending order from the highest to the lowest, and assigning each operation and activity to five risk categories from high to low; and Evaluating the overall reasonableness of the risk assessment rankings and the placement of operations and activities into five risk categories. The risk categories and the relative weighing of these categories are based on the most relevant critical factors for assessing risk as determined by the judgment of SCO management and staff. Each of the risk factors, except for extraordinary circumstances, received a score of from one to five, with one indicating minimum risk and five indicating maximum risk. For extraordinary circumstances, if an operation or activity had a risk factor in this category, it was given an automatic score of five. -2- California Lottery Risk Assessment Review The risk factors and their respective composition are as follows: 1. Financial Impact This factor was based on the dollar amount of the transactions, complexity of the transactions, and frequency of the transactions. 2. Compliance with Lottery Act, Other Legal Requirements, and SAM This factor was based on the operation or activity’s mandatory compliance with the Lottery Act, other legal requirements, and the State Administrative Manual (SAM). 3. Prior SCO Experience This factor was based on prior audits and reviews the SCO has performed on the operation or activity. 4. Change in Operations/New Processes This factor was based on any changes or new processes occurring within an operation or activity. 5. Security and Integrity This factor was based on the complexity and diversity of operating systems, physical access, and logical access. 6. Extraordinary Circumstances This factor was based on any important and unusual matters that deserve special attention. The scores of each of these factors were entered into a risk matrix. Each of the six risk factors was given a weight based on the judgment of SCO management and auditors as follows: Weight Risk Factor Given Financial Impact 50% Compliance with Lottery Act, Other Legal Requirement, and SAM 30% Prior SCO Experience 10% Change in Operations/New Processes 5% Security and Integrity 5% Extraordinary Circumstances 100% A final risk score for each of the Lottery’s operations and activities was computed based on the score of each of its risk factors and the weight given to the factor. A total score of 10, which indicates maximum risk and includes the extraordinary circumstance risk factor, was possible. -3- California Lottery Risk Assessment Review Conclusion The SCO identified 142 operations and activities as critical or necessary functions within the Lottery. Based on the composite score of each operation and activity, the SCO categorized it into one of five levels of risk: high, medium-high, medium, low-medium, or low. The results of the final categorization of operational and activities are as follows: Number of Operations Level of Risk Explanation of Risk and Activities Schedule High Operations/activities that, due to their nature and the level of current 23 1 oversight, must be audited on a routine basis. Medium-High Operations/activities for which, due to their nature and the level of current 34 2 oversight, a periodic audit would be advisable. Medium Operations/activities for which, given time constraints and resources, should 38 3 be audited periodically. Medium-Low Operations/activities that, as ranked by the risk matrix, have limited risk. As 27 4 such, an audit may be warranted at some time. Low Operations/activities that carry little or no risk. New extraordinary 20 5 circumstances would need to occur to warrant an audit. The risk assessment included operations and activities as of June 30, 2011. The SCO will periodically assess the effect of any future changes in the operations and activities or related risk factors that may occur. Such an assessment will facilitate adjustments to audit priorities and future audit plans. Restricted Use This report is intended for the information and use of the California Lottery, the California Lottery Commission, and the SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of the final report, which is a matter of public record. Original signed by JEFFREY V. BROWNFIELD Chief, Division of Audits November 30, 2011 -4- California Lottery Risk Assessment Review Schedule 1— High Risk Activities and Operations As of June 30, 2011 Composite Operations and Activities Division Description Score Revolving Fund and Fin/Admin Maintain and monitor disbursement records, 4.43 Disbursements/Travel Revolving Fund transactions, and travel advances. GTECH Gaming Contract ITSD Provide gaming and telecommunication services. 4.38 (expires on 10/13/19) Prize Assignment Fin/Admin Process winners’ request for trusts, beneficiary 4.30 designations, estates, group claims, loan and sales, etc. of installment payments. On-line Claims Fin/Admin Validate and process on-line claims from winners 4.29 and from district offices. Scratcher Claims Fin/Admin Validate and process Scratcher game prize claims 4.29 from winners and from district offices. Purchase & Disposal of Fin/Admin Acquisition of investments to fund the payment of 4.26 Investment Securities the deferred prizes, cash out (bond liquidation) the unclaimed annuity prizes for transfer to Education. Receipts & Disbursements of Fin/Admin Monitor and record cash receipts, deposits, and 4.15 Funds remittances of money. Procurement Function Executive Oversee procurement functions. 4.11 Delinquent Account Collections Fin/Admin Coordinate the efforts in the collection of monies 4.10 due from terminated retailers. Monitor collection agency contract for compliance with percentage fee billings. Banking Activity (Electronic Fin/Admin Daily physical processing of electronic files 3.99 Fund Transfer) created for billing purposes and ensuring appropriate retailer bank accounts are maintained on the Stratus, IBM, and Platinum accounts receivable systems. Payroll Fin/Admin Maintain and process all payroll transactions, 3.96 including distribution of warrants. Otto Construction (expires on Operations Pre-construction services and construction of new 3.93 12/31/11) HQ building. eProcurement System Executive Contract/procurement management system for the 3.78 initiation, approval, acceptance of goods and services, and approval of payment. Gaming Security: On-line, SLED Conduct all investigations including criminal 3.75 Scratcher Games, and Scratcher investigations for the Lottery. Monitor and analyze Production criminal activities and trends of criminal organizations that negatively affect the Lottery. Maintain liaison with law enforcement agencies. David & Goliath Contract Sales & David & Goliath will perform general market 3.75 (expires on 11/18/15) Marketing advertising services. -5- California Lottery Risk Assessment Review Schedule 1 (continued) Composite Operations and Activities Division Description Score Contract Services Executive Oversee contracting functions. 3.74 Financial Statements, Reports, Fin/Admin Analysis and preparation of GAAP quarterly and 3.71 and Footnotes annual financial statements, with full disclosure footnotes. Analysis and preparation of end-of- game report, and the monthly management information reports. Camelot Global Services North Sales and Business planning consulting in developing and 3.70 America (Expires on 07/12/13) Marketing implementing the Lottery's business plan. Accounts Payable-Vendors Fin/Admin Maintain and monitor accounts payable 3.70 transactions for Lottery vendors and retailers. Fixed Assets Fin/Admin Capitalization and depreciation of assets. 3.70 Ramirez & CO. Contract (expires Fin/Admin Investment advisor and a fee structure for services 3.70 on 06/30/11) as an agent for the Lottery in executing and restructuring of our investment portfolio. Fleet Services Operations Monitor the use and maintenance of the Lottery's 3.70 vehicles. Point-of-Sale (POS) Sales & Develop, produce, and distribute all POS 3.70 Marketing materials. -6- California Lottery Risk Assessment Review Schedule 2— Medium-High Activities and Operations As of June 30, 2011 Composite Operations and Activities Division Description Score Retailer-Accounts Fin/Admin Analysis and reconciliation of electronic fund 3.69 Receivable-Collections transfers, to/from retailers, including non-sufficient funds. Retailer-Accounts Fin/Admin Maintain communication with retailers to collect 3.69 Management monies owed the Lottery. Analyze and resolve retailer questions regarding Lottery billing processes. Fixed Assets & Inventory Operations System to maintain fixed assets records and maintain 3.66 System Lottery-owned property Alcone Marketing Group Sales & Marketing promotions and point-of-sale services 3.65 Contract (expires on 08/31/11) Marketing Annuity System Fin/Admin Process investments to fund the grand prize and 3.65 monitor the investment portfolio. Process installment prize payments through the prize authorization process and create the prize claim schedule tapes for (SCO) payments. Scratchers Inventory Sales & Provide retailer services for sales and promotions and 3.64 Management Center Marketing resolve retailer problems, and manage Scratcher inventory. Technology Operations ITSD Maintains the technology infrastructure for the Lottery 3.61 internal operations, which include the network, voice, servers, and data. The technology infrastructure is housed at the primary data center (Lottery Headquarters) and an Operational Recovery Site. Personnel Transaction HR Process personnel transactions, leave balances, payroll 3.60 Processing and benefits (health, dental, & vision). Key Accounts-Chain Retailers Sales and Develop and maintain communications with major 3.60 Marketing retail chains and franchise organizations. Scratcher Game Close-out Sales and Process for closing and ending Scratcher games. 3.58 Process Marketing Consumer Marketing & Sales and Provide general marketing advertising for all Lottery 3.58 Advertising Marketing products End of Game Reconciliations Fin/Admin Reconcile end-of-game ticket inventories to the 3.56 accounts receivable system. Quarterly Transfer Fin/Admin Quarterly transfer of net revenues to public education. 3.55 Draw Management SLED Manage, coordinate, and approve activities related to 3.55 mechanical and automated draws, and on-line game draws. Develop and Monitor Annual Fin/Admin Prepare, evaluate, implement, administer, and control 3.55 Budgets the Lottery's budget and fiscal planning activities. -7- California Lottery Risk Assessment Review Schedule 2 (continued) Composite Operations and Activities Division Description Score Forecasting Fin/Admin Develop sales forecasts for setting jackpot amount for 3.55 major draw games and sales forecasts for budget development/monitoring. IT Compliance ITSD Track and monitor resolution of audit issues. Review 3.45 and provide recommendations for technical security procedures. Identify security vulnerabilities and provide recommendations for process improvements. Mail & Reproduction Services Operations Receive mail, distribute intra-office mail, log and 3.43 track certified and registered claims mail, provide copying services for the Lottery. Adjustment Activity Fin/Admin Process manual payments and adjustments to retailer 3.40 accounts. Promotions Sales & Manage consumer and retailer promotions. 3.40 Marketing Equipment/Inventory Operations Coordinate office relocations. 3.40 Website Corp Comm Create, maintain, and update public Lottery website. 3.38 Gaming Contract Management ITSD Manager and monitor the Lottery's gaming public 3.38 Section website contracts. This involves understanding the contract terms; monitoring contractor performance and deliverables; overseeing and communicating contractual issues; and performing analysis necessary to manage, document, and coordinate problem resolution. Manual Payments Processing Fin/Admin Process all manual payments to vendors, retailers, and 3.35 employees. Business Services Operations Provide employees and Big Spin participants an outlet 3.30 to purchase Lottery services. Time Advertising Contract Sales & Advertising of Lottery products to Asian community. 3.30 (expires on 09/07/12) Marketing Special Investigations SLED Conduct investigations of civil, internal, 3.25 administrative, employee, contractor, criminal and disclosure issues. Monitor production of Scratcher tickets, and conduct preliminary investigations into lost or stolen Lottery tickets. Monitor complaints against retailers and assist in authenticating online tickets. Monitor games to ensure security and integrity. Draw Audit Contract - KPMG Executive To provide Draw auditing and review services. 3.25 (expires 12/31/11) Salary Advance Fin/Admin Process, maintain, and monitor salary advances. 3.25 Retailer Network Planning, Sales & Plan and direct retailer network services. 3.25 Installation & Maintenance Marketing End of Games Audit Sales & End-of-game reconciliation of Scratcher tickets for 3.20 Marketing inventory. -8- California Lottery Risk Assessment Review Schedule 2 (continued) Composite Operations and Activities Division Description Score Quarterly Fin/Admin Record and process quarterly accruals for vendors. 3.15 Accruals-Administrative Expense Classification & Pay HR Administer the State’s classification plan and related 3.10 personnel actions; recruitment Business Continuity Plan Operations Provide procedures and processes designed to protect 3.05 critical business activities from the effects of major failures of information systems or disasters and to ensure their timely resumption. -9- California Lottery Risk Assessment Review Schedule 3— Medium Risk Activities and Operations As of June 30, 2011 Composite Operations and Activities Division Description Score District Offices Sales & Provide Lottery and/or retailer support in sales, 3.00 Marketing advertising, and security in nine district offices. Customer Service Delivery ITSD Provide support to all Lottery staff for phones, 2.95 desktops/laptops, mobile devices, and peripherals. Staff the IT Service Desk that is the single source of input for Lottery staff technology requests and problem reporting. On-line Marketing Sales & Develop long-term product & distribution 2.95 Marketing strategies. Product Development Sales & Analyze, plan, and develop all Lottery games. 2.95 Marketing District Sales Representative Sales & Provide sales support and promotional services for 2.95 Activities Marketing games. Casanova Pendrill Publicidad Sales & Provide advertising services targeting Hispanic 2.95 Contract (expires on 12/31/11) Marketing community. Retailer Marketing Sales & Develop general marketing advertising for all 2.90 Marketing Lottery's retailers. Andrews International Security SLED Provide security guard services. 2.90 Systems (expires on 12/02/11) Questioned Tickets Fin./Admin Review questionable tickets submitted for prize 2.85 claims. District Sales Representative Sales & Program wherein the DSRs earn quarterly bonuses 2.85 (DSR) Bonus Marketing if they meet sales goals. District Sales Representative Sales & Database system tracks DSR activities for bonus. 2.85 Reporting System Marketing GTECH Printing Corp. (expires Sales & Supplemental Scratcher printing. 2.85 on 06/30/13) Marketing Information Security Program SLED Ensure compliance with all statutory and 2.85 regulatory requirements regarding the confidentiality and security of information. Financial Audit Contract - Executive Provide financial auditing and review services. 2.80 KPMG (expires on 12/31/13) Key Accounts System Sales & Database system for chain retailer accounts. 2.80 Marketing Investigation of SLED Investigate questionable and fraudulent tickets. 2.80 Questionable/Fraudulent Tickets Background Processing (In- SLED Conduct background investigations, regulate 2.70 house) retailers, and monitor all administrative and criminal actions against Lottery retailers. -10- California Lottery Risk Assessment Review Schedule 3 (continued) Composite Operations and Activities Division Description Score Physical Access SLED Maintain controls over physical access to facilities, 2.70 equipment, etc. Logical Access ITSD Control access to data maintained in computer files 2.65 and gaming systems (vendors). LPA Sacramento, Inc (expires on Operations Provide professional architectural and engineering 2.63 12/31/11) services. Employee Recognition HR Oversee development and implementation of 2.60 employee recognition programs for the Lottery. Tax Unit Fin/Admin Process tax deposits, provide tax reporting to 2.60 governmental agencies, and process 1099s and W- 2Gs for winners, retailers, and vendors. Petty Cash Funds Fin/Admin Maintain and monitor petty cash disbursements. 2.55 Estrada Consulting (expires on Design, develop, and implement a Business 2.50 4/18/12) ITSD Intelligence system. Public Relations Corp Comm Develop and disseminate information to media; 2.50 press releases, media advisories, earned media events, etc. Non-Retailer Accounts Fin/Admin Maintain and monitor accounts receivable records 2.50 Receivable for vendors and employees. Facilities Operations Operations Maintain building and furniture inventory, and 2.48 provide lease management services. Sales Inquiry System Sales & Sales information database. 2.40 Marketing General Ledger Analysis Fin/Admin Monthly analysis and reconciliation of general 2.35 ledger accounts. State Treasurer’s Office Contract Fin/Admin Investment and custodial services of U.S. Treasury 2.35 Securities. Game Accounting Fin/Admin Analysis, reconciliation, research, and accrual of 2.30 on-line and Scratcher game accounting activities such as sales, prizes, commission expenses, etc. Pollard Banknote Limited Sales & Supplemental Scratcher printing. 2.25 (expires on 06/30/13) Marketing Scientific Games, Inc (expires on Sales & Scratcher design/development/production. 2.25 6/30/13) Marketing Processing Retailer Adjustments Fin/Admin Process retailer adjustments for both online and 2.25 Scratcher games. Business Consulting Services ITSD Conduct business analysis and customer 2.23 acceptance testing for all Lottery business applications supported by the Information Technology Services Division. -11- California Lottery Risk Assessment Review Schedule 3 (continued) Composite Operations and Activities Division Description Score Trade Incentive Program (TIP) Sales & Administer and monitor retailer promotional 2.20 Marketing programs. Stanley Convergent Security SLED Provide Lottery's physical security system 2.20 Solutions services. Training HR Oversee staff development and training. 2.20 -12- California Lottery Risk Assessment Review Schedule 4— Medium-Low Risk Activities and Operations As of June 30, 2011 Composite Operations and Activities Division Description Score Background Investigation System SLED Maintain database for background 2.10 (In-house now) investigations. Enterprise Application Delivery ITSD Deploy, maintain, and support in-house 2.05 developed applications or commercial-off-the- shelf applications. Television Communications Corp Comm Provide corporate audit, video, and other 2.00 production activities designed to meet communication needs. Corporate Social Responsibility Executive Focus on building productive stakeholder 2.00 relationships and promote responsible gaming. California Office of Problem Executive Maintain the Lottery’s problem-gambling 2.00 Gambling Contract (Exp on helpline (1-800) and other services. 06/30/2011) Contract Support Operations Monitor, implement, and initiate all contracts, 2.00 work requests, and purchase for technical/trade services for all buildings and grounds. Invoice Center Sales & Manage receipt of Scratcher tickets invoices 1.98 Marketing from retailers. Exception Questionable Claim SLED Database for questionned tickets investigated 1.98 System by Security. Reasonable Accommodation HR Implement and monitor ADA, HIPA, medical 1.95 problems, accident training. Muse Communications Contract Sales & Provide advertising targeting African- 1.95 (Exp on 01/31/12) Marketing American community. Retailer Document Processing Sales & Establish, maintain, update, and purge all 1.90 Marketing retailer master file records. Selection Services HR Administer exams for the Lottery and recruit 1.90 for vacancies. Labor Relations HR Develop and maintain manager-labor 1.90 relationships, labor grievances, meeting with unions (SEIU 1000, peace officers, etc.); investigating allegations, adverse actions. Equal Employee Opportunity HR Develop, implement and monitor the EEO 1.90 Services program. Health & Safety HR Develop and maintain health and safety and 1.90 wellness programs. CAL-OSHA. Injured Workers Program HR Oversee workers compensation (SCIF), and 1.90 Return to Work Program. -13- California Lottery Risk Assessment Review Schedule 4 (continued) Composite Operations and Activities Division Description Score University Enterprises (Expires HR Provide student assistant services to various 1.90 on 6/30/11) departments within the Lottery. State Personnel Board (Expires on HR Various services (ongoing): 6/30/11) On-line Data Processing 1.90 Psychological screening On-line testing services Leasing Operations Monitor Lottery’s leased property. 1.85 Case Tracking System SLED Database for cases investigated by Security. 1.83 Monitoring Audit Contracts Executive Coordinate audits to minimize duplications or 1.81 omissions. Retailer Systems/Sales Operations Sales & Track installation of retailer vending 1.80 Marketing machines. Customer Service Operations Receive calls and provide services to retailers 1.75 and public via 1-800 information line, and provide performance correspondence services. TG Page Design Group (Expires Corp Comm Provide a broad range of original graphic 1.60 on 03/31/12) design layout and creative design services. Security Audit Contract - KPMG Executive Provide security evaluation audit services. 1.58 IPSOS Reid (Exp on 07/31/11) Executive Provide Lottery player and non-player 1.55 tracking services. IT Planning & Project ITSD Provide project management for IT projects 1.50 Management and enterprise architecture. -14- California Lottery Risk Assessment Review Schedule 5— Low Risk Activities and Operations As of June 30, 2011 Composite Operations and Activities Division Description Score Shaw Valenza LLP (Expires on HR Service agreement for consultation and 1.45 8/31/11) investigative services on Equal Employment Opportunity (EEO) matters. Audits, Reviews & Special Executive Conduct internal audit reviews and other 1.40 Projects projects. Legal Services Executive Provide legal services to the Lottery. 1.30 Sierra National Construction, Inc Operations Provide construction and tenant improvements at 1.30 (Expired) the Lottery headquarters complex. Retailer Communications Sales & Coordinate retailer communications and develop 1.30 Marketing and maintain newsletter. Solution, LLC (expires on ITSD Provide a full range of website development, 1.30 5/13/13) design, implementation, and web hosting services. California Technology Agency ITSD Host and provide support to Lottery mainframe 1.19 (OTECH) applications. SAS 70 Executive Audit online gaming vendor. 1.15 Records Retention Management Operations Manage and retain all of Lottery's physical 1.15 records. Enterprise Services Support ITSD Provides internal services to Information 1.13 Technology Services staff and liaison support to other service organizations in the Lottery (e.g., Finance, HR, Contracts and Procurement). Monitor & Implement Audit Executive Monitor the status and implementation of all 1.10 Recommendations internal and external audit recommendations. Engineering & Maintenance Operations Provide maintenance services for Lottery 1.10 facilities. Forms Management Operations Manage and maintain all of the Lottery's form 1.05 documents. Security Audit (Printers) Contract Executive Service Agreement to conduct a security audit of 1.00 - Delehanty Consulting Scratcher printer vendors by expert consultant. US Patent & Trademark Office Executive Register of patents and services. 1.00 Business/Strategic Planning Executive Plan corporate objectives for the annual and 1.00 five-year strategic plans and identify strategies for achieving the objectives. Market Research & Sales Executive Perform market research, sales analysis for 1.00 Analysis various Lottery Divisions-especially Sales and Marketing and ITSD. -15- California Lottery Risk Assessment Review Schedule 5 (continued) Composite Operations and Activities Division Description Score Comparing Budget & Associated Fin/Admin Database system to monitor expenditures against 1.00 Expenditures (BETS) budget and provide monthly reports. Custodial Support Operations Provide janitorial services. 1.00 Experiential Marketing & Sales & Provide information and analysis to management 1.00 Broadcasting Marketing and manage Lottery broadcast programs. -16- State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250-5874 http://www.sco.ca.gov S11-LOT-005