CA Lottery Scratchers Ticket Distribution Process -

CALIFORNIA STATE LOTTERY Audit Report SCRATCHERS TICKET DISTRIBUTION PROCESS July 1, 2015, through June 30, 2018 M M. C ALIA OHEN C ALIFORNIA S TATE C ONTROLLER August 2024 MALIA M. COHEN CALIFORNIA STATE CONTROLLER August 14, 2024 Harjinder K. Shergill-Chima, Director California State Lottery 700 North Tenth Street Sacramento, CA 95811 Dear Ms. Shergill-Chima: The State Controller’s Office audited the California State Lottery’s Scratchers ticket distribution process for the period of July 1, 2015, through June 30, 2018. The purpose of the audit was to determine whether the California State Lottery maintained adequate internal controls over Scratchers ticket distribution and complied with applicable laws, rules, regulations, policies, and procedures as they relate to Scratchers ticket distribution. If you have any questions regarding this report, please contact Roochel Espilla, Chief, State Agency Audits Bureau, by telephone at (916) 323-5744 or by email at respilla@sco.ca.gov. Sincerely, Original signed by Kimberly A. Tarvin, CPA Chief, Division of Audits KAT/ac MAILING ADDRESS P.O. Box 942850, Sacramento, CA 94250 SACRAMENTO 3301 C Street, Suite 700, Sacramento, CA 95816 | 916.324.8907 LOS ANGELES 901 Corporate Center Drive, Suite 200, Monterey Park, CA 91754 | 323.981.6802 Ms. Harjinder K. Shergill-Chima August 14, 2024 Page 2 of 2 Copy: Fernando Aceves, Chief Counsel California State Lottery Nicholas Buchen, Deputy Director, Finance Division California State Lottery Sharon Allen, Deputy Director, Sales and Marketing Division California State Lottery John Lowden, Deputy Director, Security and Law Enforcement Division California State Lottery Sara Sheikholislam, Deputy Director, Internal Audits California State Lottery Emily Nguyen, Audit Manager, Internal Audits California State Lottery Mimi Alemu, External Audit Liaison, Internal Audits California State Lottery Gregory Ahern, Chair California State Lottery Commission Tiffani Alvidrez, Commissioner California State Lottery Commission Anthony Garrison-Engbrecht, Commissioner California State Lottery Commission Keetha Mills, Commissioner California State Lottery Commission Alexandre Rasouli, M.D., Commissioner California State Lottery Commission MAILING ADDRESS P.O. Box 942850, Sacramento, CA 94250 SACRAMENTO 3301 C Street, Suite 700, Sacramento, CA 95816 | 916.324.8907 LOS ANGELES 901 Corporate Center Drive, Suite 200, Monterey Park, CA 91754 | 323.981.6802 California State Lottery Scratchers Ticket Distribution Process Contents Audit Report Summary ............................................................................................................................. 1 Background ......................................................................................................................... 1 Audit Authority .................................................................................................................. 2 Objectives, Scope, and Methodology ................................................................................ 2 Conclusion ........................................................................................................................... 3 Follow-Up on Prior Audit Findings .................................................................................. 3 Views of Responsible Officials .......................................................................................... 4 Restricted Use ..................................................................................................................... 4 Findings and Recommendations ............................................................................................. 5 Attachment—California State Lottery’s Response to Draft Audit Report California State Lottery Scratchers Ticket Distribution Process Audit Report Summary The State Controller’s Office (SCO) audited the California State Lottery’s (Lottery) Scratchers ticket distribution process for the period of July 1, 2015, through June 30, 2018. The purpose of the audit was to determine whether the Lottery maintained adequate internal controls over Scratchers ticket distribution and complied with applicable laws, rules, regulations, policies, and procedures as they relate to Scratchers ticket distribution. Based on our audit, we determined that the Lottery: • Did not recall compromised Scratchers tickets from Lottery retailer locations; • Lacked adequate controls over Scratchers tickets with deficient security test results; • Did not comply with its Scratchers ticket testing procedures; and • Lacked adequate controls over Scratchers ticket inventory at distribution centers. Further details of these findings are described in the Findings and Recommendations section of this report. Background On November 6, 1984, California voters passed Proposition 37, the California State Lottery Act of 1984 (Lottery Act), which authorized the creation of a state-operated lottery. The Lottery Act is found in Chapter 12.5, section 8880 et seq., of the Government Code. The Lottery Act created the California State Lottery Commission and gave it broad powers to oversee the Lottery’s operations. The purpose of the Lottery Act is to provide supplemental money to benefit public education without the imposition of additional or increased taxes. The Lottery has seven divisions: Executive, Finance, Human Resources, Operations, Security and Law Enforcement, Information Technology Services, and Sales and Marketing. As of February 1, 2021, the Lottery has 917 budgeted positions; staff members are located at Lottery Headquarters, two distribution centers, and nine district offices. The Lottery’s distribution centers are located in Northern and Southern California. Each distribution center has a warehouse manager, a supervisor, and approximately 25 warehouse workers. The distribution centers service the Lottery’s nine district offices and over 150,000 Lottery retailer locations. The distribution centers are responsible for receiving, storing, distributing, maintaining, and destructing Scratchers tickets. The Lottery’s Sales section of the Sales and Marketing Division is responsible for Scratchers ticket game development, and determines game ticket quantities to be delivered to the distribution centers. The Scratchers Inventory Management Center within the Sales and Marketing Division works with the Lottery’s district sales representatives and retailers and submits game ticket orders to the distribution centers. Prior to game ticket -1- California State Lottery Scratchers Ticket Distribution Process distribution, the Lottery’s Security and Law Enforcement Division (SLED) performs quality assurance checks on every Scratchers ticket game to ensure that games meet security and quality guidelines. Audit Authority Pursuant to Government Code (GC) section 8880.46.6, the SCO may conduct special post-audits of the Lottery, as the State Controller deems necessary. The Controller or his/her agents conducting an audit under this chapter shall have access and authority to examine any and all records of the California State Lottery Commission. GC section 12410 states, “The Controller shall superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provision of law for payment.” In addition, GC section 12411 stipulates that “ . . . the Controller shall suggest plans for the improvement and management of revenues.” Objectives, Scope, The objectives of the audit were to determine whether: and Methodology • The Lottery is complying with applicable laws, rules, regulations, policies, and procedures as they relate to Scratchers ticket distribution; and • The Lottery maintains adequate safeguards over the Scratcher ticket inventory for distribution, maintenance, and destruction. The audit period was July 1, 2015, through June 30, 2018. To meet the audit objectives, we performed the following procedures. • We reviewed the State Administrative Manual; the Lottery’s policies and procedures; and applicable laws, rules, and regulations as they relate to Scratcher ticket distribution. • We reviewed prior audits performed by the SCO and the Lottery’s Internal Audits Office and followed up on any prior audit findings. • We performed walkthroughs and interviews, and observed individuals involved with the Lottery’s processes and procedures related to Scratchers ticket distribution. • We gained an understanding of and evaluated internal controls over Scratchers ticket distribution as they relate to the specific objectives and scope of the audit. • We performed tests of procedural compliance on processes related to Scratchers ticket distribution as follows: o We tested 131 of 579 Scratchers ticket deliveries to Lottery distribution centers to determine whether they were accurately recorded in the inventory management system. o We reconciled the inventory management system to delivery verification records to determine whether all ticket inventory for the audit period was entered in the system. o We tested 50 of 5,229 Scratchers ticket retailer orders to determine -2- California State Lottery Scratchers Ticket Distribution Process whether they were received, confirmed, and activated by the intended Lottery retailers. o We tested 117 of 234 Scratchers ticket destructions to determine whether tickets were properly disposed by end-of-game dates. o We reviewed 260 Scratchers Ticket Security-Testing Worksheets (Worksheets) for 141 games to determine if tickets were tested for quality assurance and security before distribution to the public. o We reviewed 44 case management reports to determine whether appropriate actions were taken for tickets with deficient test results. o We reviewed two liquidated damage assessments during the audit period for non-compliant Scratchers tickets to determine whether the Lottery pursued all potential assessments. • We assessed the reliability of computer-processed data related to Scratchers ticket distribution by interviewing the Lottery officials knowledgeable about the data; reviewing existing information about the data and the system that produced it; and tracing data to source documents, based on judgmental selections. We determined that the data was sufficiently reliable for the purposes of this report. We did not audit the Lottery’s financial statements. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We limited our review of internal control to gain an understanding of the Scratchers ticket distribution process. Conclusion Our audit determined that the Lottery: • Did not recall compromised Scratchers tickets from Lottery retailer locations; • Lacked adequate controls over Scratchers tickets with deficient security test results; • Did not comply with its Scratchers ticket testing procedures; and • Lacked adequate controls over Scratchers ticket inventory at distribution centers. Follow-up on Prior The Lottery has satisfactorily resolved the findings noted in our prior audit report on the Lottery’s Scratchers ticket distribution process for the period Audit Findings of July 1, 2009, through June 30, 2011, issued on January 14, 2013. -3- California State Lottery Scratchers Ticket Distribution Process Views of We issued a draft report on February 22, 2022. Lottery representatives Responsible responded by letter dated June 9, 2023. The Lottery agreed with the audit results for Findings 3 and 4, but disagreed with Findings 1 and 2. Our Officials comments to the Lottery’s responses to Findings 1 and 2 are included in the Findings and Recommendations section. This final audit report includes the Lottery’s response as an attachment. Restricted Use This report is intended for the information and use of the Lottery, the California State Lottery Commission, and the SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this report, which is a matter of public record, and is available on the SCO website at www.sco.ca.gov. Original signed by Kimberly A. Tarvin, CPA Chief, Division of Audits August 14, 2024 -4- California State Lottery Scratchers Ticket Distribution Process Findings and Recommendations FINDING 1— In September 2017, the Lottery’s SLED determined that six Scratchers ticket games manufactured by Scientific Game International, Inc. (SGI) The Lottery did catastrophically failed routine internal security tests. SLED stated that not recall tickets showed enough discernable data to compromise the games. SLED compromised considered the games high-risk, and found that the tickets could critically Scratchers tickets impact the Lottery’s reputation and ticket sales. SLED recommended that from Lottery the Lottery immediately stop distribution and recall all game tickets from retailer locations Lottery retailer locations and distribution centers. However, the Lottery did not recall the six compromised games and lacked adequate documentation to support that the deficiencies were appropriately addressed with SGI. Upon further review, we discovered that SGI had a history of producing non-compliant Scratchers tickets. In 2013, SLED notified the Procurement Services and Support Unit, formerly the Contract Development Services Unit, when two out of five SGI game tickets failed the same security test during the Request for Proposal evaluation process for the Scratchers Products and Related Services Ticket Printing contract. Despite failing the security tests, the Lottery awarded SGI as the primary vendor. Since the contract was awarded, SLED reported the following events: • In February 2016, a SLED analyst inadvertently tested an older pack of tickets manufactured by SGI. The game failed the same security test, having some but not all play data discernable. As there was not enough data present to completely compromise the game, tickets were not removed from retailer locations. SGI agreed to conduct experiments and evaluations with its ink suppliers to develop an additive or standalone coating that would prevent this age-related failure. • In April 2017, SLED investigators traveled to the SGI security testing center and discussed the status of security coating improvements. SGI assured the Lottery that it would continue to work on the development of a coating that would withstand the test. • In September 2017, SLED conducted a complete retesting of tickets for 30 Scratchers games produced by SGI that were currently being sold at retailer locations. SLED investigators found that six games had “catastrophic failures,” in which enough data was discernable to compromise the game. SLED also tested packs of tickets from secondary vendors and none failed retesting. The Lottery did not recall the six “catastrophic failure” games and lacked adequate documentation to support that the deficiencies were appropriately addressed with SGI. In a memorandum addressed to the then-Deputy Director of SLED, dated September 29, 2017, SLED investigators recommended that the Lottery recall the six games from retailer locations, request that SGI provide full access to its data regarding the test failures so that the Lottery could identify all games affected, and procure those games from a secondary vendor until the issue was resolved. -5- California State Lottery Scratchers Ticket Distribution Process In an email addressed to a Lottery Sales and Marketing Division Marketing Specialist, another former SLED Deputy Director stated that she was told by Sales and Marketing Division staff members that they were aware of the problematic tickets and had discussed the issues with SGI, but that the games were close to their end-of-game dates and, therefore, were not worth being recalled if high-tier prizes had already been claimed. However, we determined that at the time the security tests were conducted, only one game was at the end-of-game date; the remaining five games had end-of game dates that were 29, 85, 146, 202, and 211 days away, respectively. The Lottery could not provide adequate documentation to support how these compromised ticket issues were addressed, why the six games were not recalled from retailer locations, or whether the Lottery implemented SLED’s recommendations. SLED investigators began monthly testing to identify test failures; according to SLED, SGI tickets continued to fail during our audit period. It is imperative that the Lottery address all ticket security deficiencies to protect the integrity and security of Lottery Scratchers ticket game, Lottery players’ goodwill, and Scratchers tickets sales. An adequate system of controls over Scratchers ticket security deficiencies will ensure that vendors conform to contract terms and conditions, produce quality tickets, and are held accountable for noncompliance. GC section 13402 states: Agency heads are responsible for the establishment and maintenance of a system or systems of internal control, and effective and objective ongoing monitoring of the internal controls within their state agencies. This responsibility includes documenting the system, communicating the system requirement to employees, and ensuring that the system is functioning as prescribed and is modified, as appropriate, for changes in conditions. GC section 13403 (a) states, in part: As used in this chapter, “internal control” means a process, including a continuous built-in component of operations, effected by a state agency’s oversight body, management, and other personnel that provide reasonable assurance that the state agency's objectives will be achieved. Request for Proposal Number 0616 Exhibit A, Scope of Services and Service Specifications, 5.2.8 Quality Control states, in part: The Contractor must employ quality control procedures to ensure that all Scratchers tickets delivered meet the specifications and requirements of this Contract. The Contractor must employ 100% visual inspection of Scratchers tickets and must implement a specific procedure for the visual observation of the application of the covering material, release coat, and game data application. -6- California State Lottery Scratchers Ticket Distribution Process Scientific Games International, Inc. Contract Number 15862A03, Exhibit A, Primary Contractor Scope of Services and Service Specifications states: 5.2 Gaming Security The Contractor must address security measures associated with the development, production, and post-production of games. Details of these measures must be provided in the required security plan, as specified in Exhibit B Terms and Conditions. 5.2.4 Invasive Techniques Tickets must be manufactured in such a way that it is not possible to ascertain whether an instant ticket is a winning or non-winning instant ticket without rendering the instant ticket un-sellable to the public or easily recognizable as having been tampered with. In particular, it must not be possible to “see through” the scratch-off material with any practically available device or technique, including among other things, high intensity light, x-rays, infrared, lasers, chemical means, electrical means, photographic means, copying machine intrusion. Recommendation We recommend that the Lottery develop a system of controls for Scratchers tickets deficiencies with entity-wide documented procedures that include: • A description of the Scratchers ticket deficiency; • SLED’s and the contract manager’s recommendations; • Documentation of discussions with the ticket printing vendor regarding the deficiency and actions taken; and • Documentation of management’s decision on how the deficient Scratchers tickets were handled. Lottery’s Response The Lottery disagrees with the finding that Scratchers tickets (i.e., instant games) should have been recalled from retailer locations. SCO’s conclusions appear to be based on opinions from one internal memo which was not substantiated by actual evidence. However, the Lottery agrees with the recommendation to improve documentation and develop a more clearly defined cross-divisional process. As one of the largest lotteries in North America, the Lottery prints an average of 1.1 billion Scratchers tickets each year. Within the lottery industry, there are only three vendors that print Scratchers tickets and can manage the volume and security requirements of California’s business. California utilizes all three major vendors: Scientific Games International (SGI), International Game Technology, and Pollard Banknote Limited. During the comprehensive competitive procurement process, the Lottery assesses the viability of each of these vendors to determine their respective capacity and ability to effectively manage the Lottery’s business. -7- California State Lottery Scratchers Ticket Distribution Process The Lottery and its vendors work closely to ensure the security and integrity of its games. Due to the sheer volume of printed tickets, a zero- error rate is not achievable. Vendors may have errors or compliance issues in isolated cases, which both the vendor and the Lottery work to remedy immediately. The Lottery leverages liquidated damages clauses in its contracts to address any errors or compliance issues. The Lottery disagrees with SCO’s implied statements that it should not have contracted with SGI, which is a leader in the gaming industry that works with national and international lotteries and other gaming entities. It is the world’s largest creator, manufacturer, and services provider of lottery instant games and works with over 130 world-wide lotteries, in addition to providing and supporting gaming systems and platforms, retail technology, inventory management, and state-of-the-art technology solutions. Since the contract was awarded in 2013, SGI has printed approximately 440 games and reorders for California, which amounts to 7.2 billion tickets. While the Lottery identified issues in SGI’s ink and coating process in 2016, they were remedied and addressed through analysis, testing, and customized standards. Creating, printing, and distributing Scratchers games is a process that takes approximately 9 to 12 months, which means changes may not immediately reach the marketplace. After substantial quality and assurance testing, SGI began applying its new ink process in November 2018, and the Lottery has not seen further issues around this problem since that time. The six games identified in SCO’s report are based on a 2017 memorandum from a Lottery Security Law Enforcement Division (SLED) Supervising Agent documenting an issue with games printed by SGI. However, the 2017 memorandum includes inaccurate information that cannot be substantiated by reports contained within SLED’s case management system. To protect the integrity of the Lottery’s security process, specific details of the testing protocols cannot be detailed in this response. However, the memorandum indicates that 30 SGI games were tested, when, in fact, SLED has a record that 31 games were tested. Of those 31 games, 15 games showed discernable data, which also varies from the 2017 memorandum. Additionally, SLED’s case management data does not show that any of the SGI games tested were considered “catastrophic failures” as indicated in the 2017 memorandum. For a variety of reasons, the small, non-representative sample tested at the Lottery is not likely to detect a significant failure beyond normal manufacturing variances immediately prior to distribution of the game. The value of regular testing at the Lottery is to determine moderate and long-term trends concerning ticket printing specifications and whether such specifications should be modified. More importantly, the deficiencies raised in the memo were not obvious or discernable to the “naked eye” and would require special equipment to discover them. These items were not included in the logs that monitor ticket issues or liquidated damages, which also is not consistent with any findings labeled “catastrophic” or presenting a major security issue. The email from the Chief of SLED to the Marketing Specialist referenced by the SCO was dated two years after the initial memo. As the Chief was not directly involved in management decisions around this specific situation at the time, her response was speculative and not supported by evidence. In addition, many of the key Lottery staff involved with these specific games have retired or left the Lottery since -8- California State Lottery Scratchers Ticket Distribution Process this audit first began in 2018. Documentation outlining their decisions around the review process has been difficult to rebuild. Any decision to remove games from retail involves a complex cost- benefit analysis, balancing the severity of the issue and the potential risk with the projected impact to our mission, which ultimately drives all our decision-making. This analysis includes the number of potentially impacted retailers and players based on display rates and rate of sale as well as the lost sales, costs, logistics, and timing to remove and replace product at the Lottery’s 23,000 retailers. In general, older games are typically less available in the marketplace as sales decline and players purchase new ones, as would have been the case with the six identified games. These six games remained in market, generated an additional $407.4 million in sales, and there were no abnormalities or major issues reported from players or retailers. Nevertheless, to avoid any future confusion, the Lottery agrees with the recommendation for improved documented procedures for the organization to address ticket deficiencies. Since the audit time frame, there have been no additional ticket deficiencies identified during security testing. Although individual units internally categorized Scratchers issues by levels of severity, there was not a cross-divisional process to formally document how the Lottery handles deficient Scratchers ticket test results. In the years since the audit began, SLED and Marketing completed a new process to better define ticket deficiency issues, including recording and reviewing tiers of severity with defined processes by issue type. This also provides a greater level of accountability and additional documented decision points to address and define necessary actions and consequences, including contractually defined compensation from its vendors. The new process addresses steps once a ticket deficiency is identified, involving formal documentation of decision points on whether to recall or not recall Scratchers tickets. Documentation of discussions with vendors is encompassed within the Lottery’s existing liquidated damages process, which is always activated where there is an issue related to specific games. This process reviews any issues, capturing and documenting contact and work on the problem, and assesses financial fines/assessments/damages against vendors by their contractual obligations to ensure appropriate actions are taken to ensure the integrity of all games. The liquidated damages process has also been further revised to complement the deficiency process, as well as layering in greater documentation of physical evidence. SCO Comment The SCO supports the Lottery’s decision to improve documentation and develop more clearly defined entity-wide procedures. However, the Lottery’s statement that our conclusion is based on “opinions from one internal memo which was not substantiated by actual evidence” is incorrect. We obtained sufficient and appropriate evidence to provide a reasonable basis for our conclusion. We evaluated the following evidence: • Worksheets for the games; -9- California State Lottery Scratchers Ticket Distribution Process • A case management report regarding the incidents; • Two memoranda, issued in April 2013 and September 2017, from a Lottery Agent who was the Lottery’s subject matter expert on ticket testing; and • Testimonies from staff and management who were involved in the ticket testing. Furthermore, the 2013 memorandum names several employees who took part in the testing of SGI Scratchers tickets. One of the employees verbally corroborated the contents of the memorandum and confirmed that nothing was done to address the ticket deficiencies in 2017. We acknowledge that a zero-error rate is not achievable with Scratchers ticket products. However, the Lottery was not able to provide documentation to substantiate that it had worked with SGI to address or resolve the ticket deficiencies identified in the 2013 memorandum. We did not suggest that the Lottery should not have contracted with SGI. During the solicitation phase, we found that the Lottery had discovered and documented a quality issue regarding the tickets produced by SGI, and that similar issues occurred in the marketplace years later. We found no documentation to suggest that the deficiency was adequately addressed. The Lottery’s Special Investigation and Gaming Security Unit implemented a new testing procedure to address the deficiencies, but there was no documentation to show that the Sales and Marketing Division worked with the vendor to either fix the problem or hold the vendor accountable for the tickets. The Lottery also stated in its response that SGI began applying its new ink process in November 2018, and that the Lottery has not seen further issues related to the SGI’s ink and coating process since that time. We did not test this process and cannot comment on the validity of actions that the Lottery implemented after June 30, 2018, as they were taken subsequent to the audit period. In addition, the Lottery stated that there were some inconsistencies between the 2017 memorandum and the case management report. However, these inconsistencies do not invalidate that the six games identified and described in the 2017 memorandum as having “catastrophic testing failures” by the Lottery Agent—who is a subject matter expert— were found to have enough discernable data to compromise the games. The Lottery’s case management reports produced by SLED include the results, but not detailed analyses and conclusions. As described in our recommendation to this finding, the Lottery should develop a system of controls for Scratchers tickets deficiencies with entity-wide documented procedures that include a description of the Scratchers ticket deficiency and SLED’s recommendations. The Lottery also asserts that the response contained in an email by another former SLED Deputy Director “was speculation and not supported by evidence.” On the contrary, this email corroborated the other evidence supporting the existence of problematic tickets produced by SGI. The -10- California State Lottery Scratchers Ticket Distribution Process email also provided a perspective, which we found to be invalid, of the Lottery’s decision not to recall the compromised tickets. The Lottery stated that it was difficult to obtain documentation from its staff members in order to understand their review processes. However, during our fieldwork, we met with and communicated at length with the staff members involved in the specific games before they left or retired. Those staff members provided us with an understanding of the in-house laboratory ticket testing process and explained the issues that were presented in the 2017 memorandum and case management report. During fieldwork, we inquired about the Lottery’s process for deciding whether to remove games from retailer locations. The Lottery did not disclose that it performs cost-benefit analyses, nor did staff provide any documentation to demonstrate that a comprehensive evaluation was conducted for the six compromised games. The documentation we obtained supported that the Lottery’s decision to not recall the games was based solely on end-of-game dates. Furthermore, only one of the games was at the end-of-game date; the remaining five had end-of-game dates that ranged from 29 to 211 days. FINDING 2— The Lottery did not adequately document the severity of the deficient Scratchers ticket test results or the actions taken. We reviewed 260 The Lottery Worksheets and determined that 44 (17%) showed at least one deficient lacked adequate test result. We reviewed case management reports and could not determine controls over the severity of the deficiency and the actions taken for 40 of 44 deficient Scratchers tickets test results. As a result, we could not determine if compromised tickets with deficient were distributed to the public. security test results SLED performs quality assurance checks to reduce the risk that compromised tickets are distributed to the public. SLED analysts record test results on a Worksheet and create a case management report for each test in the RIMS system. If a deficiency is identified, a SLED supervisor is notified and is required to observe the analyst’s testing results or retest the ticket. According to the Lottery’s Scratchers Security Testing Procedures, SLED supervisors are responsible for reviewing the case management reports within three days of the analyst’s report and are required to verbally report any deficiencies to the SLED Deputy Director. However, there are no documented procedures for how the SLED Deputy Director should handle deficient test results. SLED management stated that it reports deficient test results to the Lottery’s Sales and Marketing Division’s management; however, the Sales and Marketing Division does not have procedures on how to handle ticket deficiencies. As the Lottery does not have documentation to support the steps taken to address the security test deficiencies, we could not determine the severity of the deficiencies, the Lottery’s conclusions and actions, remedial actions by the vendor, and whether compromised tickets were distributed to the public. Lack of adequate controls over Scratchers ticket deficiencies undermines the importance of the Lottery’s testing process and could result in the distribution of poor-quality or compromised tickets to the -11- California State Lottery Scratchers Ticket Distribution Process public, increasing the risk of fraud, contractual noncompliance, and potential damage to the Lottery’s reputation. Scratcher Security Testing Procedure dated September 4, 2012, states, in part: To determine the security and quality of Lottery Scratcher tickets, a series of laboratory tests are performed on sample tickets. Failure to successfully pass any one of the tests may cause the Scratcher game to be compromised. Compromised tickets may be rejected by the Lottery, and could at the Lottery's discretion, either be returned to the manufacturing vendor or refused delivery. All security test results are documented on a Scratcher Ticket Security Testing form and all tested samples are retained in the laboratory for reference. GC section 13402 states: Agency heads are responsible for the establishment and maintenance of a system or systems of internal control, and effective and objective ongoing monitoring of the internal controls within their state agencies. This responsibility includes documenting the system, communicating the system requirement to employees, and ensuring that the system is functioning as prescribed and is modified, as appropriate, for changes in conditions. GC section 13403 (a) states, in part: As used in this chapter, “internal control” means a process, including a continuous built-in component of operations, effected by a state agency's oversight body, management, and other personnel that provide reasonable assurance that the state agency's objectives will be achieved. Recommendation We recommend that the Lottery develop documented, entity-wide procedures for how it handles deficient Scratchers ticket security test results, including complete documentation of security testing conclusions, the severity of the deficient test results, and the actions taken to address them. Lottery’s Response The Lottery coordinates with its vendor partners in the planning, printing, and shipping of 1.1 billion tickets each year. As part of this process, it has developed a robust, multi-layer security review and assessment of its games to ensure integrity and accuracy, beginning with the security requirements expected from its vendors and continuing into the marketplace. While the Lottery disagrees with this finding that there were not adequate controls in place, it does agree with the recommendation that its existing processes and documentation will benefit from additional improvement. As noted in Finding 1, a cross-divisional process has been developed to formally document how the Lottery handles deficient Scratchers ticket test results. Tickets found to have a deficiency may vary in their implications and impact to a game. It may be an issue that does not -12- California State Lottery Scratchers Ticket Distribution Process impact the integrity of the game, such as faded ink, to more serious issues such as a malfunctioning bar code. SCO Comment The SCO supports the Lottery’s decision to improve existing processes and documentation. We met with management from the Sales and Marketing Division and SLED to gain an understanding of how Scratchers ticket deficiencies were addressed. During our discussions, we inquired about informal and formal processes for addressing ticket deficiencies; in those discussions, Lottery representatives never informed us of internal units categorizing Scratchers issues by levels of severity, or the existence of division policies or procedures directing staff to address ticket deficiencies. The Scratchers ticket process involves multiple units and divisions, and our conclusion was that there was neither a clear understanding nor documented procedures for addressing deficient test results with Lottery management or the vendor. There cannot be adequate control over processes when policies and procedures are informal, undocumented, and poorly understood. Our audit found that SLED agents document test results on the Worksheets and case management reports; and that when deficiencies are identified, there are no established processes in place to ensure that the deficiencies are addressed with management and the vendor when necessary. Based our testing of the Scratchers testing process, we could not determine the severity of the deficiencies identified by SLED. We were also unable to verify the Lottery’s conclusions and actions taken to address the deficiencies, remedial actions taken by the vendor, or whether compromised tickets had been distributed to the public. We understand that ticket deficiencies vary in their implications and impact on Lottery games; however, it is critical that the Lottery document the conclusions of its security testing, the severity of deficient test results, and the actions taken to address deficiencies in order to ensure that compromised tickets are not distributed to the public. FINDING 3— The Lottery did not consistently conduct security testing in accordance The Lottery did with its Scratchers Security Testing Procedures. SLED conducts security not comply with testing on Scratchers tickets to ensure that tickets cannot be compromised Scratchers in such a way that game data could be predetermined. We reviewed 260 Worksheets and 44 case management reports and determined that: Security Testing Procedures • 46 (55%) of 83 reordered Scratchers ticket games were not tested before distribution to the public; • 49 (35%) of 139 new Scratchers ticket games were not tested before the distribution date; • Nine (3%) of 260 tests were incomplete with no explanation for why specific tests were not conducted; -13- California State Lottery Scratchers Ticket Distribution Process • 40 (91%) of 44 case management reports were not approved within the three-day time requirement; and • Four (9%) of 44 case management reports did not match Worksheet results. In addition, we determined that the Scratchers Security Testing Procedures are incomplete, as they do not include all security tests conducted by SLED. According to the timeline requirements in the Scratchers Security Testing Procedures, it is imperative that ticket testing be conducted before the tickets are sold. Lack of compliance with Scratchers Security Testing Procedures could result in distribution of compromised tickets to the public, which potentially increases the risk of fraud and could negatively impact player goodwill and ticket sales. Scratchers Security Testing Procedures, dated September 4, 2012, states, in part: To determine the security and quality of Lottery Scratcher tickets, a series of laboratory tests are performed on sample tickets. Failure to successfully pass any one of the tests may cause the Scratcher game to be compromised. Compromised tickets may be rejected by the Lottery, and could at the Lottery's discretion, either be returned to the manufacturing vendor or refused delivery. All security test results are documented on a Scratcher Ticket Security Testing form and all tested samples are retained in the laboratory for reference. Scratchers Security Testing Procedures, dated September 4, 2012, Time Line Requirements states, in part: It is imperative for the ticket testing to be conducted before the ticket starts selling. If ticket testing results in any failed result, sufficient time is required to prevent the potentially flawed ticket from being sold. As a result, the following time line shall be followed: a) When SIGS [Special Investigations and Gaming Security Unit] receives the sign-off sheets and void packs of tickets from the vendor's printing press, the Analyst has two weeks (14 days) to complete the ticket testing for that game ticket. b) Any possible failed tests shall immediately be reported verbally to the Chief Lottery Agent of Administration that same day. c) After the ticket testing has been completed, the Analyst has one week (7 days) to complete the supplemental report and attach the ticket test results in the Case Management System. d) The SIGS Supervising Lottery Agent has three (3) business days to review and approve the Analyst's report, and verbally report any deficiencies to the Chief Lottery Agent of Administration. Recommendation We recommend that the Lottery’s Scratchers Security Testing Procedures include all security tests conducted by SLED. In addition, in order to uphold the quality and security of Scratchers tickets and reduce the risk of -14- California State Lottery Scratchers Ticket Distribution Process distributing compromised tickets to the public, we recommend that the Lottery adhere to its Scratchers Security Testing Procedures to ensure that: • New Scratchers ticket games are tested before the distribution process begins; • All reordered Scratchers ticket games are tested; • All Scratchers ticket security tests are complete and properly documented; and • Case management reports are adequately documented and approved within the timeline requirements. We reviewed Scratchers ticket-shipping documents, inventory received FINDING 4— reports, and inventory totals entered into the Inventory Management The Lottery System and determined that distribution centers lacked proper segregation lacked adequate of duties for Scratchers ticket inventory, lacked adequate procedures and controls over documentation for inventory adjustments and do not require management Scratchers ticket approval for inventory adjustments, and do not require dual custody when inventory at receiving Scratchers ticket shipments at the Northern Distribution Center. distribution centers During our audit, we determined that there were instances in which individual distribution center staff members had the ability to receive, record, and adjust Scratchers ticket inventory. We noted the following instances: • On August 12, 2016, the Warehouse Manager received Game 1233 Scratchers ticket inventory while also being the primary party responsible for recording and adjusting ticket inventory in the System. This example shows the manager’s ability to receive, record, and adjust ticket inventory. • On August 14, 2017, the Material and Stores Specialist adjusted Scratchers ticket inventory for Game 1242. The Material and Stores Specialist is primarily responsible for receiving Scratchers ticket inventory. This example shows the Specialist’s ability to receive, record, and adjust ticket inventory. Proper separation of duties prohibits the assignment of responsibility to one person for the receiving of assets, asset custody, and related record- keeping. For example, if one distribution center staff member is responsible for all three duties, he/she could state that he/she received the full shipment of Scratchers tickets, steal tickets, and adjust the inventory records so that the stolen boxes do not appear in the Inventory Management System for distribution. When duties are separated, fraud and theft are more difficult because multiple people must work together to complete the tasks. Currently the risks of fraud and theft are high, as the Lottery does not require documentation or management approval for inventory adjustments and does not require dual custody when receiving ticket shipments at the Northern Distribution Center. -15- California State Lottery Scratchers Ticket Distribution Process GC section 13402 states: Agency heads are responsible for the establishment and maintenance of a system or systems of internal control, and effective and objective ongoing monitoring of the internal controls within their state agencies. This responsibility includes documenting the system, communicating the system requirement to employees, and ensuring that the system is functioning as prescribed and is modified, as appropriate, for changes in conditions. GC section 13403 (a) states, in part: As used in this chapter, "internal control" means a process, including a continuous built-in component of operations, effected by a state agency's oversight body, management, and other personnel that provide reasonable assurance that the state agency's objectives will be achieved. Recommendation We recommend that the Lottery strengthen its controls over Scratchers ticket inventory at distribution centers, develop documented procedures for inventory adjustments that include adequate documentation and management oversight, and implement proper segregation of duties over Scratchers ticket inventory. -16- California State Lottery Scratchers Ticket Distribution Process Attachment— California State Lottery’s Response to Draft Audit Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 www.sco.ca.gov S18-LOT-0004