The operator shall establish and maintain documented internal controls governing its gaming operations, including related gaming and financial transactions.

The internal controls shall:

• Be formally documented
• Be kept current and reflect operational practices
• Be implemented in day-to-day operations
• Be consistently followed

The organisation should establish a formal process for resolving Interactive Gaming System malfunctions. Key steps should include:

• Determining the cause of the malfunction by reviewing relevant records, reports, logs,and surveillance footage.
• Repairing or replacing the affected critical component.
• Verifying the component's integrity before it is returned to operation.
• Documenting and filing a report with the regulatory body as required.
• Defining the criteria and procedure for voiding plays and payments if a full recovery cannot be achieved.

Maintain documented internal controls describing the risk management framework applicable to the Interactive Gaming System.

The documentation shall include:

• An overview of all software applications and system components forming the Interactive Gaming System
• A list and description of all game types offered by the operator
• A description of measures implemented to prevent and detect collusion in peer-to-peer games

The organisation should establish and document a process to prevent restricted individuals, such as employees and their household members, from playing games. The process should specify how these individuals are identified, how their information is maintained, and the method used to block their access to the gaming system.

The organisation should have a documented public policy which defines procedures for detecting and handling suspect accounts, compromised credentials and fraudulent player accounts.

The procedures should cover:

• monitoring account activity to identify potential fraud, stolen credentials or suspicious access
• enforcing authentication safeguards, including system administrator notification and user lockout or audit trail entry after a maximum of three incorrect authentication attempts
• implementing session timeouts or connection time limits for high-risk access, such as remote access
• flagging suspect accounts where credentials may have been stolen
• suspending, restricting or invalidating accounts involved in suspected fraud, compromise or unauthorised use
• transferring critical stored account information into a new account where needed
• handling deposits, wagers, winnings and remaining funds linked to fraudulent player accounts
• recording account decisions and actions for investigation, audit or regulatory review

The organisation should ensure that system recovery backups contain all data needed to fully restore the system after a catastrophic failure.

Backup content should include:

• all recorded information required to be maintained by the system, including gameplay, player account, transaction, jackpot, incentive, significant event and user access records
• site or venue specific configuration data, including security accounts and access settings
• current encryption keys, system parameters, configuration changes and other data needed to restore participating sites, venues and system operation