Legislative audit finds Minnesota State Lottery lacks adequate internal controls and inconsistent retailer background checks

The Office of the Legislative Auditor (OLA) told the Minnesota House State Government Finance Committee on Jan. 16, 2025 that its November performance audit of the Minnesota State Lottery found weaknesses in both IT controls and retail oversight that increase risk to the lottery's gaming operations.

"We found the lottery generally did not have adequate internal controls," Lori Lisen, deputy legislative auditor for the financial audit division, told the committee. The audit reviewed lottery operations and IT from July 1, 2021 through Dec. 31, 2023 and combined non-IT and IT testing to examine core gaming systems, retailer controls and prior audit-findings status.

Lisen said the audit identified three principal IT weaknesses: the lottery had not performed annual reviews of all system access as required by its policies; key IT administrators lacked adequate separation of duties; and the lottery had not fully documented, approved or tested incident-response and disaster-recovery procedures. Regarding access controls, Lisen said lottery staff currently hold broad administrative privileges across monitoring systems and servers, increasing the risk of a compromised account or damaging insider activity.

On incident response, the OLA found the lottery's plan had not been approved by executive leadership and had not been exercised through detailed training scenarios. The auditors recommended the lottery document response roles and likely impacts, conduct post-incident reviews and perform regular testing and training.

The audit also flagged retailer controls. The lottery had moved from nationwide background checks (performed previously by the Department of Public Safety) to searches of public records only after DPS stopped running checks in 2023 because retailers had not provided consent forms. The OLA concluded that the lottery's current process can miss out-of-state convictions and therefore may not ensure compliance with statutory disqualifications that bar retailers with certain convictions within the previous five years.

Lisen further reported that the lottery allowed retailers with expired contracts to continue selling tickets, in contravention of statutes requiring signed contracts and prohibiting persons other than licensed retailers from selling tickets. The auditors found contract renewals were not consistently enforced and recommended the lottery prevent retailers with expired contracts from operating and implement controls to ensure timely renewals.

The OLA's non-IT work also included an employee survey: 126 of 146 permanent lottery staff responded (86%). The audit found substantial concerns about executive leadership's responsiveness and workplace culture: significant shares of respondents said executive leadership did not value employee input and that human resources and executive leadership did not respond appropriately to informal concerns. By contrast, respondents generally expressed greater satisfaction with direct supervisors.

Representative Jim Joy, who has retail experience, told the committee the findings on expired contracts and background checks were concerning for retailers and for lottery integrity. Representative John Kosnick noted the audit scope and the large dollar amount the lottery transfers to state accounts; the lottery's executive director reported returning nearly $200 million to state services in the prior year.

The committee chair, Jim Nash, told members OLA had invited lottery officials to attend the hearing but that the lottery declined; staff said a written response from the lottery was expected. The auditors told the committee they will protect nonpublic information used in their review and that the MUSL (Multi-State Lottery Association) compliance process and NIST guidance were used as reference points for required controls.

The OLA does not have enforcement authority; it issues findings and recommendations for agencies and provides the legislature with oversight information. Committee members expressed interest in follow-up, including technical details about whether the lottery can remotely suspend retailer terminals and about vendor risk management for third-party providers that support gaming infrastructure.

The auditors recommended the lottery: perform annual access reviews and enforce separation of duties; document and test incident-response and disaster recovery plans; restore or otherwise ensure nationwide background checks to identify disqualifying convictions; and stop retailers with expired contracts from selling tickets until contracts are renewed.