Robert Rudloff (rrudloff@gmresorts.com) was interviewed in March 2018 by Gerry Zack (gerry.zack@corporatecompliance.org), Incoming CEO of SCCE & HCCA, based in Minneapolis, MN.
Robert Rudloff, Senior Vice President of Internal Audit, MGM Resorts International, Las Vegas, Nevada
GZ: Thanks for taking the time to be interviewed for our readers. Let’s start by having you tell us a bit about your background and your role at MGM.
RR: I was born and raised in New Jersey, the oldest of four. My father was a letter carrier, and my mother was a stay-at-home mom until becoming a teacher when I was 13. In 1980, I earned undergraduate degrees — one in accounting and one in art — from Castleton University in Vermont. After a summer at a local accounting firm, I started my internal auditing career in the casino gaming industry at Harrah’s in Atlantic City. In 1986, I moved to the Trump Organization as Director of Internal Audit for Trump Plaza Hotel and Casino, later moved to Trump Taj Mahal in the same capacity, and then was promoted to Corporate Director of Internal Audit for all of the Trump casinos.
In 1988, I moved to Las Vegas, where I joined PricewaterhouseCoopers as a Director of Internal Audit Services. I served clients in the gaming industry as well as in other industries, but I never gave up my gaming roots. In 2003, I joined MGM Resorts International (then known as MGM MIRAGE) as Vice President, Internal Audit, when the company was dealing with a significant compliance crisis. I was later promoted to Senior Vice President, Internal Audit, as both the company and the internal audit team continued to grow. We now stand at 100 professionals on the internal auditing team.
GZ: The gaming business is heavily regulated and has some very strict compliance requirements. In fact, it may be one of the more heavily regulated industries. Can you give a brief overview of the regulatory framework you operate under and some of the key risk areas?
RR: First and foremost, we are governed by the gaming regulatory agencies in each state where we operate: Nevada, New Jersey, Maryland, Michigan, Mississippi, Illinois, and Massachusetts (where we will open a casino later this year). Each state has its own regulatory scheme, which are largely similar from state to state, but each has their own nuances that we, as internal auditors, must understand in depth. In each state, the regulators not only mandate that an internal auditing function be present, but also dictate which audits (at a minimum) must be performed each year. On top of that, casinos are deemed to be “financial institutions” and are required to comply with federal currency transaction reporting and suspicious activity reporting regulations.
Our biggest risk is regulatory non-compliance, because our privileged licenses could be at risk for repeated or severe violations, or we could be subject to substantial financial penalties for flaws in our anti-money-laundering programs. Moreover, if we were to have compliance failures in one gaming jurisdiction, it could put the company under increased scrutiny in another. On top of our domestic regulatory frameworks, we are also subject to a separate regulatory oversight in Macau, where we now operate two major casino properties. Although this type of regulatory oversight may be unique to gaming, we also have the other regulatory risks most global publicly traded companies face: Sarbanes-Oxley (SOX) compliance, anti-corruption compliance, environmental compliance, and so on.
GZ: Can you describe the relationship between the Compliance and Internal Audit functions at MGM? In what ways do the two departments interact?
