Lottery audits are the layered reviews that verify a state lottery is running honestly, securely, and within the law. Three separate sets of auditors typically work on the same organization: an internal audit team inside the lottery, an independent CPA firm hired for the annual financial statement audit, and a governmental auditor or legislative committee that runs performance reviews. Together they examine drawings, security systems, vendor contracts, retailer sales, prize payouts, tax withholding, and the transfer of net proceeds to the programs the legislature said the money would fund.
Who Conducts the Audits
The first layer sits inside the lottery. An internal audit department runs continuous reviews of daily operations and flags security lapses, procedural shortcuts, and financial irregularities before they harden into systemic problems. Internal auditors know the workflows intimately, which makes them well placed to notice when a process quietly drifts away from the written policy.
The second layer is an independent certified public accounting firm hired to perform the annual financial statement audit. External auditors confirm that reported revenue, expenses, and fund transfers are free of material misstatement. Their independence is the entire point; they have no stake in making the numbers look good.
The third layer is governmental. State auditors, comptrollers, or legislative audit committees conduct performance audits that go beyond whether the books balance. They ask whether the lottery is running efficiently, spending resources wisely, and following every requirement the legislature imposed when it created the agency. When a legislative audit committee orders a performance review, the resulting report is typically a public record, giving lawmakers and voters a direct look at how the lottery is being managed.
Operations, Security, and Vendor Controls
Operational compliance is the foundation of any lottery audit. Auditors verify that every procedure, from ticket printing to prize payouts, follows the state’s authorizing legislation and regulatory code. A deviation triggers a formal finding, and the lottery has to address it through a corrective action plan with specific deadlines.
Physical and digital security get equal scrutiny. On the physical side, auditors examine how ticket stock is stored and tracked, how cash moves from retailers back to the lottery, and who can enter the data centers running the gaming systems. On the digital side, the review covers network security, access controls, encryption, and data backup. The World Lottery Association’s Security Control Standard, currently in its 2024 edition, is the industry’s international benchmark. It combines ISO/IEC 27001 information security requirements with 62 gaming-specific controls and additional controls covering system development and multijurisdictional games.1World Lotteries Association. WLA-SCS:2024 WLA Security Control Standard
Vendor management gets close attention too, especially for the technology companies that run point-of-sale terminals and central gaming infrastructure. Auditors review contract terms, performance metrics, and whether vendor access to sensitive systems is properly restricted.
Drawings and Multistate Games
The drawing is where public confidence lives or dies, so it attracts the most intense audit attention. Auditors verify random number generators and mechanical drawing equipment through independent laboratory testing that confirms statistical randomness and checks for tampering. A chain-of-custody review tracks every physical component, from the balls and mechanical equipment to the security seals, and confirms that only authorized personnel handled them from storage to drawing to post-event lockup.
During the drawing itself, controls include multiple independent witnesses, continuous video recording, and strict access restrictions on the drawing room. These are audit checkpoints, not optional practices. Any gap in documentation or deviation from protocol becomes a formal finding.
Multistate games like Powerball and Mega Millions add another layer. The Multi-State Lottery Association requires each participating lottery to run two systems in parallel: a computer gaming system and an independent internal control system. Every day’s transactions must be collected, processed, and balanced on the control system and compared against the gaming system’s records. On drawing days the rules tighten. Any imbalance has to be reported to MUSL’s Drawing Manager at least 30 minutes before the scheduled draw, and if the imbalance threatens the game’s security the drawing is delayed until it is resolved or both systems are locked down.2Multi-State Lottery Association. Multi-State Lottery Association Rules and Powerball Group Rules
Winner Payouts and Tax Withholding
After a drawing, the audit trail follows every large prize from the winning ticket through verification, tax withholding, and final payout. Officials validate the claimed ticket against the central gaming system’s data record, checking for anomalies or signs of alteration, and screen winners against internal exclusion lists and security databases to catch fraud, identity theft, or insider activity.
Federal and State Withholding
Tax compliance is a significant piece of the audit. For 2026, the IRS has inflation-adjusted the minimum reporting threshold for Form W-2G to $2,000.3Internal Revenue Service. Instructions for Forms W-2G and 5754 Mandatory federal withholding kicks in at a higher threshold. When net proceeds from a state-conducted lottery exceed $5,000, the lottery must withhold federal income tax at 24% before paying the winner, and the full amount of the winnings is subject to withholding, not just the portion above $5,000.4eCFR. 26 CFR 31.3402(q)-1 – Extension of Withholding to Certain Gambling Winnings Auditors confirm that these withholdings are calculated correctly and remitted to the IRS, because errors create tax liability for both the winner and the lottery.
Most states also impose their own withholding on lottery winnings, with rates that vary widely, and a handful impose none at all. Auditors verify that the correct state rate is applied alongside the federal withholding.
Debt Offsets and Unclaimed Prizes
Before a large prize reaches the winner, the lottery has to check whether that person owes qualifying debts to the government. Unpaid child support, delinquent taxes, and other obligations can trigger an intercept that diverts part or all of the prize. Auditors review whether the lottery is running those checks and calculating offsets correctly, because failing to intercept a legally required payment creates liability for the agency.
Prize claim deadlines are another audit item. Every state sets a deadline for winners to claim, typically between 180 days and one year. Forfeited funds usually flow back into the lottery fund and are redirected to designated public programs or returned to the prize pool. Auditors confirm that these transfers happen on schedule and in the correct amounts.
Winner Disclosure
About half of states now allow lottery winners to remain anonymous, either fully or above certain prize thresholds, while the rest treat winner information as public record. The audit checks that the agency’s disclosure procedures match the current statutory requirements, which have been changing frequently as more states pass anonymity protections.
Money In, Money Out
The financial audit confirms that every dollar flowing through the lottery is accounted for, from ticket sales to final distribution.
Revenue verification starts at the retail level. Auditors confirm that ticket sales recorded by retailer terminals are captured and reconciled with the central gaming system. With thousands of retail locations generating transactions daily, small discrepancies can signal skimming, underreporting, or system errors that compound over time.
On the expense side, auditors examine administrative costs, marketing spending, and retailer compensation. Lottery retailers earn a commission on every ticket sold, and across all U.S. lotteries, retailer commissions and incentives averaged 6.2% of sales in fiscal year 2024, with individual rates typically between 5% and 8%.5NASPL. FAQ Auditors verify that these payments follow each state’s retailer contracts. Excessive administrative overhead or questionable marketing spending gets flagged for the governmental oversight body.
The final financial checkpoint is confirming that net proceeds reach their legally mandated destination. Every state’s authorizing legislation specifies where lottery profits must go after prizes and operating costs. Education is the most common beneficiary, with some states directing 30% or more of total lottery revenue to public school funding, though the specific programs and percentages vary widely. Auditors trace the actual fund transfers against the statutory requirements to confirm that the right amounts reached the right accounts on time.
Responsible Gaming Checks
Lottery audits increasingly extend to responsible gaming practices. The World Lottery Association operates a four-level certification framework that evaluates how seriously a lottery takes problem gambling prevention. At the entry level, a lottery commits to responsible gaming principles. At the highest level, it must show that specific programs are embedded in daily operations and continuously improving.6World Lotteries Association. The WLA Responsible Gaming Framework and Certification
The certification covers ten program areas, including employee training, retailer education, game design safeguards, advertising standards, player education, treatment referrals, and research into gambling behavior. Lotteries seeking certification must back up their claims with data and documentation rather than generic policy statements, and the WLA requires that submissions reflect actual practices and show measurable progress over time.6World Lotteries Association. The WLA Responsible Gaming Framework and Certification Those records give auditors a structured baseline to review a lottery against.
Where to Find the Results
Most state lotteries publish their annual financial audit reports and make performance audit results available, either on the lottery’s own website or through the state auditor’s office. When a report isn’t published proactively, you can typically request it through your state’s public records or freedom of information process. Many state gaming commissions also publish operational datasets on open data portals, offering sales figures, prize data, and other performance metrics without a formal request.
Availability is itself an audit checkpoint. Governmental oversight bodies evaluate whether the lottery is meeting its transparency obligations, and an agency that makes its audit results hard to find or request can expect that to show up in the next performance review.