Why Wipfli?
Your tribal casino’s success is about more than today’s performance. It fuels essential tribal programs, creates employment opportunities and supports your community’s future.
Take your gaming enterprise further with an advisory partner who understands your unique operations and priorities.
With over 140 gaming clients, Wipfli’s tribal gaming professionals have first-hand experience in the leading practices and practical solutions that can help you elevate your profitability, compliance and efficiency. From diversifying revenue streams to modernizing technology and navigating evolving regulatory requirements, we provide proactive support to grow your business.
Wipfli’s casino audit services help gaming organizations maintain compliance while strengthening business performance. We work closely with your teams to help meet audit requirements and regulatory deadlines, navigate complex compliance demands and provide tailored insights to improve your profitability.
Access specialized support for gaming accounting services, IT, , HR and payroll without a challenging hiring process. We provide experienced professionals who can help you fill critical talent gaps and drive growth.
From renewable energy projects to facility improvements, Wipfli’s multidisciplinary team helps tribal gaming enterprises identify eligible costs, capture available tax incentives and improve project returns.
Whether you’re evaluating expansion opportunities, acquisitions or other strategic investments, Wipfli provides the insights and transaction support needed to assess risk and maximize long-term value.
Leverage technology as your competitive advantage with support from Wipfli’s tribal technology consulting services. From tailored ERP and budgeting solutions to on-prem cybersecurity, we help you implement the solutions and strategy necessary to transform performance.
Wipfli helps gaming organizations develop the leadership, operations and strategic plan they need to help ensure sustainable performance and profitability.
Protecting assets, maintaining compliance and managing operational risk require a proactive approach. Wipfli helps your organization strengthen controls and build resilience across casino operations.
Make informed investment decisions that support the long-term success of your gaming organization. Our advisory services can help your leadership balance risk and align investment strategies with future growth objectives.
Insights and resources
ARTICLE
AI governance for tribes: A guide for tribal leaders
Tribal leaders are increasingly integrating AI more deeply into their organizational operations. But leaders who don’t first establish AI governance expose their tribes to risks like data security issues, poor operational outcomes and financial losses. Keep reading to learn how AI governance helps tribes mitigate those risks, plus how to create an effective governance structure and AI policy to protect your tribe. Why do tribes need stronger AI governance? Without governance, tribes face the same risks as their non-tribal peers , like shadow AI, data privacy, bias or inaccurate outputs. But tribal leaders also carry the additional responsibility of navigating sovereignty issues and protecting tribal culture, as well as compliance challenges that are only likely to grow over time. Key AI risk management areas for tribes include: Sovereignty and culture: AI use could expose your tribe’s data, including member, cultural and historical data, to AI models without tribal consent, which risks not only member privacy but culturally disrespectful AI-produced content. Shadow AI: Unsanctioned AI use within tribal organizations can create issues with data privacy, costs and inaccurate information flowing up to leaders or your tribal council. Bias and poor output quality: AI trained on limited or inaccurate data may exhibit biases or output wrong answers, and even well-trained models still hallucinate. Cost overruns: As AI models increasingly move to usage-based pricing, it’s become possible to run up a large monthly AI bill without realizing it until it’s too late. Limited regulations: There is still no comprehensive federal AI law in the U.S., but states are enacting their own rules, and the EU AI Act is already in force, with obligations phasing in through 2027. Lack of ROI: AI initiatives that are poorly designed or implemented will cost money but lack impact (for example, a Gartner survey found 84% of finance organizations have implemented or plan to implement AI, but only 7% report high impact ). Many tribal organizations are also currently lagging behind the private sector in AI adoption, which, if not corrected, will make it harder to catch up. How does effective governance help tribes mitigate AI risks and improve outcomes? AI governance helps manage AI risks and improve outcomes by setting ground rules for how your tribal organizations use AI. Effective governance chooses AI tools, defines use cases and builds guardrails to protect your data and mitigate the risk of bad outcomes. Establishing governance typically starts with creating a governance team. Once formed, your governance team will choose AI governance pillars and create a formal AI policy that will help limit risky AI use and deliver better organizational results from your AI investments . AI governance should be an ongoing effort, with your governance team continuing to evaluate AI-related risks and opportunities. Guide your AI governance using policy pillars like these Before you can write your formal AI policy, you need to define key policy pillars. Each pillar covers a critical aspect of AI governance, including areas like fairness, reliability, privacy and vendor risk. Once you have a list of pillars, you can use it to help write your AI policy. Here are common policy pillars that may make sense for your tribe to build into your own AI policy: Fairness and bias management AI models can show bias towards individuals or groups based on certain characteristics like culture, ethnicity or gender. Assess how your AI tools are trained, as bias is especially likely for models that rely on smaller datasets. Reliability and validity With AI, input quality plays a major role in output quality. Evaluate whether you are giving your AI tools the clean, organized data they need, and regularly check AI outputs for errors. Sovereignty, privacy and security Sharing private tribal data with public AI models risks exposing that data to users outside your tribe. Set up controls to help ensure that tribal data is only shared with enterprise AI tools that are contractually bound to protect it. In vendor contracts, ask for explicit terms: No training on tribal data, no benchmarking and a full data export if you leave. Transparency and explainability Leaders should understand how AI models are being used within tribal entities. Conduct regular AI transparency and explainability reviews to make sure that’s the case. Accountability and oversight AI needs human oversight to manage risks, protect against bias and avoid damaging mistakes. Make sure your tribe has clear guardrails and defined oversight structures in place. As vendors embed AI agents directly into finance and ERP systems, govern each agent like an employee: Define what it can reach, who approved it and how to shut it off. Inclusiveness AI tools built on broad, diverse datasets are more likely to deliver outputs that reflect the broad range of human experience. This can help you not just avoid bias but actively promote inclusiveness. Legal and regulatory compliance Legal and regulatory compliance rules for AI are still in their infancy. However, tribes, specifically, should evaluate how AI could affect their existing compliance obligations and watch for future developments in this space. Vendor and third-party risk Your vendors are likely using AI too, which means that any tribal data you share with them could be at risk of being fed to public AI models . Regularly discuss this risk with your vendors and make sure they have their own responsible AI governance policies in place. Acceptable IP use AI outputs that draw on trademarked or copyrighted IP could create liability for your tribe. Be aware of this risk and train your employees to flag potential problem areas. Sustainability AI relies on resource-intensive, energy-hungry data centers to function. If your tribe has sustainability goals, you may want to restrict unnecessary AI use or buy carbon offsets. Again, this list is just a starting point. You may wish to include some or all of these pillars when writing your own AI policy, but you may also determine you need others not mentioned here. AI governance checklist: Follow these action steps to establish your tribe’s own AI governance process To establish an AI governance process for your tribe, you should create a governance team or working group. This group should define AI dos and don’ts, choose governance pillars and consider how AI will affect your tribe, its data and its operations. At that point, you can write your tribe’s formal AI policy. Here are key steps to follow when establishing AI governance: 1. Choose your AI governance team Establish a diverse group of tribal leaders, organizational managers and other stakeholders. This group should include a range of perspectives to help the group consider how AI affects your tribe, its businesses and its people. 2. Level set for AI knowledge Your whole governance team needs to have an active working knowledge of AI. Make sure everyone on the team understands the different types of AI, like agents or generative AI, key risks and how technology is evolving today. 3. Decide on AI dos and don’ts Define your AI dos and don’ts. This is essentially deciding how you want your tribal organizations to use AI, and what sort of usage is off-limits. For example, using an AI tool to help with grant writing or assist in conducting fraud checks may be a do, but delegating those tasks entirely to AI would be a don’t. 4. Select AI governance pillars that fit your needs Based on your do’s and don’ts, along with other considerations like compliance requirements or tribal culture, choose your AI governance policy pillars. Use the policy pillars list in the previous section as a starting point here and then adapt it to meet your tribe’s specific needs. 5. Collaborate with other stakeholders Your AI governance team needs to be able to make crucial governance decisions without getting bogged down, but it should also consult a wide range of stakeholders when possible. Open communication between your governance team, tribal leaders and employees within tribal entities will help ensure both more effective policies and stronger policy adoption. 6. Talk about any new oversight processes you may need Your governance team should create specific oversight processes for areas like AI monitoring or approving a new AI tool. These can then be included in your formal AI policy. 7. Clarify which AI tools are acceptable to use Clearly define which AI tools your tribal organizations are allowed to use. For example, you may want to state that tribal employees can only use enterprise AI tools your tribe has specifically contracted with, as those will protect your data. 8. Write your formal AI policy Turn your dos and don’ts, policy pillars, oversight ideas and acceptable tools list into a formal written AI policy. You can write your own policy from scratch, but you may also find it simpler to download a sample AI policy and adapt it to fit your needs. Read more AI for Tribes: Managing risk and maximizing impact AI ROI: How to get more business value from your AI spending AI risk management: Business strategy, governance and more
ARTICLE
7 cybersecurity tips for tribes and tribal organizations
Cybercrime continues to plague the U.S., and the problem is only accelerating. According to the 2025 FBI Internet Crime Report , there were 1,008,597 cybercrime complaints filed in the year. That is the biggest number on record. No industry or government body is safe from a cyberattack. This includes tribal governments and the businesses they operate, particularly casinos. In this environment, investing in cybersecurity isn’t an option. You shouldn’t be asking if you’ll be attacked, but rather when and if you’ll be ready. Keep reading to learn steps your tribe can take to bolster its cybersecurity posture. Why tribes must take cybersecurity seriously Nearly 90 tribes nationwide own and operate broadband networks . It’s common for critical infrastructure managed by tribes, such as water treatment facilities and healthcare centers, to be connected. Tribal businesses, such as casinos and resorts, also rely on the internet to deliver services and manage day-to-day operations. Add it all together and tribes have a large attack surface that bad actors can target. Tribes hold sensitive data of their members and customers that need to be protected. There’s also invaluable cultural heritage data that could be compromised in an attack. From critical services to members being disrupted to financial information being stolen, the consequences of a cyberattack could be disastrous for a tribe. A cybersecurity program that is regularly tested is a must for tribes to protect their communities. Why do cybercriminals target tribes? The reason tribes are targeted is simple: they run high-dollar businesses, manage critical infrastructure and possess sensitive data. The information or infrastructure that attackers could attempt to compromise includes: Financial data Tribal casinos, resorts and other businesses generate significant revenue. As a result, they hold large amounts of credit card numbers, bank routing information, gaming loyalty program data and more. Examples of attacks on tribal casinos include: Several Kewadin Casinos locations were forced to temporarily close following an attack. A ransomware attack impacted gaming operations and other tribal services for the Lower Sioux Indian Community . Tribal enrollment and membership records Tribes hold a significant amount of their members’ personally identifiable information (PII), including names, Social Security numbers, dates of birth, physical addresses and potentially even biometric data. Financial records linked to distributions, tribal housing assistance funds and more could also be compromised if your tribe is the victim of an attack. Healthcare records Many tribes manage independent medical centers via the Indian Health Service (IHS) or localized tribal health networks. As a result, they possess protected health information (PHI). In addition to the ethical need to protect their members’ health records, holding PHI means tribes must comply with HIPAA. Disruption of critical services Some cyberattacks are carried out simply to create chaos. Tribes provide a variety of essential services to their communities, and their disruption could upend day-to-day life. Services that are vulnerable to an attack include: Health centers Police, fire and emergency dispatch centers Emergency alerting systems Utilities, including water and power Social services such as housing and welfare programs Cultural heritage and language assets Hackers can also target a tribe’s digital archives. If successful, they can hold your cultural and historical files ransom. It took the Eastern Band of Cherokee Indians eight months to recover audio and video recordings of tribal members speaking their native language after they were stolen in a ransomware attack . Other valuable assets could include digital copies of sacred artifacts, geographic land boundaries, water rights documents and historical government treaties. What cybersecurity actions should tribes take? Here are seven ways tribes can mitigate cyber risks across their government and business operations: 1. Multi-factor authentication (MFA) MFA remains one of the most effective controls a tribe can deploy, but not all MFA is equal. SMS-based codes, in which an access code is texted to a cell phone, are now considered a weaker form of MFA due to SIM-swapping attacks, in which criminals convince a carrier to transfer your phone number to a device they control. Tribes should prioritize a phishing-resistant MFA, such as FIDO2 hardware security keys or authenticator apps that generate time-based codes. These methods help prevent the most common cyberattacks, including phishing, credential stuffing and adversary-in-the-middle (AiTM) attacks, a newer technique that attackers use to bypass traditional MFA by intercepting authentication sessions in real time. 2. Penetration testing Penetration testing simulates real-world attacks against your systems, applications and people. A pen test will expose vulnerabilities in your security that hackers may exploit. For example, the third-party firm you hire to perform penetration testing might create simulated phishing emails to look for insufficient updates and improper protection processes. 3. Real-time detection If you’re only relying on traditional endpoint protection tools (e.g., firewalls and antivirus software), security attacks and data breaches may go undetected for weeks or months. These are reactive security measures developed to counter known security threats. Two technologies now define the current standard for proactive threat detection: Security information and event management (SIEM) collects and aggregates log data from across your environment, networks, endpoints, applications, identity systems and cloud platforms and correlates that data in real time to surface suspicious patterns. Unlike a firewall that only sees what crosses its perimeter, a SIEM sees across your entire operation simultaneously. For a tribal organization running a casino, a health center, a broadband network and a government services portal, that breadth of visibility is critical. A SIEM might flag that the same user account logged in from two geographic locations within minutes, that a privileged account accessed an unusual volume of enrollment records overnight or that outbound traffic is communicating with a known malicious IP address. Managed detection and response (MDR) pairs that technology with human security analysts operating around the clock. MDR platforms use extended detection and response (XDR) capabilities to correlate signals across endpoints, networks, cloud environments and identity systems. Trained analysts investigate alerts, separate genuine threats from false positives and take containment action when needed. AI-driven behavioral analysis has become central to this discipline, enabling faster detection of multi-stage attacks that automated rules alone would miss. Used together, SIEM and MDR close the visibility and response gaps left by legacy tools. For tribes that cannot hire a full security staff, outsourcing MDR to a specialized provider delivers 24/7 coverage without the operational overhead. While the SIEM ensures analysts have the full environment data they need to act quickly and decisively. 4. Patches and updates Hackers know how to exploit vulnerabilities in systems, applications and processes. Patches and updates fix code defects and close these vulnerabilities. Make sure a member of your IT team is monitoring software and frequently pushing updates and patches. 5. Cybersecurity insurance When assessing your insurance needs, make sure to consider obtaining cybersecurity insurance. Appropriate coverage helps prevent your tribe from being left in a vulnerable security posture with much to lose. 6. Backup and recovery Ransomware attacks are increasingly looking for backup files to encrypt so they can prevent access to any data until the ransom is paid. Your tribes should have a data backup recovery process in place that includes air-gapped, immutable data protection. These are offline copies of data, which makes them secure, recoverable and unable to be altered or changed. By keeping an archive of immutable backups, you can recover from a ransomware attack much easier and faster — without having to pay the ransom. 7. Cybersecurity training Employees remain a primary target in cyberattacks, and the attacks they face are becoming more sophisticated. AI-generated phishing emails are now grammatically flawless, personalized and increasingly indistinguishable from legitimate communications. Deepfake audio and video are being used in vishing (voice phishing) attacks, in which criminals impersonate executives or vendors to obtain authorization for fraudulent wire transfers or credential resets. A modern security awareness program needs to include: Simulated phishing campaigns: Regularly send realistic test phishing emails to employees and use failures as teaching moments rather than punitive ones. Role-based training: Tailor training to specific departments. Finance staff need training on wire fraud and business email compromise. HR staff need training on W-2 and direct deposit scams. IT staff need training specific to their elevated access privileges. Insider threat awareness: Not all threats are external; employees need to understand access control principles and report unusual activity. Frequent updates: Training content must evolve as threats evolve. New employees must be trained before they have access to tribal systems, not weeks after onboarding. Cybersecurity for tribes FAQs Here are answers to some frequent asked questions about cybersecurity for tribes: Why are tribal governments targeted by cyberattacks? Tribal governments are high-value targets because they combine the financial assets of a business with the sensitive data holdings of a government entity. Tribal casinos and resorts generate significant revenue and process large volumes of credit card transactions, gaming loyalty data and financial records that are attractive to financially motivated attackers. At the same time, tribes hold personally identifiable information (PII) on their members and protected health information (PHI) through tribal health centers. Tribes also operate critical infrastructure, including broadband networks, water utilities and emergency services that hackers may target to cause disruption. The scale of that attack surface, often managed with lean IT and security resources, makes tribal governments a frequent and deliberate target. How often should tribes conduct cybersecurity assessments? At a minimum, tribes should conduct a comprehensive cybersecurity risk assessment annually, but the threat environment has evolved to the point where annual reviews alone are not sufficient. Penetration tests should be performed at least once a year, with targeted retesting any time a significant system change, new technology deployment or major business expansion occurs. Ongoing attack surface management and continuous vulnerability scanning should run between formal assessments to catch newly discovered exposures before attackers do. Tribes that operate casinos, health centers or broadband networks, each of which carries its own regulatory and compliance obligations, may need assessments on a more frequent cycle to remain in good standing with applicable requirements. Think of cybersecurity assessment not as a calendar event but as a continuous process with periodic formal checkpoints. What is the biggest cybersecurity risk for tribal organizations today? The single greatest cybersecurity risk facing tribal organizations today is human error. Specifically, the success rate of phishing and social engineering attacks as an initial entry point into tribal systems. Attackers no longer need to find a technical vulnerability when a convincing email, text message or AI-generated voice call can trick an employee into handing over credentials or directly authorizing a fraudulent transaction. Once inside, attackers move laterally across connected systems, often going undetected for weeks. The growing use of generative AI by threat actors has made phishing messages harder to identify, removing the spelling errors and awkward phrasing that employees were historically trained to spot. Addressing this risk requires a combination of phishing-resistant MFA, continuous security awareness training and robust detection capabilities that can identify suspicious behavior even after credentials have been compromised. How can tribes prepare for ransomware attacks? Preparing for ransomware requires a layered strategy that addresses prevention, detection and recovery. On the prevention side, tribes should enforce phishing-resistant MFA on all accounts, maintain a disciplined patch management program and limit user access privileges so that a compromised account cannot move freely across systems. For detection, managed detection and response (MDR) combined with a SIEM gives security teams the visibility to identify ransomware staging activity, such as large-scale file enumeration or backup deletion, before encryption begins. Recovery preparedness centers on maintaining tested, air-gapped and immutable backups, so that data can be restored without paying a ransom. Equally important is a documented incident response plan that has been rehearsed through tabletop exercises, ensuring tribal leadership, IT staff, legal counsel and communications teams each know their role the moment an attack is confirmed. Read more AI for tribes: Managing risk and maximizing impact How GASB 103 and GASB 104 will impact tribal governments Your tribal organization just implemented a new ERP. How do you maximize the success of your investment?
ARTICLE
Title 31/AML compliance checklist for tribal casinos | Wipfli
Title 31/AML compliance needs to be a priority for tribal casinos. To help, Wipfli compiled a Title 31 compliance checklist.
Reach out to our team
Let’s talk about how Wipfli’s tribal gaming consulting can help you meet your objectives for diversification and growth.
LET'S CONNECT
Wipfli is ready to help you balance today’s challenges with the priorities that will shape your tribe’s future.
