Explorer

The issuer used several IT systems to initiate process and/or record transactions related to one type of revenue and the related accounts receivable. In its testing of controls over these accounts the firm tested various IT-dependent manual controls that used data and reports generated or maintained by these IT systems. As a result of the deficiencies in the firm's testing of ITGCs the firm's testing of these IT-dependent manual controls was not sufficient. (AS 2201.46)

The firm identified significant deficiencies in ITGCs for two of the issuer's IT systems related to individuals having inappropriate access to these systems. The firm identified and tested various compensating controls that it believed would mitigate these deficiencies. In performing its testing of the identified compensating controls the firm did not identify that the control owners used data and reports in the performance of these controls that were produced by the systems that were subject to these ITGC deficiencies. (AS 2201.68)

For one business unit the issuer recognized several types of revenue. The following deficiencies were identified: · For one type of revenue the firm selected for testing various automated controls over the processing of certain orders through the issuer's IT systems. The firm's testing of each of these automated controls using a sample of only one instance of the control's operation was not sufficient because the firm did not test whether changes to configurations within these controls were subject to effective ITGCs over these IT systems. (AS 2201.46)

The issuer's main information technology ('IT') application processed financial transactions and maintained related data. The firm selected for testing IT general controls ('ITGCs') that consisted of controls over access and change management. The firm did not test administrator access to the database and the operating system supporting this application. (AS 2201.42 and .44)

The issuer's main information technology ('IT') application processed financial transactions and maintained related data. The firm selected for testing IT general controls ('ITGCs') that consisted of controls over access and change management. The firm did not identify and test any controls that addressed the risk of developers migrating changes to production without proper approval and testing. (AS 2201.39)

The firm selected for testing certain IT-dependent controls. The firm did not identify and test any controls over the accuracy and completeness of data used in the operation of these controls. (AS 2201.39)

The firm selected for testing three controls that consisted of the configuration of the application to (1) only allow key fields to be populated with certain data (2) sequentially assign sales order customer invoice and cash receipt numbers and (3) not allow customer invoices and journal entries to be posted when the accounting period is closed. The firm did not sufficiently test the configuration of the application because it did not test the operation of the control over all types of revenue transactions that occurred during the year. Further the sample sizes the firm used to test these controls were too small due to the deficiencies in the firm's testing of access and change management controls described above. (AS 2201.42 .44 and .46)

The firm relied on certain information technology general controls (ITGCs) in its substantive approach to testing revenue and accounts receivable. The following deficiencies were identified: · The firm selected for testing a control over change management but did not perform procedures to determine whether the population of changes from which it made its selections for testing represented the complete population of changes made to this system. (AS 1105.10)

The firm relied on certain information technology general controls (ITGCs) in its substantive approach to testing revenue and accounts receivable. The following deficiencies were identified: · The firm selected for testing certain IT application controls and IT-dependent manual controls over revenue and accounts receivable. The firm's approach to testing these controls depended on effective ITGCs including controls over change management. As a result of the deficiency in the firm's testing of the control discussed above the firm's testing of these IT application controls and IT-dependent manual controls was not sufficient. (AS 2301.18)

The firm relied on certain information technology general controls (ITGCs) in its substantive approach to testing revenue and accounts receivable. The following deficiencies were identified: · As a result of the firm's control testing deficiencies the sample sizes the firm used in certain of its substantive procedures to test revenue and accounts receivable were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The issuer used seven information-technology (IT) systems to initiate process and record transactions related to certain revenue and the related accounts receivable and deferred revenue. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. As a result of the following deficiencies in the firm's testing of IT general controls (ITGCs) the firm's testing of these automated and IT-dependent controls was not sufficient. (AS 2201.46)

With respect to change management: The firm selected for testing a change management control over all seven IT systems that consisted of the documentation testing and approval of changes prior to their implementation into production and all changes made in the production environment were to be recorded in a ticketing system. The following deficiency was identified: · For one IT system the firm did not evaluate the effect of the issuer's exclusion of a known change to a system report that did not have a ticket on the firm's conclusions regarding the design and operating effectiveness of this control. (AS 2201.48)

With respect to change management: The firm selected for testing a change management control over all seven IT systems that consisted of the documentation testing and approval of changes prior to their implementation into production and all changes made in the production environment were to be recorded in a ticketing system. The following deficiency was identified: · For all seven IT systems the firm did not perform sufficient procedures to test the completeness of the population of changes from which it made its selections because for a seven-month interim period the firm obtained tickets for a sample of changes from certain IT systems but did not verify that they were included in the population and the firm did not perform any procedures to test completeness of the population subsequent to the interim period. Further the firm did not (1) sufficiently evaluate a known change that did not have a ticket and whether other changes could have been made without a ticket and (2) evaluate another known change to a report that had a ticket but was excluded from the population. (AS 1105.10; AS 2810.03)

As a result of the firm's ITGC testing deficiencies discussed above the firm did not perform sufficient substantive procedures as follows: · The sample sizes the firm used in certain of its substantive procedures to test the existence and valuation of certain accounts receivable were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

As a result of the firm's ITGC testing deficiencies discussed above the firm did not perform sufficient substantive procedures as follows: · The firm did not perform any substantive procedures to test or as discussed above with respect to change management sufficiently test controls over the accuracy and completeness of certain system-generated data or reports the firm used to substantively test certain deferred revenue. (AS 1105.10)

The issuer used an information-technology (IT) system to initiate process and record transactions related to certain revenue accounts receivable and inventory. In its testing over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by the IT system. As a result of the following deficiencies in the firm's testing of IT general controls (ITGCs) the firm's testing of these automated and IT-dependent controls was not sufficient. (AS 2201.46)

The issuer used an information-technology (IT) system to initiate process and record transactions related to certain revenue accounts receivable and inventory. In its testing over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by the IT system. With respect to change management: - The firm selected for testing certain change management controls that consisted of (1) testing of changes in a test environment and (2) approval of these changes prior to their implementation into the production environment. The firm did not evaluate the procedures that the control owners performed to evaluate the appropriateness of certain types of changes made to the IT system or otherwise identify and test other controls to address the change management risks. (AS 2201.42 and .44)

The issuer used an information-technology (IT) system to initiate process and record transactions related to certain revenue accounts receivable and inventory. In its testing over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by the IT system. With respect to change management: - The issuer's IT personnel processed certain changes directly into the production environment of the IT system. The firm did not identify and test any controls over these direct changes. (AS 2201.39)

The issuer used an information-technology (IT) system to initiate process and record transactions related to certain revenue accounts receivable and inventory. In its testing over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by the IT system. With respect to change management: - The firm's testing of certain automated controls over customer orders was not sufficient because the firm did not test changes made into the production environment of the IT system for those controls after the date of testing. (AS 2201.44)

For revenue and accounts receivable which were affected by the audit deficiencies related to change management the following additional deficiencies were identified: - The issuer recognized certain revenue net of chargeback and rebate accruals. The chargeback and rebate accruals were based on inventory quantity and claims data transmitted from certain of the issuer's customers to its IT system through an electronic data interface (EDI). In its testing of controls over chargeback and rebate accruals the firm tested certain automated controls and IT-dependent manual controls that used this EDI data. The firm did not identify and test any controls over the accuracy and completeness of the inventory information received through EDI that was used in the operation of the controls. (AS 2201.39)

For revenue and accounts receivable which were affected by the audit deficiencies related to change management the following additional deficiencies were identified: - The issuer recognized certain revenue net of chargeback and rebate accruals. The chargeback and rebate accruals were based on inventory quantity and claims data transmitted from certain of the issuer's customers to its IT system through an electronic data interface (EDI). In its testing of controls over chargeback and rebate accruals the firm tested certain automated controls and IT-dependent manual controls that used this EDI data. The firm used a 'test of one' approach to test an automated control over the claims data but did not perform testing of ITGCs over the EDI to allow for the use of such an approach. (AS 2201.42 and .44)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. As a result of the following deficiencies in the firm's testing of ITGCs over certain of these IT systems the firm's testing of these automated and IT-dependent controls was not sufficient. (AS 2201.46)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: The firm performed a review of the security settings in place over the issuer's accounting system using an unapproved custom software audit tool that included tests of privileged access password settings and client production settings. The firm identified certain exceptions involving the segregation of duties of two users who had administrator access to the system which enabled them to migrate changes into production. The firm also identified that the system's production environment had been opened multiple times during the year by these two users. The following deficiency was identified: · The firm did not determine the effect of the exception identified on the operating effectiveness of the user access controls over the system. (AS 2201.48)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: The firm performed a review of the security settings in place over the issuer's accounting system using an unapproved custom software audit tool that included tests of privileged access password settings and client production settings. The firm identified certain exceptions involving the segregation of duties of two users who had administrator access to the system which enabled them to migrate changes into production. The firm also identified that the system's production environment had been opened multiple times during the year by these two users. The following deficiency was identified: · The firm did not identify and test any controls over the appropriateness of the activity that the two privileged access users performed when opening the system's production environment. (AS 2201.39)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: The firm performed a review of the security settings in place over the issuer's accounting system using an unapproved custom software audit tool that included tests of privileged access password settings and client production settings. The firm identified certain exceptions involving the segregation of duties of two users who had administrator access to the system which enabled them to migrate changes into production. The firm also identified that the system's production environment had been opened multiple times during the year by these two users. The following deficiency was identified: · The firm did not perform any procedures to evaluate the reliability of the information produced from the custom software audit tool that was used to test the security settings of this system. (AS 1105.04 and .06)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: The firm selected for testing controls over the assignment of privileged access rights to certain other IT systems that consisted of management's review and approval of privileged access requests. The following deficiency was identified: · The firm did not identify and test any controls over the accuracy and completeness of the reports used in the operation of these controls. (AS 2201.39)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to change management: The firm selected for testing change management controls over certain IT systems that consisted of (1) the authorization of changes prior to development (2) testing and approval of changes prior to their migration into production and (3) the establishment of segregation of duties and the restriction of users with the ability to develop and migrate changes to production to authorized personnel. The firm did not perform procedures to test or test any controls over the completeness of the population of changes from which it made its selections for testing. (AS 1105.10)

The issuer initiated and processed transactions related to sales accounts receivable and inventory at numerous business units using various IT systems. With respect to controls for these business units the firm selected for testing two entity-level controls that used information generated by the IT systems. The firm did not test IT general controls (“ITGCs”) over the IT systems for these business units or test any other controls over the accuracy and completeness of the information that was generated by the systems and that the issuer used in the performance of the entity-level controls. (AS 2201.39)

The issuer used various IT systems to initiate process and record transactions related to certain revenue and accounts receivable. The following deficiencies were identified: · The firm tested certain automated and IT-dependent manual controls that used data from these IT systems. As a result of the deficiency in the firm's testing of IT general controls discussed above the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

The issuer used an IT system to initiate process and record transactions related to certain revenue accounts receivable and inventory. The firm selected for testing various automated controls related to this revenue accounts receivable and inventory. The following deficiencies were identified: · The firm's testing of certain other automated controls using a sample of only one instance of the control's operation was not sufficient because the firm did not test whether changes to configurations within these controls were subject to the issuer's change management controls. (AS 2201.44)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to two types of revenue and the related accounts receivable deferred revenue related to one of these types of revenue and/or investment securities. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. As a result of deficiencies in the firm's testing of IT general controls (ITGCs) the firm's testing of these automated and IT-dependent controls was not sufficient. (AS 2201.46)

For one type of revenue and the related deferred revenue which were affected by the audit deficiencies the following deficiencies related to the firm's testing of controls were identified: · The firm selected for testing certain IT-dependent manual controls but did not identify and test any controls over the accuracy and completeness of certain data or reports that the control owners used in the operations of these controls. (AS 2201.39)

For one type of revenue and the related deferred revenue which were affected by the audit deficiencies the following deficiencies related to the firm's testing of controls were identified: · The firm's testing of certain other IT-dependent manual controls was not sufficient because it did not sufficiently test the queries or programming the issuer used to generate certain data or reports that the control owners used in the operations of these controls. (AS 2201.42 and .44)

For one type of revenue and the related deferred revenue which were affected by the audit deficiencies the following deficiencies related to the firm's testing of controls were identified: · For certain other IT-dependent manual controls the firm tested the accuracy and completeness of certain reports used in the operation of these controls in the issuer's IT testing environment rather than in the production environment. The firm's testing was not sufficient because the firm did not perform procedures to determine whether the testing environment was consistent with the production environment. (AS 2201.44)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to two types of revenue and the related accounts receivable deferred revenue related to one of these types of revenue and/or investment securities. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. With respect to change management: · For one IT system the firm selected for testing controls over managing changes to the production environment. The firm did not identify and test any controls over the accuracy and completeness of certain access logs used in the operation of these controls. (AS 2201.39)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to two types of revenue and the related accounts receivable deferred revenue related to one of these types of revenue and/or investment securities. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. With respect to change management: · For one IT system the firm selected for testing controls over managing changes to the production environment. The firm did not identify and test any controls that were designed to address the risk related to unapproved changes being made to this environment. (AS 2201.39)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to two types of revenue and the related accounts receivable deferred revenue related to one of these types of revenue and/or investment securities. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. With respect to change management: · For the other IT systems the firm selected for testing controls over change management but did not perform any substantive procedures to test or in the alternative test any controls over the completeness of the population of items from which it selected its samples for testing. (AS 1105.10)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to two types of revenue and the related accounts receivable deferred revenue related to one of these types of revenue and/or investment securities. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. With respect to change management: · The firm did not identify and test any controls designed to address the risk related to unauthorized users having administrative access to certain tools the issuer used to manage changes to the production environments. (AS 2201.39)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to two types of revenue and the related accounts receivable deferred revenue related to one of these types of revenue and/or investment securities. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. With respect to user access: · The firm selected for testing certain controls over user access for the issuer's IT systems. The firm did not identify and test any controls over the accuracy and completeness of the information the control owners used in the operation of these controls. (AS 2201.39)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to two types of revenue and the related accounts receivable deferred revenue related to one of these types of revenue and/or investment securities. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. With respect to user access: · The firm selected for testing a control over privileged access in which certain control owners reviewed their own access. The firm did not evaluate whether this resulted in a lack of segregation of duties. (AS 2201.42)

The issuer used multiple information-technology (IT) systems to initiate process and/or record transactions related to revenue and the related accounts receivable investment securities and cash. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. As a result of the deficiencies in the firm's testing of IT general controls (ITGCs) the firm's testing of these automated and IT-dependent controls was not sufficient. (AS 2201.46)

The issuer used multiple IT systems to initiate process and record transactions related to certain revenue and the related accounts receivable. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. As a result of the deficiencies in the firm's testing of ITGCs the firm's testing of these automated and IT-dependent controls was not sufficient. (AS 2201.46)

In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data or reports generated or maintained by this IT system. As a result of the above deficiency in the firm's testing of ITGCs the firm's testing of these automated and IT-dependent controls was not sufficient. (AS 2201.46)

The issuer used an information-technology (IT) system to initiate process and record certain transactions related to revenue and accounts receivable. In its testing of controls over these accounts the firm tested an IT-dependent manual control that used data and reports generated or maintained by this IT system. As a result of the deficiencies in the firm's testing of IT general controls (ITGCs) the firm's testing of this IT-dependent control was not sufficient. (AS 2201.46)

The firm was instructed by the principal auditor to audit the financial statements and the effectiveness of ICFR of two of the issuer's subsidiaries to support the principal auditor's opinions on the consolidated financial statements and ICFR. The issuer's processes related to revenue accounts receivable and inventory included automated transactions initiated processed and recorded by information technology ('IT') systems at both subsidiaries. The firm selected for testing automated and IT-dependent manual controls over revenue accounts receivable and inventory that used data and reports generated by the IT systems. The firm's approach to test the accuracy and completeness of the data and reports depended on effective IT general controls ('ITGCs'). For one subsidiary the firm identified several control deficiencies related to ITGCs. The firm did not evaluate the severity of the identified control deficiencies in accordance with the instructions of the principal auditor. (AS 2201.62)

The firm was instructed by the principal auditor to audit the financial statements and the effectiveness of ICFR of two of the issuer's subsidiaries to support the principal auditor's opinions on the consolidated financial statements and ICFR. The issuer's processes related to revenue accounts receivable and inventory included automated transactions initiated processed and recorded by information technology ('IT') systems at both subsidiaries. The firm selected for testing automated and IT-dependent manual controls over revenue accounts receivable and inventory that used data and reports generated by the IT systems. The firm's approach to test the accuracy and completeness of the data and reports depended on effective IT general controls ('ITGCs'). For the other subsidiary the firm did not test ITGCs or obtain confirmation from the principal auditor that ITGCs were not in scope for testing. (AS 2201.39)

The firm was instructed by the principal auditor to audit the financial statements and the effectiveness of ICFR of two of the issuer's subsidiaries to support the principal auditor's opinions on the consolidated financial statements and ICFR. The issuer's processes related to revenue accounts receivable and inventory included automated transactions initiated processed and recorded by information technology ('IT') systems at both subsidiaries. The firm selected for testing automated and IT-dependent manual controls over revenue accounts receivable and inventory that used data and reports generated by the IT systems. The firm's approach to test the accuracy and completeness of the data and reports depended on effective IT general controls ('ITGCs'). For one subsidiary the firm identified several control deficiencies related to ITGCs. The firm did not evaluate the severity of the identified control deficiencies in accordance with the instructions of the principal auditor. (AS 2201.62) For the other subsidiary the firm did not test ITGCs or obtain confirmation from the principal auditor that ITGCs were not in scope for testing. (AS 2201.39) As a result the firm's testing of the automated and IT-dependent manual controls over revenue accounts receivable and inventory for these two subsidiaries was not sufficient. (AS 2201.46)

The firm identified deficiencies in the information technology general controls ('ITGCs') related to security administration for the issuer's general ledger system and two of its revenue systems and concluded that these deficiencies in the aggregate represented a significant deficiency. The firm also identified a deficiency in the ITGCs related to program maintenance over these revenue systems. The following audit deficiencies were identified: · With respect to the security administration control deficiencies the firm identified compensating controls but did not evaluate whether these controls would mitigate the risks including fraud risks posed by the ITGC deficiencies. Further in performing its testing of the identified compensating controls the firm did not (1) identify that the control owners used data and reports in the performance of certain of these controls that were produced by the systems that were subject to the ITGC deficiencies and (2) as discussed below sufficiently test certain of these controls. (AS 2201.68) Unrelated to our review the issuer reevaluated its controls over security administration and program maintenance ITGCs and concluded that a material weakness existed that had not been previously identified. The issuer subsequently revised its report on ICFR to reflect this material weakness and the other material weaknesses discussed herein and the firm modified its opinion on the effectiveness of the issuer's ICFR to express an adverse opinion and reissued its report.

The firm did not perform substantive procedures to test or (as a result of the ITGC deficiencies discussed above) sufficiently test controls over the accuracy of certain system-generated data it used in its substantive testing of the valuation of accounts receivable. (AS 2501.11)

The firm identified deficiencies in the information technology general controls ('ITGCs') related to security administration for the issuer's general ledger system and two of its revenue systems and concluded that these deficiencies in the aggregate represented a significant deficiency. The firm also identified a deficiency in the ITGCs related to program maintenance over these revenue systems. The following audit deficiencies were identified: · In its testing of controls over revenue accounts receivable goodwill and certain long-lived assets the firm tested certain automated controls and IT-dependent manual controls that used data and reports generated or maintained by these systems. As a result of the deficiencies discussed above the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46) Unrelated to our review the issuer reevaluated its controls over security administration and program maintenance ITGCs and concluded that a material weakness existed that had not been previously identified. The issuer subsequently revised its report on ICFR to reflect this material weakness and the other material weaknesses discussed herein and the firm modified its opinion on the effectiveness of the issuer's ICFR to express an adverse opinion and reissued its report.