Explorer

The firm identified deficiencies in the information technology general controls ('ITGCs') related to security administration for the issuer's general ledger system and two of its revenue systems and concluded that these deficiencies in the aggregate represented a significant deficiency. The firm also identified a deficiency in the ITGCs related to program maintenance over these revenue systems. The following audit deficiencies were identified: · The firm did not appropriately evaluate whether the ITGC deficiencies individually or in combination represented a material weakness. (AS 2201.62) Unrelated to our review the issuer reevaluated its controls over security administration and program maintenance ITGCs and concluded that a material weakness existed that had not been previously identified. The issuer subsequently revised its report on ICFR to reflect this material weakness and the other material weaknesses discussed herein and the firm modified its opinion on the effectiveness of the issuer's ICFR to express an adverse opinion and reissued its report.

The issuer used an information technology (IT) system to process and record transactions related to revenue accounts receivable and cash. The firm identified control deficiencies in certain IT general controls (ITGCs) over this IT system related to individuals having segregation of duties conflicts that provided these individuals with security administration privileges and the ability to both develop changes and migrate them into production. The following audit deficiencies were identified: · The firm identified and tested a compensating control that it believed would mitigate these ITGC deficiencies. The firm did not identify that this compensating control did not address the risks related to these deficiencies because the control owners performing the compensating control were among the individuals that the firm identified as having the segregation of duties conflicts. (AS 2201.68)

The issuer used an information technology (IT) system to process and record transactions related to revenue accounts receivable and cash. The firm identified control deficiencies in certain IT general controls (ITGCs) over this IT system related to individuals having segregation of duties conflicts that provided these individuals with security administration privileges and the ability to both develop changes and migrate them into production. The following audit deficiencies were identified: · The firm tested certain automated and IT-dependent manual controls over revenue accounts receivable and cash that used data and reports generated or maintained by this IT system. As a result of the audit deficiency discussed above the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

The issuer used a service organization to process certain revenue and accounts receivable. The firm obtained two service auditor's reports that addressed information technology general controls (ITGCs) at this service organization. The service auditor's report that addressed 11 months of the year under audit contained a qualified opinion for certain ITGCs that were ineffective. The firm did not perform any procedures to evaluate the effect of this qualified opinion on the audit. (AS 2201.B21)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to certain revenue and the related accounts receivable. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. As a result of the following deficiencies in the firm's testing of IT general controls (ITGCs) the firm's testing of these automated and IT dependent manual controls was not sufficient. (AS 2201.46)

The firm selected for testing various user access and change management controls over these IT systems that consisted of the issuer's reviews of (1) the granting and monitoring of user access and (2) changes to the production environment of these IT systems. The following deficiency was identified: · The firm did not perform sufficient procedures to test the design of these controls because it did not evaluate whether (1) the controls were designed to satisfy the issuer's control objectives and (2) the control owners possessed the necessary authority and competence to perform the controls. (AS 2201.42)

The firm selected for testing various user access and change management controls over these IT systems that consisted of the issuer's reviews of (1) the granting and monitoring of user access and (2) changes to the production environment of these IT systems. The following deficiency was identified: · The firm did not identify and test any controls over the accuracy and completeness of certain system-generated information that were used in the operation of these controls. (AS 2201.39)

The firm selected for testing various user access and change management controls over these IT systems that consisted of the issuer's reviews of (1) the granting and monitoring of user access and (2) changes to the production environment of these IT systems. The following deficiency was identified: · The firm used certain system-generated information (1) in its testing of these controls and/or (2) to make selections to test certain controls but did not perform procedures to test or test any controls over the accuracy and/or completeness of this information. Further the firm used other information in its testing of certain of these controls but did not sufficiently test or test controls over the accuracy and completeness of this information because it did not test how the information was generated. (AS 1105.10)

The firm selected for testing various user access and change management controls over these IT systems that consisted of the issuer's reviews of (1) the granting and monitoring of user access and (2) changes to the production environment of these IT systems. The following deficiency was identified: · In its testing of a control over user access the firm identified a deviation indicating that an individual may have had inappropriate access to one of these systems. The firm determined that this deviation did not affect its conclusion on the operating effectiveness of this control based on certain system-generated information provided by the issuer. The firm did not sufficiently evaluate the effect of this deviation on the operating effectiveness of this control because it did not test or test controls over the accuracy and completeness of this information. (AS 1105.10; AS 2201.48)

As a result of the firm's ITGC testing deficiencies the firm did not perform sufficient substantive procedures over this revenue and the related accounts receivable as follows: · The sample sizes that the firm used in certain of its substantive procedures to test these accounts were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

As a result of the firm's ITGC testing deficiencies the firm did not perform sufficient substantive procedures over this revenue and the related accounts receivable as follows: · The firm did not perform sufficient procedures to test or sufficiently test controls over the accuracy and completeness of certain system-generated information that the firm used in its substantive testing. (AS 1105.10)

The issuer used an IT system to process and record transactions including those related to product revenue accounts receivable and certain expenses and related accruals. This system allowed the issuer to create security profiles for users that the issuer used to assign various levels of access privileges to these users including administrative access that allowed users to make changes to this system. The following deficiencies were identified: · The firm selected for testing two ITGCs over administrative access to this system but as part of that testing it did not perform any procedures to assess the control owners' (1) evaluation of certain security profiles and (2) determination of whether the access privileges assigned to those profiles were appropriate. (AS 2201.42 and .44)

The issuer used an IT system to process and record transactions including those related to product revenue accounts receivable and certain expenses and related accruals. This system allowed the issuer to create security profiles for users that the issuer used to assign various levels of access privileges to these users including administrative access that allowed users to make changes to this system. The following deficiencies were identified: · The firm selected for testing certain automated and IT-dependent manual controls over transactions related to these accounts. The firm's approach to testing these controls depended on effective ITGCs. Due to the deficiency in the firm's testing of ITGCs discussed above the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

The issuer used two information-technology (IT) systems to process and record transactions related to revenue accounts receivable and inventory for this business unit. The following deficiencies were identified: • The firm selected for testing certain automated and IT-dependent manual controls that used information generated or maintained by the second system. The accuracy and completeness of this information depended on effective IT general controls (ITGCs). Due to the deficiency in the firm's evaluation of the ITGC control deficiencies discussed above the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

The issuer used two IT systems to process and record transactions related to revenue and certain accounts receivable. The following deficiencies were identified: · The firm tested certain automated controls that used data maintained by one of these IT systems. The accuracy and completeness of these data depended on effective IT general controls ('ITGCs'). Due to the deficiencies in the firm's testing of the ITGCs discussed above the firm's testing of these automated controls was not sufficient. (AS 2201.46)

The issuer used an information technology (IT) system to process and record transactions related to revenue accounts receivable and inventory. In its testing of controls over these accounts the firm tested certain IT-dependent manual controls that used data and reports generated or maintained by this IT system. As a result of the deficiencies in the firm's testing of IT general controls (ITGCs) discussed below the firm's testing of these IT-dependent manual controls was not sufficient. (AS 2201.46)

The issuer used an information technology (IT) system to process and record transactions related to revenue accounts receivable and inventory. In its testing of controls over these accounts the firm tested certain IT-dependent manual controls that used data and reports generated or maintained by this IT system. The following ITGC deficiencies were identified: · The firm selected for testing a control over change management but did not perform any procedures to test or in the alternative test any controls over the completeness of the population of changes from which it made its selections for testing. (AS 1105.10)

The issuer used an information technology (IT) system to process and record transactions related to revenue accounts receivable and inventory. In its testing of controls over these accounts the firm tested certain IT-dependent manual controls that used data and reports generated or maintained by this IT system. The following deficiencies related to the firm's testing of controls were identified: · The firm used the work of the issuer's internal audit as evidence of the effectiveness of automated application controls over the accuracy and completeness of reports that the issuer used in the operation of certain other IT-dependent manual controls that the firm tested. Internal audit relied on the testing of these controls that was performed in prior years. The firm did not sufficiently evaluate whether internal audit's strategy to rely on testing that was performed in prior years was appropriate because the firm did not evaluate whether ITGCs were effective in those prior years. (AS 2201.B29; AS 2605.24)

The issuer used an information technology (IT) system to process and record transactions related to revenue accounts receivable and inventory. In its testing of controls over these accounts the firm tested certain IT-dependent manual controls that used data and reports generated or maintained by this IT system. The following deficiencies related to the firm's testing of controls were identified: · For certain automated controls the firm tested a sample of one transaction for each of these controls in the issuer's IT testing environment rather than in its production environment. The firm's testing was not sufficient because the firm did not perform procedures to determine whether the testing environment was consistent with the production environment. (AS 2201.44)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to revenue accounts receivable and unbilled receivables. In its testing of controls over these accounts the firm tested various IT-dependent manual controls that used data and reports generated or maintained by these IT systems. As a result of the deficiencies in the firm's testing of IT general controls (ITGCs) the firm's testing of these IT-dependent manual controls was not sufficient. (AS 2201.46)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to revenue accounts receivable and unbilled receivables. In its testing of controls over these accounts the firm tested various IT-dependent manual controls that used data and reports generated or maintained by these IT systems. As a result of the following deficiency in the firm's testing of IT general controls (ITGCs) the firm's testing of these IT-dependent manual controls was not sufficient. • The firm selected for testing certain controls over change management and user access but did not test or test any controls over the completeness of the population from which it selected its samples for testing. (AS 1105.10)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to revenue accounts receivable and unbilled receivables. In its testing of controls over these accounts the firm tested various IT-dependent manual controls that used data and reports generated or maintained by these IT systems. As a result of the following deficiency in the firm's testing of IT general controls (ITGCs) the firm's testing of these IT-dependent manual controls was not sufficient. • The firm did not identify and test controls that addressed the risk that users with the ability to develop changes also have the ability to implement those changes. (AS 2201.39)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to revenue accounts receivable and unbilled receivables. In its testing of controls over these accounts the firm tested various IT-dependent manual controls that used data and reports generated or maintained by these IT systems. As a result of the following deficiency in the firm's testing of IT general controls (ITGCs) the firm's testing of these IT-dependent manual controls was not sufficient. • The firm selected for testing a control over logical access to several IT systems but did not test the aspect of this control related to these IT systems. (AS 2201.42 and .44)