Explorer

For these same business units the firm selected for testing certain controls that prevented the processing of orders for customers on credit hold. The firm did not test beyond inquiry the aspect of these controls that addressed which users had the ability to release customers from credit hold. (AS 2201.42 and .44)

For one of these business units the firm selected for testing a control over the issuer's review of certain customer's accounts receivable balances. The firm did not identify and test any controls over the accuracy and completeness of a report used in the operation of this control. (AS 2201.39)

For two other business units the firm did not identify and test any controls that addressed the risk of material misstatement related to the acceptance of invalid or unauthorized customer orders. (AS 2201.39)

The sample sizes the firm used in certain of its substantive procedures to test revenue were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The firm subjected certain other of the issuer's business units to less extensive audit procedures. With respect to revenue from these business units the following deficiencies were identified: · In determining the extent to which audit procedures should be performed the firm did not evaluate (1) the materiality of these business units (2) the decentralized nature of records and information processing at these business units and (3) whether the risks of material misstatement that the firm identified for the business units subject to more extensive audit procedures also applied to these business units. (AS 2101.11 and .12; AS 2201.B10)

The firm subjected certain other of the issuer's business units to less extensive audit procedures. With respect to revenue from these business units the following deficiencies were identified: · To address the risks of material misstatement related to revenue for these business units the firm selected for testing a control that included the issuer's comparisons and reviews of the consolidated (1) budget to actual results and (2) prior-period actual results to current-period actual results. The firm did not evaluate the specific review procedures that the control owner performed to investigate identified variances and determine whether items identified for follow up had been appropriately resolved. (AS 2201.42 and .44)

The firm subjected certain other of the issuer's business units to less extensive audit procedures. With respect to revenue from these business units the following deficiencies were identified: · To address the risks of material misstatement related to revenue for these business units the firm selected for testing a control that included the issuer's comparisons and reviews of the consolidated (1) budget to actual results and (2) prior-period actual results to current-period actual results. The firm did not identify and test any controls over the review of the budget used in the operation of this control. (AS 2201.39)

The firm subjected certain other of the issuer's business units to less extensive audit procedures. With respect to revenue from these business units the following deficiencies were identified: · To firm did not perform any substantive procedures to test revenue for these business units. (AS 2301.08)

The issuer's main information technology ('IT') application processed financial transactions and maintained related data. The firm selected for testing IT general controls ('ITGCs') that consisted of controls over access and change management. The firm did not test administrator access to the database and the operating system supporting this application. (AS 2201.42 and .44)

The firm selected for testing a control that consisted of the issuer's review of the allowance for doubtful accounts. The firm did not evaluate the review procedures that the control owner performed including the procedures performed to investigate certain accounts receivable balances and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

The firm's approach for substantively testing the valuation of accounts receivable was to review and test management's process. The firm did not sufficiently evaluate the reasonableness of the allowance for doubtful accounts for one customer because in response to the customer indicating in its written confirmation reply that its balance to the issuer was zero the firm limited its procedures to obtaining a written representation from the issuer's management. (AS 2501.09 .10 and .11; AS 2810.03)

The issuer's main information technology ('IT') application processed financial transactions and maintained related data. The firm selected for testing IT general controls ('ITGCs') that consisted of controls over access and change management. The firm did not identify and test any controls that addressed the risk of developers migrating changes to production without proper approval and testing. (AS 2201.39)

The firm selected for testing certain IT-dependent controls. The firm did not identify and test any controls over the accuracy and completeness of data used in the operation of these controls. (AS 2201.39)

The firm selected for testing a control that consisted of the issuer's monthly review of the financial results. The firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

The firm selected for testing a control that consisted of the issuer's monthly review of the financial results. The firm did not identify and test any controls over the accuracy and completeness of data used in the operation of the control. (AS 2201.39)

The firm selected for testing three controls that consisted of the configuration of the application to (1) only allow key fields to be populated with certain data (2) sequentially assign sales order customer invoice and cash receipt numbers and (3) not allow customer invoices and journal entries to be posted when the accounting period is closed. The firm did not sufficiently test the configuration of the application because it did not test the operation of the control over all types of revenue transactions that occurred during the year. Further the sample sizes the firm used to test these controls were too small due to the deficiencies in the firm's testing of access and change management controls described above. (AS 2201.42 .44 and .46)

With respect to Accounts Receivable the firm sent positive confirmation requests to the issuer's customers for a sample of accounts receivable. For the items in its sample for which the requested confirmations were not returned the firm did not perform alternative procedures that provided sufficient evidence that these balances represented valid receivable balances as of the confirmation date. (AS 2310.31)

With respect to Accounts Receivable the firm did not perform any substantive procedures to test the collectability of accounts receivable. (AS 2301.08)

The issuer's policy is to apply payments to the oldest outstanding accounts receivable balance first. The firm used system-generated accounts receivable aging reports to substantively test the allowance for credit losses. The firm did not perform sufficient procedures to test the accuracy of these reports because it did not perform procedures to evaluate whether any accounts receivable balances were inappropriately removed from the aging reports due to the issuer's policy while other accounts receivable balances inappropriately remained. (AS 1105.10)

The issuer recognized revenue from multiple revenue streams. The following deficiency was identified: · The firm selected for testing controls over certain revenue and related accounts receivable that consisted of (1) the issuer's performance of consistency checks between its systems that track the delivery of services and other systems where sales orders are manually entered as received and (2) management's review of the exception reports produced from these checks that reflect anomalies in the data between the various systems. The firm did not identify and test any controls over the accuracy and completeness of the exception reports used in the operation of these controls. (AS 2201.39)

The issuer recognized revenue from multiple revenue streams. The following deficiency was identified: · The sample sizes the firm used in certain of its substantive procedures to test revenue and related accounts receivable were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiency in the firm's control testing discussed in the first bullet above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The firm's substantive procedures to test accounts receivable as of an interim date consisted of performing confirmation procedures for a sample of invoices. The firm did not perform sufficient procedures to extend its conclusions from the interim date to year end because its procedures were limited to performing confirmation procedures for a small sample of invoices recorded as accounts receivable at year end. (AS 2301.45)

The firm selected for testing controls that consisted of management's review of (1) aged accounts receivable and/or (2) a reconciliation of accounts receivable to monthly billings. The firm did not identify and test any controls over the accuracy of the aging report and certain data used in the operation of these controls. (AS 2201.39)

The firm relied on certain information technology general controls (ITGCs) in its substantive approach to testing revenue and accounts receivable. The following deficiencies were identified: · The firm selected for testing a control over change management but did not perform procedures to determine whether the population of changes from which it made its selections for testing represented the complete population of changes made to this system. (AS 1105.10)

The firm relied on certain information technology general controls (ITGCs) in its substantive approach to testing revenue and accounts receivable. The following deficiencies were identified: · The firm selected for testing certain IT application controls and IT-dependent manual controls over revenue and accounts receivable. The firm's approach to testing these controls depended on effective ITGCs including controls over change management. As a result of the deficiency in the firm's testing of the control discussed above the firm's testing of these IT application controls and IT-dependent manual controls was not sufficient. (AS 2301.18)

The firm relied on certain information technology general controls (ITGCs) in its substantive approach to testing revenue and accounts receivable. The following deficiencies were identified: · As a result of the firm's control testing deficiencies the sample sizes the firm used in certain of its substantive procedures to test revenue and accounts receivable were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The issuer's accounts receivable included certain credit balances that were reclassified as liabilities of the issuer. The firm did not perform any substantive procedures to obtain an understanding of the nature of certain of these credit balances and evaluate whether they represented valid obligations of the issuer. (AS 2301.08)

The issuer used seven information-technology (IT) systems to initiate process and record transactions related to certain revenue and the related accounts receivable and deferred revenue. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. As a result of the following deficiencies in the firm's testing of IT general controls (ITGCs) the firm's testing of these automated and IT-dependent controls was not sufficient. (AS 2201.46)

With respect to change management: The firm selected for testing a change management control over all seven IT systems that consisted of the documentation testing and approval of changes prior to their implementation into production and all changes made in the production environment were to be recorded in a ticketing system. The following deficiency was identified: · For one IT system the firm did not evaluate the effect of the issuer's exclusion of a known change to a system report that did not have a ticket on the firm's conclusions regarding the design and operating effectiveness of this control. (AS 2201.48)

With respect to change management: The firm selected for testing a change management control over all seven IT systems that consisted of the documentation testing and approval of changes prior to their implementation into production and all changes made in the production environment were to be recorded in a ticketing system. The following deficiency was identified: · For all seven IT systems the firm did not perform sufficient procedures to test the completeness of the population of changes from which it made its selections because for a seven-month interim period the firm obtained tickets for a sample of changes from certain IT systems but did not verify that they were included in the population and the firm did not perform any procedures to test completeness of the population subsequent to the interim period. Further the firm did not (1) sufficiently evaluate a known change that did not have a ticket and whether other changes could have been made without a ticket and (2) evaluate another known change to a report that had a ticket but was excluded from the population. (AS 1105.10; AS 2810.03)

As a result of the firm's ITGC testing deficiencies discussed above the firm did not perform sufficient substantive procedures as follows: · The sample sizes the firm used in certain of its substantive procedures to test the existence and valuation of certain accounts receivable were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

As a result of the firm's ITGC testing deficiencies discussed above the firm did not perform sufficient substantive procedures as follows: · The firm did not perform any substantive procedures to test or as discussed above with respect to change management sufficiently test controls over the accuracy and completeness of certain system-generated data or reports the firm used to substantively test certain deferred revenue. (AS 1105.10)

The firm selected for testing controls over accounts receivable at five of the issuer's locations including certain automated and manual controls related to the matching of cash receipts to the corresponding invoices and application of the receipts to the correct accounts receivable balances. For four of these locations the issuer changed from a manual cash application control to an automated cash application control during the first quarter of the year. The automated control included a manual element that used system-generated reports to identify investigate and apply cash receipts that were not automatically processed. The following deficiency was identified: · For four locations the firm did not perform sufficient procedures to test the automated control because the firm did not (1) evaluate whether the control was configurable or programmable within the system and (2) perform procedures to test the configuration or program of the control as applicable. Further the firm did not test each relevant scenario of the automated control to ensure the system processed transactions as designed. (AS 2201.42 and 44)

The firm's procedures to test the existence and valuation of accounts receivable included selecting a sample of customer invoices for testing using a sampling approach that was based on obtaining a certain level of audit evidence from its other substantive procedures. The sample size the firm used was too small to provide sufficient appropriate audit evidence over accounts receivable because the firm's other substantive procedures did not provide the level of substantive evidence needed to support its sampling approach. (AS 2315.16 .19 .23 and .23A)

The firm selected for testing controls over accounts receivable at five of the issuer's locations including certain automated and manual controls related to the matching of cash receipts to the corresponding invoices and application of the receipts to the correct accounts receivable balances. For four of these locations the issuer changed from a manual cash application control to an automated cash application control during the first quarter of the year. The automated control included a manual element that used system-generated reports to identify investigate and apply cash receipts that were not automatically processed. The following deficiency was identified: · For four locations the firm did not perform any procedures to test the manual element of the control when cash receipts were not automatically applied. (AS 2201.39)

The firm selected for testing controls over accounts receivable at five of the issuer's locations including certain automated and manual controls related to the matching of cash receipts to the corresponding invoices and application of the receipts to the correct accounts receivable balances. For four of these locations the issuer changed from a manual cash application control to an automated cash application control during the first quarter of the year. The automated control included a manual element that used system-generated reports to identify investigate and apply cash receipts that were not automatically processed. The following deficiency was identified: · For one location the firm did not identify and test any controls that addressed whether cash receipts were matched to corresponding invoices and applied to the correct accounts receivable balances. (AS 2201.39)

The firm's procedures to test the existence and valuation of accounts receivable at these five locations included selecting a sample of customer invoices for testing using a sampling approach that was based on obtaining a certain level of audit evidence from its other substantive procedures and placing reliance on controls. The sample size the firm used was too small to provide sufficient appropriate audit evidence over accounts receivable because the firm's other substantive procedures did not provide the level of substantive evidence needed to support its sampling approach (AS 2315.16 .19 .23 and .23A).

The firm's procedures to test the existence and valuation of accounts receivable at these five locations included selecting a sample of customer invoices for testing using a sampling approach that was based on obtaining a certain level of audit evidence from its other substantive procedures and placing reliance on controls. The sample size the firm used was too small to provide sufficient appropriate audit evidence over accounts receivable because the procedures performed to test accounts receivable were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The firm sent positive confirmation requests via email to a sample of customers as part of its substantive testing of accounts receivable and the email address for each customer was provided by the issuer. The firm received the responses for all but one of the confirmation requests sent via email. The firm did not consider performing procedures to address the risks associated with electronic responses such as verifying the source of the confirmation responses. (AS 2310.29)

The issuer used an information-technology (IT) system to initiate process and record transactions related to certain revenue accounts receivable and inventory. In its testing over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by the IT system. As a result of the following deficiencies in the firm's testing of IT general controls (ITGCs) the firm's testing of these automated and IT-dependent controls was not sufficient. (AS 2201.46)

The issuer used an information-technology (IT) system to initiate process and record transactions related to certain revenue accounts receivable and inventory. In its testing over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by the IT system. With respect to change management: - The firm selected for testing certain change management controls that consisted of (1) testing of changes in a test environment and (2) approval of these changes prior to their implementation into the production environment. The firm did not evaluate the procedures that the control owners performed to evaluate the appropriateness of certain types of changes made to the IT system or otherwise identify and test other controls to address the change management risks. (AS 2201.42 and .44)

The issuer used an information-technology (IT) system to initiate process and record transactions related to certain revenue accounts receivable and inventory. In its testing over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by the IT system. With respect to change management: - The issuer's IT personnel processed certain changes directly into the production environment of the IT system. The firm did not identify and test any controls over these direct changes. (AS 2201.39)

The issuer used an information-technology (IT) system to initiate process and record transactions related to certain revenue accounts receivable and inventory. In its testing over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by the IT system. With respect to change management: - The firm's testing of certain automated controls over customer orders was not sufficient because the firm did not test changes made into the production environment of the IT system for those controls after the date of testing. (AS 2201.44)

For revenue and accounts receivable which were affected by the audit deficiencies related to change management the following additional deficiencies were identified: - The issuer recognized certain revenue net of chargeback and rebate accruals. The chargeback and rebate accruals were based on inventory quantity and claims data transmitted from certain of the issuer's customers to its IT system through an electronic data interface (EDI). In its testing of controls over chargeback and rebate accruals the firm tested certain automated controls and IT-dependent manual controls that used this EDI data. The firm did not identify and test any controls over the accuracy and completeness of the inventory information received through EDI that was used in the operation of the controls. (AS 2201.39)

For revenue and accounts receivable which were affected by the audit deficiencies related to change management the following additional deficiencies were identified: - The issuer recognized certain revenue net of chargeback and rebate accruals. The chargeback and rebate accruals were based on inventory quantity and claims data transmitted from certain of the issuer's customers to its IT system through an electronic data interface (EDI). In its testing of controls over chargeback and rebate accruals the firm tested certain automated controls and IT-dependent manual controls that used this EDI data. The firm used a 'test of one' approach to test an automated control over the claims data but did not perform testing of ITGCs over the EDI to allow for the use of such an approach. (AS 2201.42 and .44)

The firm did not perform any substantive procedures to test or in the alternative identify and test any controls over the accuracy and completeness of data and reports obtained from the issuer's IT system that it used to test certain revenue. (AS 1105.10)

The sample sizes the firm used in its substantive procedures to test the existence of certain accounts receivable were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to deficiencies in the firm's IT control testing. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The firm was instructed by the principal auditor of the issuer to test specific controls of the component in the areas of revenue accounts receivable and inventory. During the audit the principal auditor provided additional information to the firm regarding certain of these controls including the existence of additional control attributes and changes to the description of the controls. The firm did not perform procedures to (1) understand if the revised control descriptions as communicated by the principal auditor were indicative of changes to the controls and if so change its tests of design and operating effectiveness and (2) test the additional control attributes communicated by the principal auditor including one such attribute related to the component's monitoring of the accuracy and frequency of inventory cycle counts. (AS 2201.42 and .44)

The firm selected for testing as instructed by the principal auditor a control that consisted of the review and approval of price quotes. The firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

The sample size the firm used in certain of its substantive procedures to test accounts receivable was too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)