Explorer

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. As a result of the following deficiencies in the firm's testing of ITGCs over certain of these IT systems the firm's testing of these automated and IT-dependent controls was not sufficient. (AS 2201.46)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: The firm performed a review of the security settings in place over the issuer's accounting system using an unapproved custom software audit tool that included tests of privileged access password settings and client production settings. The firm identified certain exceptions involving the segregation of duties of two users who had administrator access to the system which enabled them to migrate changes into production. The firm also identified that the system's production environment had been opened multiple times during the year by these two users. The following deficiency was identified: · The firm did not determine the effect of the exception identified on the operating effectiveness of the user access controls over the system. (AS 2201.48)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: The firm performed a review of the security settings in place over the issuer's accounting system using an unapproved custom software audit tool that included tests of privileged access password settings and client production settings. The firm identified certain exceptions involving the segregation of duties of two users who had administrator access to the system which enabled them to migrate changes into production. The firm also identified that the system's production environment had been opened multiple times during the year by these two users. The following deficiency was identified: · The firm did not identify and test any controls over the appropriateness of the activity that the two privileged access users performed when opening the system's production environment. (AS 2201.39)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: The firm performed a review of the security settings in place over the issuer's accounting system using an unapproved custom software audit tool that included tests of privileged access password settings and client production settings. The firm identified certain exceptions involving the segregation of duties of two users who had administrator access to the system which enabled them to migrate changes into production. The firm also identified that the system's production environment had been opened multiple times during the year by these two users. The following deficiency was identified: · The firm did not perform any procedures to evaluate the reliability of the information produced from the custom software audit tool that was used to test the security settings of this system. (AS 1105.04 and .06)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: The firm selected for testing controls over the assignment of privileged access rights to certain other IT systems that consisted of management's review and approval of privileged access requests. The following deficiency was identified: · The firm did not identify and test any controls over the accuracy and completeness of the reports used in the operation of these controls. (AS 2201.39)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: The firm selected for testing controls over the assignment of privileged access rights to certain other IT systems that consisted of management's review and approval of privileged access requests. The following deficiency was identified: · The firm did not evaluate the specific review procedures that the control owners performed to determine whether access was appropriate and that the roles were adequately restricted or granted to users to prevent unauthorized and inappropriate access to these systems. (AS 2201.42 and .44)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to change management: The firm selected for testing change management controls over certain IT systems that consisted of (1) the authorization of changes prior to development (2) testing and approval of changes prior to their migration into production and (3) the establishment of segregation of duties and the restriction of users with the ability to develop and migrate changes to production to authorized personnel. The firm did not perform procedures to test or test any controls over the completeness of the population of changes from which it made its selections for testing. (AS 1105.10)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. With respect to Accounts Receivable which was affected by the audit deficiencies related to user access and change management the following additional deficiency was identified: · The firm did not identify and test any controls over the posting of cash receipts to customer accounts and invoices. (AS 2201.39)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. With respect to Accounts Receivable which was affected by the audit deficiencies related to user access and change management the following additional deficiency was identified: · The firm selected for testing a control that consisted of the issuer's review and analysis of accounts receivable as reflected in a customized system-generated accounts receivable aging report. The firm did not evaluate whether the automated aspect of this control which consisted of the system's aging of customer account balances was configurable and programmable and if so perform procedures to test the configuration and programming of the control. (AS 2201.42)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. With respect to Accounts Receivable which was affected by the audit deficiencies related to user access and change management the following additional deficiency was identified: · The firm selected for testing a control that consisted of the issuer's review and analysis of accounts receivable as reflected in a customized system-generated accounts receivable aging report. The firm did not perform procedures to test the accuracy and completeness of the reports and calculations produced by the system to determine whether the automated aspect of the control operated as it was designed. (AS 2201.44)

The following deficiency was identified: · The firm selected for testing a control that consisted of the configuration of the issuer's accounting system to automatically apply cash receipts to specific invoices and the manual investigation of outstanding items and unapplied cash receipts in the cash in-transit accounts. The firm did not test the automated aspect of this control related to the automatic application of cash receipts to specific invoices. (AS 2201.42 and .44)

The following deficiency was identified: · The firm selected for testing an automated control that consisted of the configuration of the issuer's accounting system to automatically record sales transactions based on revenue recognition triggers contained in the sales order and customer master files. The firm did not test whether the system accurately retrieved information from customer master files that was associated with the recorded sales. (AS 2201.42 and .44)

The following deficiency was identified: · The firm selected for testing a control that consisted of the reconciliation of goods invoiced to goods shipped and delivered. The firm did not perform procedures to test the design and operating effectiveness of this control. (AS 2201.42 and .44)

The following deficiency was identified: · The firm selected for testing a control that consisted of the issuer's verification of the shipment and delivery dates recorded in the accounting system to determine whether the transfer of title and recognition of revenue was based on accurate information. The firm did not identify and test any controls over the completeness of a customized system-generated report used in the operation of this control. (AS 2201.39)

The following deficiency was identified: · The firm selected for testing controls that consisted of the issuer's (1) use of revenue recognition triggers to consistently recognize revenue for each billing type (2) matching of sales invoices to documents supporting proof of delivery and transfer of title and (3) verification of the shipment and delivery dates recorded in the accounting system to determine whether the transfer of title and recognition of revenue was based on accurate information. The firm did not perform procedures to test or test any controls over the completeness of the population of a customized system-generated report from which it made its selections for testing. (AS 1105.10)

The issuer initiated and processed transactions related to sales accounts receivable and inventory at numerous business units using various IT systems. With respect to controls for these business units the firm selected for testing two entity-level controls that used information generated by the IT systems. The firm did not test IT general controls (“ITGCs”) over the IT systems for these business units or test any other controls over the accuracy and completeness of the information that was generated by the systems and that the issuer used in the performance of the entity-level controls. (AS 2201.39)

The firm's reliance on the entity-level controls discussed above to reduce its substantive procedures was unsupported. As a result its analytical procedures which consisted of comparisons of certain current-year account balances to corresponding prior-period balances to test revenue accounts receivable and inventory for these locations did not provide sufficient appropriate audit evidence. (AS 2301.08)

The issuer used various IT systems to initiate process and record transactions related to certain revenue and accounts receivable. The following deficiencies were identified: · The firm selected for testing a control over change management for these IT systems but did not perform sufficient procedures to test the completeness of the population of changes from which it made its selections for testing because it limited its procedures to testing the completeness of only one type of change. (AS 1105.10)

The issuer used various IT systems to initiate process and record transactions related to certain revenue and accounts receivable. The following deficiencies were identified: · The firm tested certain automated and IT-dependent manual controls that used data from these IT systems. As a result of the deficiency in the firm's testing of IT general controls discussed above the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

The issuer used various IT systems to initiate process and record transactions related to certain revenue and accounts receivable. The following deficiencies were identified: · The sample sizes the firm used in certain of its substantive procedures to test this revenue were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The issuer used an IT system to initiate process and record transactions related to certain revenue accounts receivable and inventory. The firm selected for testing various automated controls related to this revenue accounts receivable and inventory. The following deficiencies were identified: · The firm's testing of certain automated controls using a sample of only one instance of the control's operation was not sufficient because the firm did not test the configuration or programming of these controls or perform other procedures that would have provided sufficient appropriate audit evidence that these controls were designed and operating effectively. (AS 2201.42 and .44)

The issuer used an IT system to initiate process and record transactions related to certain revenue accounts receivable and inventory. The firm selected for testing various automated controls related to this revenue accounts receivable and inventory. The following deficiencies were identified: · The firm's testing of certain other automated controls using a sample of only one instance of the control's operation was not sufficient because the firm did not test whether changes to configurations within these controls were subject to the issuer's change management controls. (AS 2201.44)

The issuer used an IT system to initiate process and record transactions related to certain revenue accounts receivable and inventory. The firm selected for testing various automated controls related to this revenue accounts receivable and inventory. The following deficiencies were identified: · The sample sizes the firm used in certain of its substantive procedures to test this revenue accounts receivable and inventory were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to two types of revenue and the related accounts receivable deferred revenue related to one of these types of revenue and/or investment securities. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. As a result of deficiencies in the firm's testing of IT general controls (ITGCs) the firm's testing of these automated and IT-dependent controls was not sufficient. (AS 2201.46)

For one type of revenue and the related deferred revenue which were affected by the audit deficiencies the following deficiencies related to the firm's testing of controls were identified: · The firm selected for testing automated controls over customer set up modification and credit approval. The firm did not test the aspects of these controls related to the timing of approvals and the established credit limits. Further the firm's testing of the aspects of the controls related to possible override was not sufficient because the firm's procedures were limited to inquiry. (AS 2201.42 and .44)

For one type of revenue and the related deferred revenue which were affected by the audit deficiencies the following deficiencies related to the firm's testing of controls were identified: · The firm selected for testing automated controls over contract approval and product delivery. The firm's testing of these controls was not sufficient because the firm's procedures did not address certain types of contract scenarios and delivery types. (AS 2201.42 and .44)

For one type of revenue and the related deferred revenue which were affected by the audit deficiencies the following deficiencies related to the firm's testing of controls were identified: · The firm selected for testing certain IT-dependent manual controls but did not identify and test any controls over the accuracy and completeness of certain data or reports that the control owners used in the operations of these controls. (AS 2201.39)

For one type of revenue and the related deferred revenue which were affected by the audit deficiencies the following deficiencies related to the firm's testing of controls were identified: · For one control the firm did not perform any substantive procedures to test or in the alternative test any controls over the completeness of the lists from which it selected items for testing. (AS 1105.10)

For one type of revenue and the related deferred revenue which were affected by the audit deficiencies the following deficiencies related to the firm's testing of controls were identified: · The firm's testing of certain other IT-dependent manual controls was not sufficient because it did not sufficiently test the queries or programming the issuer used to generate certain data or reports that the control owners used in the operations of these controls. (AS 2201.42 and .44)

For one type of revenue and the related deferred revenue which were affected by the audit deficiencies the following deficiencies related to the firm's testing of controls were identified: · For certain other IT-dependent manual controls the firm tested the accuracy and completeness of certain reports used in the operation of these controls in the issuer's IT testing environment rather than in the production environment. The firm's testing was not sufficient because the firm did not perform procedures to determine whether the testing environment was consistent with the production environment. (AS 2201.44)

As a result of the firm's control testing deficiencies discussed above the firm did not perform sufficient substantive procedures for two types of revenue and the related accounts receivable and for deferred revenue related to one of these types of revenue as follows: · The firm's substantive procedures to test these accounts included analytical procedures. The firm used data from the issuer's systems to develop its expectations but did not test or sufficiently test controls over the accuracy and completeness of these data. Further the firm established its thresholds for investigating differences based on a level of control reliance that was not supported due to the deficiencies in the firm's testing of controls. As a result the analytical procedures did not provide the desired level of assurance that misstatements that could have been material would be identified. (AS 2301.16 .18 and .37; AS 2305.16 and 20)

As a result of the firm's control testing deficiencies discussed above the firm did not perform sufficient substantive procedures for two types of revenue and the related accounts receivable and for deferred revenue related to one of these types of revenue as follows: · The firm performed substantive procedures to test certain arrangements with multiple performance obligations. The firm's testing of the reasonableness of the relative stand-alone selling prices the issuer used to allocate this revenue to the performance obligations was not sufficient because the firm did not test or sufficiently test controls over the accuracy and completeness of the data it used in its testing. (AS 1105.10)

For one of these two types of revenue the firm developed its expectation for one of its analytical procedures using data derived from the recorded amounts of revenue. The firm did not evaluate whether this data was sufficiently reliable for purposes of achieving its audit objectives. (AS 2305.16)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to two types of revenue and the related accounts receivable deferred revenue related to one of these types of revenue and/or investment securities. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. With respect to change management: · For one IT system the firm selected for testing controls over managing changes to the production environment. The firm did not identify and test any controls over the accuracy and completeness of certain access logs used in the operation of these controls. (AS 2201.39)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to two types of revenue and the related accounts receivable deferred revenue related to one of these types of revenue and/or investment securities. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. With respect to change management: · For one IT system the firm selected for testing controls over managing changes to the production environment. The firm did not identify and test any controls that were designed to address the risk related to unapproved changes being made to this environment. (AS 2201.39)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to two types of revenue and the related accounts receivable deferred revenue related to one of these types of revenue and/or investment securities. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. With respect to change management: · For the other IT systems the firm selected for testing controls over change management but did not perform any substantive procedures to test or in the alternative test any controls over the completeness of the population of items from which it selected its samples for testing. (AS 1105.10)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to two types of revenue and the related accounts receivable deferred revenue related to one of these types of revenue and/or investment securities. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. With respect to change management: · The firm did not identify and test any controls designed to address the risk related to unauthorized users having administrative access to certain tools the issuer used to manage changes to the production environments. (AS 2201.39)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to two types of revenue and the related accounts receivable deferred revenue related to one of these types of revenue and/or investment securities. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. With respect to user access: · The firm selected for testing certain controls over user access for the issuer's IT systems. The firm did not identify and test any controls over the accuracy and completeness of the information the control owners used in the operation of these controls. (AS 2201.39)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to two types of revenue and the related accounts receivable deferred revenue related to one of these types of revenue and/or investment securities. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. With respect to user access: · The firm selected for testing a control over privileged access in which certain control owners reviewed their own access. The firm did not evaluate whether this resulted in a lack of segregation of duties. (AS 2201.42)

For one type of revenue and the related deferred revenue which were affected by the audit deficiencies the following deficiencies related to the firm's testing of controls were identified: · The firm's testing of certain automated controls was not sufficient because the firm did not test the configuration or programming of these controls or perform other procedures that would have provided sufficient appropriate audit evidence that these controls were designed and operating effectively. Further the firm's testing of certain automated controls was not sufficient because its testing of certain aspects of the controls was limited to inquiry. (AS 2201.42 and .44)

For one type of revenue and the related deferred revenue which were affected by the audit deficiencies the following deficiencies related to the firm's testing of controls were identified: · For two automated controls the firm did not perform any substantive procedures to test or in the alternative test any controls over the completeness of the lists from which it selected items for testing. (AS 1105.10)

A component of the issuer (“component”) entered into contracts with customers in which revenue was recognized over time based on the extent of progress towards completion of the performance obligation. The following deficiency was identified: · The firm selected for testing a control that consisted of the component's review of invoices. The firm did not identify and test any controls over the accuracy and completeness of certain data used in the operation of the control. (AS 2201.39)

A component of the issuer (“component”) entered into contracts with customers in which revenue was recognized over time based on the extent of progress towards completion of the performance obligation. The following deficiency was identified: · The firm selected for testing a control that consisted of the component's review of manual journal entries. The firm did not sufficiently test the operating effectiveness of this control because it made its selections to test the control from an incomplete population of journal entries. (AS 2201.44)

A component of the issuer (“component”) entered into contracts with customers in which revenue was recognized over time based on the extent of progress towards completion of the performance obligation. The following deficiency was identified: · The firm selected for testing a control that consisted of the component's review of manual journal entries. The firm did not identify and test any controls over the component's recording of the manual journal entries in the general ledger. (AS 2201.39)

A component of the issuer (“component”) entered into contracts with customers in which revenue was recognized over time based on the extent of progress towards completion of the performance obligation. The following deficiency was identified: · The firm selected for testing a control that consisted of the component's review of financial information. The firm did not evaluate the review procedures that the control owners performed to identify items for follow up. Further the firm did not sufficiently evaluate whether items identified for follow up were appropriately resolved because it limited its testing to one item. (AS 2201.42 and .44)

A component of the issuer (“component”) entered into contracts with customers in which revenue was recognized over time based on the extent of progress towards completion of the performance obligation. The following deficiency was identified: · The firm selected for testing a control that consisted of the component's review of gross receivables. The firm did not sufficiently test the operating effectiveness of the control because it did not test an aspect of the control related to certain receivables. (AS 2201.44)

A component of the issuer (“component”) entered into contracts with customers in which revenue was recognized over time based on the extent of progress towards completion of the performance obligation. The following deficiency was identified: · The firm selected for testing a control that consisted of the component's review of gross receivables. The firm did not identify and test any controls over the accuracy and completeness of certain data used in the operation of the control. (AS 2201.39)

A component of the issuer (“component”) entered into contracts with customers in which revenue was recognized over time based on the extent of progress towards completion of the performance obligation. The following deficiency was identified: · The firm did not perform any substantive procedures to evaluate the appropriateness of certain revenue recognized for new and modified customer contracts. (AS 2301.08)

A component of the issuer (“component”) entered into contracts with customers in which revenue was recognized over time based on the extent of progress towards completion of the performance obligation. The following deficiency was identified: · The firm's approach for substantively testing certain revenue consisted primarily of performing a software-assisted analysis to test the relationships among revenue accounts receivable and cash receipts. The firm did not perform any substantive procedures to test the underlying revenue transactions for revenue with no relationship to accounts receivable. (AS 2301.08)

A component of the issuer (“component”) entered into contracts with customers in which revenue was recognized over time based on the extent of progress towards completion of the performance obligation. The following deficiency was identified: · The firm did not perform any substantive procedures to test certain revenue. (AS 2301.08 and .13)