Explorer

The firm selected for testing a control over management's review of the allowance for doubtful accounts calculation. The firm did not evaluate the review procedures that the control owner performed to assess the reasonableness of the assumptions used to determine the allowance including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

The firm's approach for substantively testing the allowance for doubtful accounts was to review and test management's process. The firm did not sufficiently evaluate the reasonableness of the allowance because the firm did not perform procedures to test the reasonableness of the reserve percentages used by the issuer to estimate the allowance for doubtful accounts. (AS 2501.09 .10 and .11)

The firm was instructed by the principal auditor to audit the financial statements and the effectiveness of ICFR of a subsidiary of the issuer to support the principal auditor's opinions on the consolidated financial statements and ICFR. The firm identified control deficiencies in controls that it had selected for testing over revenue accounts receivable and inventory for the subsidiary's two branches. The firm did not evaluate the severity of certain identified control deficiencies in accordance with the instructions of the principal auditor. (AS 2201.62)

The sample sizes the firm used in certain of its substantive procedures to test revenue accounts receivable and inventory for both branches were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The firm was instructed by the principal auditor to audit the financial statements and the effectiveness of ICFR of two of the issuer's subsidiaries to support the principal auditor's opinions on the consolidated financial statements and ICFR. The issuer's processes related to revenue accounts receivable and inventory included automated transactions initiated processed and recorded by information technology ('IT') systems at both subsidiaries. The firm selected for testing automated and IT-dependent manual controls over revenue accounts receivable and inventory that used data and reports generated by the IT systems. The firm's approach to test the accuracy and completeness of the data and reports depended on effective IT general controls ('ITGCs'). For one subsidiary the firm identified several control deficiencies related to ITGCs. The firm did not evaluate the severity of the identified control deficiencies in accordance with the instructions of the principal auditor. (AS 2201.62)

The firm was instructed by the principal auditor to audit the financial statements and the effectiveness of ICFR of two of the issuer's subsidiaries to support the principal auditor's opinions on the consolidated financial statements and ICFR. The issuer's processes related to revenue accounts receivable and inventory included automated transactions initiated processed and recorded by information technology ('IT') systems at both subsidiaries. The firm selected for testing automated and IT-dependent manual controls over revenue accounts receivable and inventory that used data and reports generated by the IT systems. The firm's approach to test the accuracy and completeness of the data and reports depended on effective IT general controls ('ITGCs'). For the other subsidiary the firm did not test ITGCs or obtain confirmation from the principal auditor that ITGCs were not in scope for testing. (AS 2201.39)

The firm was instructed by the principal auditor to audit the financial statements and the effectiveness of ICFR of two of the issuer's subsidiaries to support the principal auditor's opinions on the consolidated financial statements and ICFR. The issuer's processes related to revenue accounts receivable and inventory included automated transactions initiated processed and recorded by information technology ('IT') systems at both subsidiaries. The firm selected for testing automated and IT-dependent manual controls over revenue accounts receivable and inventory that used data and reports generated by the IT systems. The firm's approach to test the accuracy and completeness of the data and reports depended on effective IT general controls ('ITGCs'). For one subsidiary the firm identified several control deficiencies related to ITGCs. The firm did not evaluate the severity of the identified control deficiencies in accordance with the instructions of the principal auditor. (AS 2201.62) For the other subsidiary the firm did not test ITGCs or obtain confirmation from the principal auditor that ITGCs were not in scope for testing. (AS 2201.39) As a result the firm's testing of the automated and IT-dependent manual controls over revenue accounts receivable and inventory for these two subsidiaries was not sufficient. (AS 2201.46)

The sample sizes the firm used in certain of its substantive procedures to test revenue accounts receivable and inventory for both subsidiaries were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The issuer recorded revenue net of estimated allowances for contractual adjustments. The firm selected for testing controls that consisted of the monthly review of (1) the reasonableness of the estimated allowances for contractual adjustments and (2) the comparison of net revenue to cash collections. The firm did not identify and test any controls over (1) the accuracy and completeness of a report used in the operation of one of these controls and (2) the accuracy and/or completeness of certain data that were used in the operation of both controls. (AS 2201.39)

The issuer entered into revenue arrangements with multiple elements including arrangements that contained fees contingent upon the resolution of certain matters that were beyond the issuer's control (“contingent fees”). The issuer's policy was to recognize revenue and the related receivable from certain arrangements that contained contingent fees when services were provided which generally occurred before the resolution of the contingent matters. The following deficiencies were identified: · In addition the firm did not identify and appropriately address the inconsistency between the issuer's accounting for this revenue and its disclosure that it recognized revenue when the fee was fixed or determinable and collectability was reasonably assured. (AS 2810.30 and .31)

The issuer entered into revenue arrangements with multiple elements including arrangements that contained fees contingent upon the resolution of certain matters that were beyond the issuer's control (“contingent fees”). The issuer's policy was to recognize revenue and the related receivable from certain arrangements that contained contingent fees when services were provided which generally occurred before the resolution of the contingent matters. The following deficiencies were identified: · The firm did not evaluate whether (1) the issuer identified all elements in its arrangements and appropriately determined the units of accounting and (2) separate contracts entered into with the same individual customers within a short time frame should have been combined and accounted for as multiple-element arrangements. (AS 2301.08)

The firm did not test the accuracy of the billing rates that the issuer used to determine the allowances for contractual adjustments. Further the firm did not sufficiently test the accuracy and completeness of the cash collection data the issuer used to determine the allowances because the firm limited its procedures to comparing the data to a system-generated report that it had not tested. (AS 2501.11)

The issuer reclassified credit balances in accounts receivable to accounts payable at year end. The firm did not identify and test any controls that addressed the risk that these credit balances may have resulted from errors in the allowances for contractual adjustments. (AS 2201.39)

The firm did not perform any substantive procedures to corroborate management's assertion that the credit balances discussed above represented amounts due to third parties rather than errors in the amounts recorded as allowances for contractual adjustments. (AS 2301.08)

The issuer entered into revenue arrangements with multiple elements including arrangements that contained fees contingent upon the resolution of certain matters that were beyond the issuer's control (“contingent fees”). The issuer's policy was to recognize revenue and the related receivable from certain arrangements that contained contingent fees when services were provided which generally occurred before the resolution of the contingent matters. The following deficiencies were identified: · For certain of the issuer's revenue the firm did not identify and test any controls that addressed whether the issuer's revenue recognition policies for its multiple-element arrangements including those with contingent fees were in conformity with GAAP. (AS 2201.39)

The issuer entered into revenue arrangements with multiple elements including arrangements that contained fees contingent upon the resolution of certain matters that were beyond the issuer's control (“contingent fees”). The issuer's policy was to recognize revenue and the related receivable from certain arrangements that contained contingent fees when services were provided which generally occurred before the resolution of the contingent matters. The following deficiencies were identified: · The firm did not evaluate whether the issuer's accounting for recognizing revenue for contingent fees prior to the resolution of the contingent matters and the determination of the amount to be collected was in conformity with FASB ASC Topic 605 Revenue Recognition and with GAAP as interpreted by the SEC Codification of Staff Accounting Bulletins Topic 13 Revenue Recognition. (AS 2810.30)

The firm identified deficiencies in the information technology general controls ('ITGCs') related to security administration for the issuer's general ledger system and two of its revenue systems and concluded that these deficiencies in the aggregate represented a significant deficiency. The firm also identified a deficiency in the ITGCs related to program maintenance over these revenue systems. The following audit deficiencies were identified: · With respect to the security administration control deficiencies the firm identified compensating controls but did not evaluate whether these controls would mitigate the risks including fraud risks posed by the ITGC deficiencies. Further in performing its testing of the identified compensating controls the firm did not (1) identify that the control owners used data and reports in the performance of certain of these controls that were produced by the systems that were subject to the ITGC deficiencies and (2) as discussed below sufficiently test certain of these controls. (AS 2201.68) Unrelated to our review the issuer reevaluated its controls over security administration and program maintenance ITGCs and concluded that a material weakness existed that had not been previously identified. The issuer subsequently revised its report on ICFR to reflect this material weakness and the other material weaknesses discussed herein and the firm modified its opinion on the effectiveness of the issuer's ICFR to express an adverse opinion and reissued its report.

The firm selected for testing a control over the issuer's review of the allowance for doubtful accounts. The following deficiencies were identified: · The firm did not evaluate the review procedures that the control owner performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

The firm selected for testing a control over the issuer's review of the allowance for doubtful accounts. The following deficiencies were identified: · The firm did not identify and test any controls that addressed the reasonableness of the reserve percentage the issuer applied to certain past-due accounts receivable to determine the allowance for doubtful accounts during the operation of this control. (AS 2201.39)

The firm selected for testing a control over the issuer's review of the allowance for doubtful accounts. The following deficiencies were identified: · While performing its substantive procedures the firm identified an error in the issuer's estimate of the allowance for doubtful accounts. As a result of this error the firm identified that an aspect of this control was deficient but concluded that the remaining aspects of the control served as a compensating control. The firm did not perform procedures to evaluate whether the remaining aspects of this control would accomplish the control's objectives. (AS 2201.68)

The firm did not perform substantive procedures to test or (as a result of the ITGC deficiencies discussed above) sufficiently test controls over the accuracy of certain system-generated data it used in its substantive testing of the valuation of accounts receivable. (AS 2501.11)

The firm identified deficiencies in the information technology general controls ('ITGCs') related to security administration for the issuer's general ledger system and two of its revenue systems and concluded that these deficiencies in the aggregate represented a significant deficiency. The firm also identified a deficiency in the ITGCs related to program maintenance over these revenue systems. The following audit deficiencies were identified: · In its testing of controls over revenue accounts receivable goodwill and certain long-lived assets the firm tested certain automated controls and IT-dependent manual controls that used data and reports generated or maintained by these systems. As a result of the deficiencies discussed above the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46) Unrelated to our review the issuer reevaluated its controls over security administration and program maintenance ITGCs and concluded that a material weakness existed that had not been previously identified. The issuer subsequently revised its report on ICFR to reflect this material weakness and the other material weaknesses discussed herein and the firm modified its opinion on the effectiveness of the issuer's ICFR to express an adverse opinion and reissued its report.

The firm identified deficiencies in the information technology general controls ('ITGCs') related to security administration for the issuer's general ledger system and two of its revenue systems and concluded that these deficiencies in the aggregate represented a significant deficiency. The firm also identified a deficiency in the ITGCs related to program maintenance over these revenue systems. The following audit deficiencies were identified: · The firm did not appropriately evaluate whether the ITGC deficiencies individually or in combination represented a material weakness. (AS 2201.62) Unrelated to our review the issuer reevaluated its controls over security administration and program maintenance ITGCs and concluded that a material weakness existed that had not been previously identified. The issuer subsequently revised its report on ICFR to reflect this material weakness and the other material weaknesses discussed herein and the firm modified its opinion on the effectiveness of the issuer's ICFR to express an adverse opinion and reissued its report.

The issuer used an information technology (IT) system to process and record transactions related to revenue accounts receivable and cash. The firm identified control deficiencies in certain IT general controls (ITGCs) over this IT system related to individuals having segregation of duties conflicts that provided these individuals with security administration privileges and the ability to both develop changes and migrate them into production. The following audit deficiencies were identified: · The firm identified and tested a compensating control that it believed would mitigate these ITGC deficiencies. The firm did not identify that this compensating control did not address the risks related to these deficiencies because the control owners performing the compensating control were among the individuals that the firm identified as having the segregation of duties conflicts. (AS 2201.68)

The issuer used an information technology (IT) system to process and record transactions related to revenue accounts receivable and cash. The firm identified control deficiencies in certain IT general controls (ITGCs) over this IT system related to individuals having segregation of duties conflicts that provided these individuals with security administration privileges and the ability to both develop changes and migrate them into production. The following audit deficiencies were identified: · The firm tested certain automated and IT-dependent manual controls over revenue accounts receivable and cash that used data and reports generated or maintained by this IT system. As a result of the audit deficiency discussed above the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

The sample sizes the firm used in certain of its substantive procedures to test revenue and accounts receivable were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The issuer used a service organization to process certain revenue and accounts receivable. The firm obtained two service auditor's reports that addressed information technology general controls (ITGCs) at this service organization. The service auditor's report that addressed 11 months of the year under audit contained a qualified opinion for certain ITGCs that were ineffective. The firm did not perform any procedures to evaluate the effect of this qualified opinion on the audit. (AS 2201.B21)

The issuer recorded certain revenue net of estimated allowances for contractual adjustments. These estimated allowances were determined based in part on historical cash collections data applied at the transaction level. The firm did not identify and test any controls that addressed the accuracy of these data. (AS 2201.39)

For certain customer contracts the firm did not identify and test any controls that addressed whether relevant terms and conditions were identified and evaluated for appropriate revenue recognition. (AS 2201.39)

The sample sizes the firm used in certain of its substantive procedures to test this revenue were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The firm did not perform substantive procedures to evaluate the terms and conditions included in certain customer contracts when testing whether the issuer appropriately recognized revenue related to these contracts. (AS 2301.08)

The issuer initiated and processed transactions related to revenue accounts receivable and inventory at several business units. The firm selected for testing an entity-level control that consisted of the issuer's review of quarterly financial information including revenue accounts receivable and inventory. The firm did not evaluate the specific review procedures that the control owner performed to determine whether items identified for follow up were appropriately resolved. (AS 2201.42 and .44)

The issuer initiated and processed transactions related to revenue accounts receivable and inventory at several business units. The firm selected for testing an entity-level control that consisted of the issuer's review of quarterly financial information including revenue accounts receivable and inventory. The firm did not identify that this entity-level control was not designed to address an identified fraud risk. (AS 2201.42)

The sample sizes the firm used in its substantive procedures to test revenue and accounts receivable at certain of the issuer's business units were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

To test accounts receivable at one of the issuer's business units the firm performed confirmation procedures for a sample of customer accounts. The firm did not maintain control over the confirmation requests sent to customers. (AS 2310.28)

To test accounts receivable at one of the issuer's business units the firm performed confirmation procedures for a sample of customer accounts. The firm did not consider performing procedures to verify the source of responses that were returned by email. (AS 2310.29)

The firm did not evaluate certain evidence that indicated that the accounts receivable from one of the issuer's customers may not be fully collectible. (AS 2301.08 and. 11; AS 2810.03)

For revenue at one of the issuer's segments the firm did not identify and test any controls over the accuracy and completeness of certain customer order data that were entered or transferred into the issuer's systems and used to recognize revenue. (AS 2201.39)

The sample sizes the firm used in its substantive procedures to test revenue and accounts receivable at this segment were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiency in the firm's control testing. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

With respect to the issuer's allowance for doubtful accounts the following deficiencies were identified: · The firm selected for testing a control that consisted of the issuer's review of the allowance for doubtful accounts at one of the issuer's business units. The firm did not evaluate the review procedures that the control owner performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

With respect to the issuer's allowance for doubtful accounts the following deficiencies were identified: · The firm's approach for substantively testing the allowance for doubtful accounts at this business unit was to test the issuer's process. The firm did not perform any procedures to evaluate the reasonableness of the significant assumptions the issuer used to develop this allowance. (AS 2501.16)

With respect to revenue and accounts receivable at certain other business units that the firm subjected to less extensive audit procedures the following deficiencies were identified: · The firm selected for testing an entity-level control that included the issuer's comparison of forecasts by business unit to actual results including revenue. The firm did not identify and test any controls over the forecasts used in the operation of this control. (AS 2201.39)

With respect to revenue and accounts receivable at certain other business units that the firm subjected to less extensive audit procedures the following deficiencies were identified: · The firm did not perform any substantive procedures to test revenue and accounts receivable for these business units. (AS 2301.08)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to certain revenue and the related accounts receivable. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. As a result of the following deficiencies in the firm's testing of IT general controls (ITGCs) the firm's testing of these automated and IT dependent manual controls was not sufficient. (AS 2201.46)

The firm selected for testing various user access and change management controls over these IT systems that consisted of the issuer's reviews of (1) the granting and monitoring of user access and (2) changes to the production environment of these IT systems. The following deficiency was identified: · The firm did not perform sufficient procedures to test the design of these controls because it did not evaluate whether (1) the controls were designed to satisfy the issuer's control objectives and (2) the control owners possessed the necessary authority and competence to perform the controls. (AS 2201.42)

The firm selected for testing various user access and change management controls over these IT systems that consisted of the issuer's reviews of (1) the granting and monitoring of user access and (2) changes to the production environment of these IT systems. The following deficiency was identified: · The firm did not identify and test any controls over the accuracy and completeness of certain system-generated information that were used in the operation of these controls. (AS 2201.39)

The firm selected for testing various user access and change management controls over these IT systems that consisted of the issuer's reviews of (1) the granting and monitoring of user access and (2) changes to the production environment of these IT systems. The following deficiency was identified: · The firm used certain system-generated information (1) in its testing of these controls and/or (2) to make selections to test certain controls but did not perform procedures to test or test any controls over the accuracy and/or completeness of this information. Further the firm used other information in its testing of certain of these controls but did not sufficiently test or test controls over the accuracy and completeness of this information because it did not test how the information was generated. (AS 1105.10)

The firm selected for testing various user access and change management controls over these IT systems that consisted of the issuer's reviews of (1) the granting and monitoring of user access and (2) changes to the production environment of these IT systems. The following deficiency was identified: · In its testing of a control over user access the firm identified a deviation indicating that an individual may have had inappropriate access to one of these systems. The firm determined that this deviation did not affect its conclusion on the operating effectiveness of this control based on certain system-generated information provided by the issuer. The firm did not sufficiently evaluate the effect of this deviation on the operating effectiveness of this control because it did not test or test controls over the accuracy and completeness of this information. (AS 1105.10; AS 2201.48)

As a result of the firm's ITGC testing deficiencies the firm did not perform sufficient substantive procedures over this revenue and the related accounts receivable as follows: · The sample sizes that the firm used in certain of its substantive procedures to test these accounts were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

As a result of the firm's ITGC testing deficiencies the firm did not perform sufficient substantive procedures over this revenue and the related accounts receivable as follows: · The firm did not perform sufficient procedures to test or sufficiently test controls over the accuracy and completeness of certain system-generated information that the firm used in its substantive testing. (AS 1105.10)