Explorer

With respect to user access: · The firm selected for testing certain controls over the restriction of access to these IT systems. In its testing of the operating effectiveness of one of these controls the firm did not evaluate whether access was appropriately restricted beyond inquiring of management. (AS 2201.42 and .44)

The firm did not identify and test any controls that addressed the issuer's presentation of deferred revenue. (AS 2201.39)

With respect to user access: · The firm selected for testing a control over the issuer's review of requested user access to these IT systems. In its testing of the operating effectiveness of this control the firm excluded a certain type of user from its testing population and instead replaced one of the users selected with one of the excluded type of users. (AS 2201.44)

The firm selected for testing automated controls over the timing of revenue recognition the approval of sales discounts and the calculation of contract progress. The firm did not sufficiently test the design and operating effectiveness of these automated controls as it limited its testing to only certain scenarios without identifying and/or evaluating all relevant configurations. Further for one of these controls the firm tested an aspect of this control in the issuer's IT testing environment rather than in its production environment without performing any procedures to determine whether the testing environment was a complete replica of the production environment. (AS 2201.42 and .44)

With respect to change management: · The firm selected for testing a control over the segregation of duties related to the ability to develop and implement changes to these IT systems. In its testing of the operating effectiveness of this control the firm did not test whether users with the ability to implement changes also had the ability to develop changes. (AS 2201.44)

With respect to user access: · The firm selected for testing certain controls over the restriction of access to these IT systems. In its testing of the operating effectiveness of one of these controls the firm excluded a certain type of user from its testing population. (AS 2201.44)

The firm used certain issuer-produced data in its substantive testing of one type of revenue and the related deferred revenue but did not test or test any controls over the accuracy of these data. (AS 1105.10)

The issuer used an IT system to retain certain data related to revenue and deferred revenue. The firm did not identify and test any controls that addressed the risk that inappropriate changes could be made to the data in this IT system. (AS 2201.39)

The issuer used an IT system to retain certain data related to revenue and deferred revenue. The firm selected for testing a control that included the issuer's review of the configuration of the tool the issuer used to transfer data into this IT system. In evaluating the design of this control the firm did not assess whether the issuer's review occurred with sufficient frequency to address the risks of material misstatement. (AS 2201.42)

The issuer recognized certain of this revenue based on the date when electronic delivery occurred. The firm did not identify and test any controls over the accuracy of these delivery dates. (AS 2201.39)

With respect to one type of revenue and the related deferred revenue the following deficiency was identified: · The issuer recognized certain of this revenue using contractual rates input into the system the issuer used to recognize revenue. The firm did not identify and test any controls over the accuracy of these contractual rates. (AS 2201.39)

With respect to one type of revenue and the related deferred revenue the following deficiency was identified: · The firm selected for testing a control over the automated calculation of certain of this revenue. The firm did not test whether this control operated as designed for each relevant processing alternative. (AS 2201.44)

For certain revenue and the related deferred revenue the firm did not identify and test any controls over certain data that the issuer used to determine whether the performance obligation was satisfied before revenue was recognized. (AS 2201.39)

The firm selected for testing a control over managing changes to the issuer's production environment for each of these IT systems. The following deficiencies were identified: · For two IT systems the firm did not identify and test any controls over the completeness of the populations of changes that the control owners used in the operation of the control. (AS 2201.39)

The firm selected for testing a control over managing changes to the issuer's production environment for each of these IT systems. The following deficiencies were identified: · For another IT system when evaluating the design of the control the firm did not assess whether the control owner's review of system changes was sufficiently precise to achieve the control's objective. (AS 2201.42)

The issuer used a service organization to maintain databases that the issuer used in the recognition of revenue and the related deferred revenue. The firm obtained a service auditor's report and identified complementary user entity controls that the service auditor's report described as necessary. The firm did not perform procedures to evaluate whether the issuer had implemented these controls with respect to one of these databases. (AS 2201.39 and .B22)

The firm selected for testing various manual controls over the issuer's deferred revenue calculation. The following deficiencies were identified: · For another of these controls the firm did not test or test any controls over the completeness of the population of items from which it selected its samples for testing. (AS 1105.10)

The firm's testing of an automated control over deferred revenue was not sufficient because the firm did not test the configuration or programming of this control or perform other procedures to test this control that would have provided sufficient appropriate audit evidence that this control was designed and operating effectively. (AS 2201.42 and .44)

With respect to revenue and deferred revenue at certain business units that the firm subjected to more extensive audit procedures the following deficiencies were identified: The firm selected for testing two controls that consisted of the issuer's (1) identification of matters at its business units that could affect revenue recognition and (2) review of certain new and modified contracts for appropriate revenue recognition. The issuer used the matters identified in the first control as the population of contracts to be reviewed in the second control. The firm did not evaluate whether the first control was designed to address whether a complete population of these new and modified contracts was identified for review in the second control. (AS 2201.42) In connection with our review the issuer reevaluated its controls over revenue including IT controls and concluded that material weaknesses existed that had not been previously identified. The issuer subsequently reflected these material weaknesses in a revision to its report on ICFR and the firm revised and reissued its report on the effectiveness of the issuer's ICFR to include these additional material weaknesses.

The issuer entered into revenue arrangements with multiple elements and allocated the total consideration from these arrangements between the sale of products and services using its best estimate of selling price (“BESP”) under the relative-selling-price method. The issuer determined BESP based on contractual prices or factors of list prices. The firm selected for testing a control that consisted of reviews of the issuer's annual analysis of BESP. The firm did not determine whether the control owners' reviews of this analysis considered whether contractual prices or factors of list prices were the most appropriate selection for BESP. (AS 2201.42 and .44)

The firm selected for testing a control that consisted of the review of all of the issuer's sales transactions including multiple-element arrangements for appropriate revenue recognition. The firm did not evaluate whether the control owners assessed whether prices for extended warranty services that were separately stated on customer invoices represented evidence that customers had the option to purchase these services for an expressly stated amount separate from the price of the product which may have affected the revenue allocation. (AS 2201.42 and .44)

The firm did not identify and test any controls over information that the issuer manually entered into the revenue systems and used to record service revenue and deferred revenue. (AS 2201.39)

The firm identified control deficiencies related to controls over the review and approval of program changes for one of the issuer's revenue systems but did not evaluate the severity of these deficiencies. (AS 2201.62)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to certain revenue and deferred revenue. The following deficiency was identified: · The firm selected for testing certain automated controls over this revenue and deferred revenue that consisted of the configuration of the IT systems to automatically perform certain functions based on pre-established parameters and the firm used a 'test of one' approach to test these controls. The firm's testing of these automated controls using a sample of only one instance of each processing alternative was not sufficient because the firm did not test the configuration or programming of these controls or perform other procedures that would have provided sufficient appropriate audit evidence that these controls were designed and operating effectively. (AS 2201.46)