Explorer

As a result of the firm's ITGC testing deficiencies for revenue unbilled accounts receivable and deferred revenue the firm did not perform sufficient procedures to test or sufficiently test controls over the accuracy and completeness of certain system-generated data or reports the firm used (1) to make its selections to test certain controls or (2) in its substantive testing. (AS 1105.10)

The issuer used certain information technology (IT) systems to initiate process and/or record transactions related to revenue unbilled accounts receivable deferred revenue and inventory. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. As a result of the deficiencies in the firm's testing of IT general controls (ITGCs) the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

The issuer used multiple IT systems to initiate process and/or record transactions related to certain revenue deferred revenue goodwill and/or intangible assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. As a result of the deficiencies in the firm's testing of ITGCs the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

The issuer used multiple IT systems to initiate process and/or record transactions related to certain revenue deferred revenue goodwill and/or intangible assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. With respect to segregation of duties: · For certain IT systems the firm did not identify and test any controls that addressed the risk related to whether users with the ability to develop changes also had the ability to implement these changes. (AS 2201.39)

The issuer used multiple IT systems to initiate process and/or record transactions related to certain revenue deferred revenue goodwill and/or intangible assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. With respect to segregation of duties: · For certain other IT systems the firm selected for testing a control that consisted of the review of segregation of duties. The firm did not test the aspect of the control that addressed whether certain users with the ability to implement changes also had the ability to develop those changes. (AS 2201.42 and .44)

The issuer used multiple IT systems to initiate process and/or record transactions related to certain revenue deferred revenue goodwill and/or intangible assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. With respect to change management: · For certain IT systems the firm selected for testing an automated control over change management. The firm did not sufficiently test the operating effectiveness of this control because the firm did not test whether the control operated as designed for each processing alternative. (AS 2201.44)

The issuer used multiple IT systems to initiate process and/or record transactions related to certain revenue deferred revenue goodwill and/or intangible assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. With respect to change management: · For certain IT systems the firm did not test or in the alternative test any controls over the completeness of the system-generated reports that it used to make its selections for testing certain controls over change management. (AS 1105.10)

As a result of the firm's ITGC testing deficiencies the firm did not perform sufficient other audit procedures as follows: · For certain revenue deferred revenue goodwill and intangible assets the firm did not perform sufficient substantive procedures to test or sufficiently test controls over the accuracy and completeness of certain system-generated data or reports (1) the firm used to make its selections to test certain controls; (2) the firm used in its substantive testing including analytical procedures; or (3) the company's specialists used. (AS 1105.10 and .A8a; AS 2305.16)

As a result of the firm's ITGC testing deficiencies the firm did not perform sufficient other audit procedures as follows: · The firm's substantive procedures to test certain revenue and deferred revenue included substantive analytical procedures. The firm established its thresholds for investigating differences based on a level of control reliance that was not supported due to the above deficiencies in the firm's testing of controls. As a result the thresholds that the firm used did not provide the desired level of assurance that misstatements that could have been material would be identified. (AS 2301.16 .18 and .37; AS 2305.20)

As a result of the firm's ITGC testing deficiencies the firm did not perform sufficient other audit procedures as follows: · The sample size the firm used in certain of its substantive procedures to test certain deferred revenue was too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The issuer used multiple IT systems to initiate process and/or record transactions related to certain revenue and/or deferred revenue. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. As a result of the deficiencies in the firm's testing of ITGCs the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

The issuer used multiple IT systems to initiate process and/or record transactions related to certain revenue and/or deferred revenue. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. With respect to segregation of duties: · For two IT systems the firm selected for testing a control that consisted of the review of segregation of duties. The firm did not test the aspect of the control that addressed whether certain users with administrative access to the tool used to implement changes also had the ability to develop these changes. (AS 2201.42 and .44)

The issuer used multiple IT systems to initiate process and/or record transactions related to certain revenue and/or deferred revenue. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. With respect to segregation of duties: · For another IT system the firm selected for testing two controls that consisted of the review of segregation of duties. The firm did not test beyond inquiry the aspect of the controls that addressed whether certain users with access to the tools used to implement changes also had the ability to develop these changes. (AS 2201.42 and .44)

The issuer used multiple IT systems to initiate process and/or record transactions related to certain revenue and/or deferred revenue. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. With respect to segregation of duties: · For an additional IT system the firm selected for testing an automated control that was designed to address the risk of developers being able to implement changes. The firm's procedures were not sufficient because they did not test the configuration or programming of the automated control or perform other procedures that would have provided sufficient appropriate audit evidence that the control was designed and operating effectively. (AS 2201.42 and .44)

The issuer used multiple IT systems to initiate process and/or record transactions related to certain revenue and/or deferred revenue. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. With respect to change management for one of these IT systems the firm did not identify and test any controls over changes to the underlying master data. (AS 2201.39)

As a result of the firm's ITGC testing deficiencies for certain revenue and deferred revenue the firm did not perform sufficient substantive procedures to test or sufficiently test controls over the accuracy and completeness of certain system-generated data or reports (1) the firm used to make its selections to test certain controls; (2) the firm used in its substantive testing including analytical procedures; or (3) the company's specialists used. (AS 1105.10 and .A8a; AS 2305.16)

The issuer used an IT system to retain certain data related to revenue and deferred revenue. The firm tested certain IT-dependent manual controls that used data from this IT system. As a result of the deficiencies in the firm's testing of controls the firm's testing of these IT-dependent manual controls was not sufficient. (AS 2201.46)

The issuer used multiple IT systems to initiate process and record transactions related to revenue and the related deferred revenue. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. As a result of the following deficiencies in the firm's testing of ITGCs the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to revenue and the related deferred revenue. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. As a result of the following deficiencies in the firm's testing of IT general controls (ITGCs) the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46) In connection with our review the issuer reevaluated its controls over revenue including IT controls and concluded that material weaknesses existed that had not been previously identified. The issuer subsequently reflected these material weaknesses in a revision to its report on ICFR and the firm revised and reissued its report on the effectiveness of the issuer's ICFR to include these additional material weaknesses.

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to revenue and the related deferred revenue. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. ·The firm selected for testing a control over the segregation of duties related to the ability to develop and implement changes to certain of these IT systems. The firm did not test whether users with the ability to implement code changes also had the ability to develop those changes. Further the firm did not test whether the ability to implement configuration changes was appropriately restricted to authorized users. (AS 2201.42 and .44) In connection with our review the issuer reevaluated its controls over revenue including IT controls and concluded that material weaknesses existed that had not been previously identified. The issuer subsequently reflected these material weaknesses in a revision to its report on ICFR and the firm revised and reissued its report on the effectiveness of the issuer's ICFR to include these additional material weaknesses.

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to revenue and the related deferred revenue. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. ·The firm selected for testing controls that consisted of the issuer's testing and approval of system changes prior to implementation into the production environment. In its testing of the operating effectiveness of certain of these controls the firm excluded certain types of changes from its testing population. (AS 2201.44) In connection with our review the issuer reevaluated its controls over revenue including IT controls and concluded that material weaknesses existed that had not been previously identified. The issuer subsequently reflected these material weaknesses in a revision to its report on ICFR and the firm revised and reissued its report on the effectiveness of the issuer's ICFR to include these additional material weaknesses.

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to revenue and the related deferred revenue. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. ·The firm selected for testing controls that consisted of the issuer's testing and approval of system changes prior to implementation into the production environment. For certain other of these controls the firm did not test or test any controls over the completeness of the population of items from which it selected its sample for testing. (AS 1105.10) In connection with our review the issuer reevaluated its controls over revenue including IT controls and concluded that material weaknesses existed that had not been previously identified. The issuer subsequently reflected these material weaknesses in a revision to its report on ICFR and the firm revised and reissued its report on the effectiveness of the issuer's ICFR to include these additional material weaknesses.

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to revenue and the related deferred revenue. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. ·The firm selected for testing controls over the issuer's monitoring of system changes. The firm did not identify and test any controls over the accuracy and completeness of certain reports that the issuer used in the operation of these controls. (AS 2201.39) In connection with our review the issuer reevaluated its controls over revenue including IT controls and concluded that material weaknesses existed that had not been previously identified. The issuer subsequently reflected these material weaknesses in a revision to its report on ICFR and the firm revised and reissued its report on the effectiveness of the issuer's ICFR to include these additional material weaknesses.

The issuer used multiple IT systems to initiate process and/or record transactions related to certain revenue deferred revenue and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. As a result of the following deficiency in the firm's testing of ITGCs the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

With respect to change management: The firm selected for testing a change management control over certain IT systems that consisted of the documentation review testing and approval of changes prior to their migration into production. The firm did not perform procedures to test or test any controls over the completeness of the population of changes from which it made its selections for testing. (AS 1105.10)

As a result of the firm's ITGC testing deficiency discussed above the firm did not perform sufficient substantive procedures as follows: · The firm used certain system-generated data to substantively test deferred revenue long-lived assets and certain revenue but did not test or (as discussed above) sufficiently test controls over the accuracy and completeness of this data. (AS 1105.10)

As a result of the firm's ITGC testing deficiency discussed above the firm did not perform sufficient substantive procedures as follows: · The firm performed substantive analytical procedures as part of its testing of certain revenue and depreciation expense. The firm used certain system-generated data to develop its expectations but did not test or (as discussed above) sufficiently test controls over the accuracy and completeness of this data. (AS 2305.16)

As a result of the firm's ITGC testing deficiency discussed above the firm did not perform sufficient substantive procedures as follows: · The sample size the firm used in certain of its substantive procedures to test revenue and long-lived assets was too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiency in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

In response to ineffective IT general controls over the general ledger and revenue systems for one of its business units the issuer implemented and the firm selected for testing an annual control at year end that consisted of testing a sample of revenue transactions from the revenue system to determine whether revenue had been appropriately recognized. The following deficiencies were identified: · The firm did not identify that this annual control did not address the accuracy and completeness of the data and reports that were derived from the revenue system throughout the year and used in the operation of certain IT-dependent manual controls that the firm had selected for testing. (AS 2201.68)

In response to ineffective IT general controls over the general ledger and revenue systems for one of its business units the issuer implemented and the firm selected for testing an annual control at year end that consisted of testing a sample of revenue transactions from the revenue system to determine whether revenue had been appropriately recognized. The following deficiencies were identified: · The firm did not sufficiently test the annual control because the firm did not (1) evaluate whether the issuer's selection process resulted in all transactions having an opportunity of being selected and (2) test the control owner's procedures to determine whether revenue or deferred revenue had been appropriately recorded for certain items selected for testing. Further the firm did not identify and test any controls over the completeness of the reports derived from the revenue system that the control owner used to select transactions for testing. (AS 2201.68)

In response to ineffective IT general controls over the general ledger and revenue systems for one of its business units the issuer implemented and the firm selected for testing an annual control at year end that consisted of testing a sample of revenue transactions from the revenue system to determine whether revenue had been appropriately recognized. The following deficiencies were identified: · The firm did not identify and test any controls over the accuracy and completeness of the data derived from the general ledger system that were used in the operation of certain IT-dependent manual controls that the firm had selected for testing. (AS 2201.68)

In response to ineffective IT general controls over the general ledger and revenue systems for one of its business units the issuer implemented and the firm selected for testing an annual control at year end that consisted of testing a sample of revenue transactions from the revenue system to determine whether revenue had been appropriately recognized. The following deficiencies were identified: · The sample sizes the firm used in certain of its substantive procedures to test this revenue were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The issuer used an internally developed information-technology (IT) system to calculate the amount of revenue and the related deferred revenue to be recorded for certain revenue transactions. The following deficiencies were identified: · The firm selected for testing certain automated and IT-dependent manual controls over this revenue and the related deferred revenue. The firm's approach to testing these controls depended on effective IT general controls (ITGCs) including controls over change management. As a result of the deficiency in the firm's testing of the control discussed above the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

The firm selected for testing certain automated and IT-dependent manual controls over this revenue and the related deferred revenue. The firm's approach to testing these controls depended on effective IT general controls (ITGCs) including controls over change management. As a result of the deficiency in the firm's testing of the control discussed above the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to revenue and deferred revenue. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. As a result of the following deficiencies in the firm's testing of IT general controls (ITGCs) the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to revenue and deferred revenue. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to change management: The issuer had various change management processes for these IT systems including the use of a tool to manage and migrate changes into the production environment. The firm selected for testing controls over change management for certain systems including a control that consisted of the issuer's periodic review of access to the production environment. The following deficiencies were identified: · The firm did not identify and test any controls over the accuracy and completeness of certain information that the control owners used in the operation of this control. (AS 2201.39)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to revenue and deferred revenue. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to change management: The issuer had various change management processes for these IT systems including the use of a tool to manage and migrate changes into the production environment. The firm selected for testing controls over change management for certain systems including a control that consisted of the issuer's periodic review of access to the production environment. The following deficiencies were identified: · To test certain other change management controls the firm selected changes from the issuer's change management tool but did not test or test any controls over the completeness of the population of changes from which it selected its samples for testing. (AS 1105.10)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to revenue and deferred revenue. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: · The firm selected for testing a control over user access for certain systems. The firm did not identify and test any controls over the accuracy and completeness of certain information that the control owner used in the operation of this control. (AS 2201.39)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to certain revenue and deferred revenue. The following deficiency was identified: · As a result of the deficiencies in the firm's testing of the automated controls described above the firm's testing of certain IT-dependent manual controls was not sufficient because those manual controls relied on the effectiveness of these automated controls. (AS 2201.46)

The issuer used multiple IT systems to initiate process and/or record transactions related to certain revenue receivables deferred revenue and inventory. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. As a result of the following deficiency in the firm's testing of IT general controls (ITGCs) the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

The issuer used multiple IT systems to initiate process and/or record transactions related to certain revenue receivables deferred revenue and inventory. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. The firm selected for testing various change management controls over certain IT systems that consisted of the documentation review testing and approval of changes prior to their migration into production. The issuer used certain other IT systems in the performance of these change management controls ('change management systems') and the firm made its selections for testing the change management controls from reports that were generated from the change management systems subsequent to year end. The firm did not perform sufficient procedures to test the completeness of the system-generated reports from which it made its selections for testing because the firm's use of the change management systems as the source of the population of changes relied on the automated functionality of those systems and the firm did not evaluate whether changes were made to the change management systems during the period from year end to the date of testing. (AS 1105.10)

The issuer used multiple IT systems to initiate process and/or record transactions related to certain revenue receivables deferred revenue and inventory. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. As a result of the firm's ITGC testing deficiencies the firm did not perform sufficient substantive procedures as follows: · The firm used certain system-generated data to substantively test revenue receivables deferred revenue and inventory but did not test or (as discussed above) sufficiently test controls over the accuracy and completeness of this data. (AS 1105.10)

The issuer used multiple IT systems to initiate process and/or record transactions related to certain revenue receivables deferred revenue and inventory. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. As a result of the firm's ITGC testing deficiencies the firm did not perform sufficient substantive procedures as follows: · The sample size the firm used in certain of its substantive procedures to test revenue was too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)