Explorer

The issuer used an IT system to retain certain data related to revenue and deferred revenue. The firm selected for testing a control that included the issuer's review of the configuration of the tool the issuer used to transfer data into this IT system. The firm did not evaluate the specific review procedures that the control owners performed to assess the configuration of this tool. (AS 2201.42 and .44)

With respect to one type of revenue and the related deferred revenue the following deficiency was identified: · The firm selected for testing controls related to the issuer's allocation of certain transactions between this revenue and the related deferred revenue. For two of these controls the firm did not evaluate the specific review procedures that the control owners performed to assess the appropriateness of this allocation. (AS 2201.42 and .44)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to revenue and deferred revenue. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to change management: The issuer had various change management processes for these IT systems including the use of a tool to manage and migrate changes into the production environment. The firm selected for testing controls over change management for certain systems including a control that consisted of the issuer's periodic review of access to the production environment. The following deficiencies were identified: · The firm did not evaluate the specific review procedures the control owner performed to determine whether user access to the production environment that had been previously granted continued to be appropriate. (AS 2201.42 and .44)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to revenue and deferred revenue. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: · The firm selected for testing a control over user access for certain systems. The firm did not evaluate the specific review procedures the control owner performed to determine whether access was appropriately granted for the instances selected for testing. (AS 2201.42 and .44)

The firm selected for testing controls over the issuer's reviews of transaction reports and the resulting monthly journal entries used to record service revenue and deferred revenue. The firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

The firm selected for testing certain controls that consisted of the issuer's reviews of revenue and deferred revenue. For one of these controls the firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)