Explorer

The issuer identified a control deficiency related to unauthorized access to customer accounts that resulted in two fraudulent wire-transfer requests that occurred at one of its locations. The firm did not sufficiently evaluate the severity of the control deficiency because it limited its evaluation of the magnitude of the potential misstatement to one of the fraudulent wire-transfer requests at the affected location without considering the issuer's other locations that were subject to the same controls. (AS 2201.62) In connection with our review the issuer evaluated its controls over wire transfers and concluded that a material weakness existed that had not been previously identified. The issuer subsequently revised its report on ICFR to reflect this material weakness and the material weakness discussed above and the firm modified its report on the effectiveness of the issuer's ICFR to express an adverse opinion and reissued its report.

In response to this control deficiency the issuer made changes to the design of one of its wire-transfer controls. The firm did not perform any procedures to evaluate the changes made to the design of this control. (AS 2201.68) In connection with our review the issuer evaluated its controls over wire transfers and concluded that a material weakness existed that had not been previously identified. The issuer subsequently revised its report on ICFR to reflect this material weakness and the material weakness discussed above and the firm modified its report on the effectiveness of the issuer's ICFR to express an adverse opinion and reissued its report.