Explorer

The issuer used multiple IT systems to initiate process and record transactions related to certain revenue and derivatives. The firm tested ITGCs for these IT systems. The following deficiencies were identified: · The firm did not perform any substantive procedures to test or in the alternative test any controls over the completeness of the system-generated reports that it used to select its sample for testing controls over change management for certain of these systems. (AS 1105.10)

The issuer used multiple IT systems to initiate process and record transactions related to certain revenue and derivatives. The firm tested ITGCs for these IT systems. The following deficiencies were identified: · The firm selected for testing a control over the segregation of duties related to the ability to develop and implement changes to these IT systems. In its testing of the operating effectiveness of this control for certain of these systems the firm did not test whether users with the ability to implement changes also had the ability to develop changes. (AS 2201.44)

The issuer used multiple IT systems to initiate process and record transactions related to certain revenue and derivatives. The firm tested ITGCs for these IT systems. The following deficiencies were identified: · The firm selected for testing a control over the approval of new or modified user access to these IT systems. In its testing of the operating effectiveness of this control the firm (1) excluded certain types of new users from its testing population and (2) did not test the aspect of this control related to the modification of access for existing users. (AS 2201.44)

The issuer used multiple IT systems to initiate process and record transactions related to certain revenue and derivatives. The firm tested ITGCs for these IT systems. The following deficiencies were identified: · The firm selected for testing a control over the removal of access to these systems for terminated users. The firm identified an exception in the operation of this control but did not evaluate the effect of this exception on the operating effectiveness of this control. (AS 2201.48)

The issuer used multiple IT systems to initiate process and record transactions related to certain revenue and derivatives. The firm tested ITGCs for these IT systems. The following deficiencies were identified: · The firm selected for testing a control over the periodic review of user access. For certain of these systems the firm did not identify and test any controls over the accuracy and completeness of the reports that the control owners used in the operation of this control. (AS 2201.39)

The issuer used multiple IT systems to initiate process and record transactions related to certain revenue and derivatives. The firm tested ITGCs for these IT systems. The following deficiencies were identified: · The firm tested various automated controls over this revenue and derivatives that used data from certain of these IT systems. As a result of the deficiencies in the firm's testing of ITGCs discussed above the firm's testing of these automated controls was not sufficient. (AS 2201.46)

The issuer used eight information-technology (IT) applications to initiate process and record transactions related to revenue trade receivables and derivatives. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and/or reports generated or maintained by certain of these IT applications. As a result of the following deficiencies in the firm's testing of IT general controls (ITGCs) the firm's testing of these automated and IT-dependent controls was not sufficient. (AS 2201.46)

With respect to change management: The firm selected for testing certain change management controls over the eight IT applications discussed above that consisted of the documentation review testing and approval of changes prior to their implementation into production. In addition all changes made in the production environment were to be recorded in a ticketing system. For certain instances tested the firm did not perform procedures to test the operating effectiveness of these change management controls beyond verifying the existence of a change ticket recorded in the issuer's ticketing system. (AS 2201.44)