Explorer

The issuer used multiple information-technology (IT) systems to initiate process and record inventory and inventory-related transactions. In its testing of controls over inventory the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to other tests of controls and substantive procedures related to inventory certain of which were affected by the audit deficiencies discussed above related to user access and change management the following additional deficiency was identified: · To test the existence of certain inventory the firm observed the physical inventory counts at all locations and performed procedures to test the rollforward of inventory from the dates in which the inventory was physically counted to year-end using system-generated reports provided by the issuer. The firm did not perform sufficient procedures to test the existence of certain inventory. Specifically the firm's observation procedures were not suitable because the firm did not perform any substantive procedures to reconcile the quantities of certain inventory counted as reflected in the stock count records to the issuer's inventory records. Therefore these observations did not provide sufficient evidence of the quantity of inventory at these locations. (AS 2510.09)

The issuer used multiple information-technology (IT) systems to initiate process and record inventory and inventory-related transactions. In its testing of controls over inventory the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to other tests of controls and substantive procedures related to inventory certain of which were affected by the audit deficiencies discussed above related to user access and change management the following additional deficiency was identified: · To test the existence of certain inventory the firm observed the physical inventory counts at all locations and performed procedures to test the rollforward of inventory from the dates in which the inventory was physically counted to year-end using system-generated reports provided by the issuer. The firm did not perform sufficient procedures to test the existence of certain inventory. The firm did not perform sufficient procedures to evaluate the reliability of a report used to test the rollforward of certain inventory quantities from the dates in which the inventory was physically counted to year-end because it did not evaluate the nature and cause of certain exceptions identified during its substantive audit procedures. (AS 1105.04 and .06)

The issuer used multiple information-technology (IT) systems to initiate process and record inventory and inventory-related transactions. In its testing of controls over inventory the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to other tests of controls and substantive procedures related to inventory certain of which were affected by the audit deficiencies discussed above related to user access and change management the following additional deficiency was identified: · The firm did not perform procedures to extend its conclusions regarding the existence and valuation of inventory assay results from the interim date in which the audit procedures were performed to year-end beyond obtaining and reviewing minutes from certain laboratory quality review meetings and the accompanying presentations. (AS 2301.45)

The issuer used multiple information-technology (IT) systems to initiate process and record inventory and inventory-related transactions. In its testing of controls over inventory the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: The issuer's IT systems had development testing/quality assurance (QA) and production environments. Changes to the IT systems were typically tested in the testing environment prior to their migration to the production environment. Changes could however be made directly in the production environment in certain situations on an emergency basis. The firm performed a review of the security settings in place over certain of the issuer's accounting systems using an unapproved custom software audit tool that included tests of privileged access password settings and client production settings. The firm also selected for testing a control over user access to the production environment of these IT systems that consisted of (1) a security setting in these systems that would not allow any direct changes to be made in the production environment by any user and (2) management's review and approval of a system-generated report that listed any changes made to the system security settings. The following deficiency was identified: · The firm did not select for testing any instances in which the control over user access to the production environment of these IT systems operated because there were no changes made to the system security settings during the periods that were selected for testing. (AS 2201.42 and .44)

The issuer used multiple information-technology (IT) systems to initiate process and record inventory and inventory-related transactions. In its testing of controls over inventory the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: The issuer's IT systems had development testing/quality assurance (QA) and production environments. Changes to the IT systems were typically tested in the testing environment prior to their migration to the production environment. Changes could however be made directly in the production environment in certain situations on an emergency basis. The issuer managed the provisioning of emergency privileged access rights which allowed users with such rights to make direct changes to the production environments of certain IT systems. The firm selected for testing controls over the assignment of privileged access rights for these systems that consisted of the system administrators' review and approval of privileged access requests. The following deficiency was identified: · The firm did not evaluate the specific review procedures that the control owners performed to assess the appropriateness of the provisioning and activity during the privileged access sessions to ensure that only approved activity was executed on these systems. (AS 2201.42 and .44)

The issuer used multiple information-technology (IT) systems to initiate process and record inventory and inventory-related transactions. In its testing of controls over inventory the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: The issuer's IT systems had development testing/quality assurance (QA) and production environments. Changes to the IT systems were typically tested in the testing environment prior to their migration to the production environment. Changes could however be made directly in the production environment in certain situations on an emergency basis. The issuer managed the provisioning of emergency privileged access rights which allowed users with such rights to make direct changes to the production environments of certain IT systems. The firm selected for testing controls over the assignment of privileged access rights for these systems that consisted of the system administrators' review and approval of privileged access requests. The following deficiency was identified: · For one control the firm did not perform sufficient procedures to test or test any controls over the completeness of the population of privileged access requests from which it made its selection for testing because the firm limited its selection to the population of active accounts of users with privileged access rights. (AS 1105.10)

The issuer used multiple information-technology (IT) systems to initiate process and record inventory and inventory-related transactions. In its testing of controls over inventory the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: The issuer's IT systems had development testing/quality assurance (QA) and production environments. Changes to the IT systems were typically tested in the testing environment prior to their migration to the production environment. Changes could however be made directly in the production environment in certain situations on an emergency basis. The issuer managed the provisioning of emergency privileged access rights which allowed users with such rights to make direct changes to the production environments of certain IT systems. The firm selected for testing controls over the assignment of privileged access rights for these systems that consisted of the system administrators' review and approval of privileged access requests. The following deficiency was identified: · The number of privileged access requests selected for testing did not provide sufficient appropriate audit evidence because the firm limited its selection to one account for one month and did not perform any procedures to test the effectiveness of the control over the remaining audit period. (AS 2201.46)

The issuer used multiple information-technology (IT) systems to initiate process and record inventory and inventory-related transactions. In its testing of controls over inventory the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: The issuer's IT systems had development testing/quality assurance (QA) and production environments. Changes to the IT systems were typically tested in the testing environment prior to their migration to the production environment. Changes could however be made directly in the production environment in certain situations on an emergency basis. Access to another IT system was controlled through the assignment of roles such as 'read-only ' 'edit ' and 'administrator ' to users for access to this system and related database for the accounting tables and modules. The firm selected for testing a control over user access to this system and related database that consisted of management's periodic review of a list of users with administrator roles to determine whether (1) the assignment of such roles was authorized (2) the access profiles were valid and (3) all manual changes made to the tables agreed to an approved change request. The following deficiency was identified: · The firm did not identify and test any controls over the accuracy and completeness of the reports used in the operation of the control. (AS 2201.39)

The issuer used multiple information-technology (IT) systems to initiate process and record inventory and inventory-related transactions. In its testing of controls over inventory the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: The issuer's IT systems had development testing/quality assurance (QA) and production environments. Changes to the IT systems were typically tested in the testing environment prior to their migration to the production environment. Changes could however be made directly in the production environment in certain situations on an emergency basis. Access to another IT system was controlled through the assignment of roles such as 'read-only ' 'edit ' and 'administrator ' to users for access to this system and related database for the accounting tables and modules. The firm selected for testing a control over user access to this system and related database that consisted of management's periodic review of a list of users with administrator roles to determine whether (1) the assignment of such roles was authorized (2) the access profiles were valid and (3) all manual changes made to the tables agreed to an approved change request. The following deficiency was identified: · The firm did not evaluate the specific review procedures that the control owners performed to determine whether access was appropriate and that the roles were adequately restricted or granted to users to prevent unauthorized and inappropriate access to this system and related database. (AS 2201.42 and .44)

The issuer used multiple information-technology (IT) systems to initiate process and record inventory and inventory-related transactions. In its testing of controls over inventory the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to change management: The firm selected for testing change management controls over an IT system that consisted of the documentation review testing and approval of changes in the testing/QA environment prior to their migration into production. The firm did not obtain evidence that testing was performed and reviewed by the control owners for nearly half of the system changes selected for testing. (AS 2201.42 and .44)

For one of the locations the firm identified and tested a compensating control to address a control deficiency it identified related to access and the ability to make changes to the general ledger. This compensating control related to testing reviewing and approving changes prior to migration into the general ledger system. The firm did not evaluate the implications of one type of users' ability to modify certain information used in the operation of this control. (AS 2201.68)

The firm did not identify and test any controls that addressed whether the inventory subsidiary ledgers for these business units accurately calculated inventory values using the correct item cost at year end. (AS 2201.39)

The firm did not identify and test any controls over the calculation of last-in first-out values for one category of inventory. (AS 2201.39)

For the other two locations the firm selected for testing three access controls that consisted of reviews of whether access to the general ledger system was appropriately restricted based on the system profiles. The firm did not evaluate whether the access provided through these profiles was appropriate based on users' functional needs. (AS 2201.42 and .44)

As a result of our inspection the firm performed additional procedures related to the deficiencies in controls over revenue and inventory discussed above and requested that the issuer reevaluate these controls. As a result of this reevaluation the issuer identified a material weakness related to the aggregation of control deficiencies over the issuer's information technology (“IT”) systems that had not been previously identified. The firm modified its report on the effectiveness of the issuer's ICFR to include this additional material weakness. The firm relied on information in reports generated from these general ledger systems in performing its substantive procedures over revenue and inventory but did not test the completeness of the information in certain of these reports beyond comparing certain amounts in these reports to the general ledger systems. (AS 1105.10)

The issuer performed daily cycle counts of inventory but designed its counts to exclude a portion of inventory from the daily cycle counts. In evaluating the design of the cycle-count control the firm did not assess the effect of the issuer excluding this portion of inventory on the control's ability to effectively prevent or detect a material misstatement. (AS 2201.42)

Certain inventory held by the issuer in several locations was subject to cycle counts. The following deficiencies were identified: · The firm did not identify and test any controls over the issuer's monitoring of the results of the cycle counts to assess whether its perpetual inventory records were reliable. (AS 2201.39)

Certain inventory held by the issuer in several locations was subject to cycle counts. The following deficiencies were identified: · For inventory at certain of these locations the firm identified deficiencies in certain controls over the issuer's cycle-count program related to whether sufficient inventory items were counted with sufficient frequency in accordance with the issuer's cycle-count program. The firm identified and tested compensating controls that it believed mitigated these deficiencies. The firm did not identify that these compensating controls did not address whether sufficient inventory items were counted with sufficient frequency in accordance with the issuer's cycle-count program. (AS 2201.68)

Certain inventory held by the issuer in several locations was subject to cycle counts. The following deficiencies were identified: · For another one of these locations the issuer used an inventory management system in performing its cycle counts. The firm did not identify and test controls over the accuracy and completeness of the cycle-count selection reports generated by this system and used by the issuer in the performance of the cycle counts at this location. (AS 2201.39)

Certain inventory held by the issuer in several locations was subject to cycle counts. The following deficiencies were identified: · Due to the deficiencies discussed above the firm's testing of controls did not provide sufficient appropriate audit evidence that the cycle-count procedures the issuer used for this inventory were sufficiently reliable to produce results substantially the same as those that would have been obtained by a count of all items each year. (AS 2510.11)

The firm's testing of controls for inventory held at certain locations consisted primarily of testing an entity-level control that involved the issuer's reviews of regional and component-level income statements and balance sheets. The firm did not evaluate the review procedures that the control owner performed including the criteria that the control owner used to identify items for follow up and whether those items were appropriately resolved with respect to the component-level financial information. (AS 2201.42 and .44)

Based on the firm's reliance on this entity-level control which was not supported due to the deficiency discussed above the firm limited its substantive procedures to test this inventory to various analytical procedures. These analytical procedures as designed provided little or no substantive evidence. (AS 2301.08)

The issuer used information-technology (IT) systems to initiate process and record transactions related to certain inventory. The firm selected for testing certain automated controls but did not test the configuration or programming of these automated controls or perform other procedures that would have provided sufficient appropriate audit evidence that these automated controls were designed and operating effectively. (AS 2201.42 and .44)

The sample size the firm used in certain of its substantive procedures to test this inventory was too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiency in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

In addition in the substantive testing discussed above the firm identified differences in the unit costs of inventory between the issuer's inventory systems but did not perform procedures to evaluate the differences. (AS 2301.08)

The firm selected for testing controls over the recording of inventory. The firm did not identify and test any controls over the accuracy and completeness of certain reports used in the operation of these controls. (AS 2201.39)

The firm used certain reports in its substantive testing of inventory but did not perform any procedures to test or test controls over the accuracy and completeness of this information. (AS 1105.10)

The sample size the firm used in certain of its substantive procedures to test inventory was too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The firm did not identify and test any controls that addressed whether the issuer's fixed overhead was expensed or capitalized appropriately in accordance with FASB ASC Topic 330 Inventory. (AS 2201.39)

The firm did not perform any substantive procedures to evaluate whether the issuer's fixed overhead was expensed or capitalized appropriately in accordance with FASB ASC Topic 330. (AS 2810.30)

The issuer changed its method of valuing certain inventory during the year. The firm did not identify and test any controls over the issuer's evaluation of whether this change represented a change in accounting principle. (AS 2201.39)

The firm did not perform any substantive procedures to evaluate whether this change represented a change in accounting principle under FASB ASC Topic 250 Accounting Changes and Error Corrections. (AS 2810.30)

The issuer used multiple IT systems to initiate process and record transactions related to this inventory. In its testing of controls over this account the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. The firm did not identify and test any controls that addressed the risk that unauthorized changes were made to the databases that supported certain of these systems. (AS 2201.39)

The issuer used multiple IT systems to initiate process and record transactions related to this inventory. In its testing of controls over this account the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. The firm did not identify and test any controls that addressed the risk that unauthorized changes were made to the databases that supported certain of these systems. As a result of this deficiency in the firm's testing of ITGCs the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

The firm selected for testing controls over the transfers of data between certain of the issuer's inventory systems and the general ledger. The firm did not identify and test any controls over the accuracy and completeness of certain reports used in the operation of these controls. (AS 2201.39)

The firm selected for testing certain automated controls over this inventory. The firm's testing of only one instance of these automated controls was not sufficient because the firm did not test the programming of these controls or perform other procedures that would have provided sufficient appropriate audit evidence that these controls were designed and operating effectively. (AS 2201.46)

As a result of the firm's control testing deficiencies the firm did not perform sufficient substantive procedures over this inventory as follows: · The firm's substantive procedures to test this inventory included substantive analytical procedures. The firm established its thresholds for investigating differences based on a level of control reliance that was not supported. As a result the thresholds that the firm used did not provide the desired level of assurance that misstatements that could have been material would be identified. (AS 2301.16 .18 and .37; AS 2305.20)

As a result of the firm's control testing deficiencies the firm did not perform sufficient substantive procedures over this inventory as follows: · The firm did not perform sufficient procedures to test or sufficiently test controls over the accuracy and completeness of certain system-generated data or reports the firm used in its substantive testing including substantive analytical procedures. (AS 1105.10; AS 2305.16)

The issuer performed cycle counts of certain inventory held at one of its warehouses. The following deficiencies were identified: · The firm did not identify and test any controls that addressed whether all of this inventory was assigned a frequency to be counted. (AS 2201.39)

The issuer performed cycle counts of certain inventory held at one of its warehouses. The following deficiencies were identified: · The firm selected for testing a control that included the issuer's review and approval of count frequencies that had been assigned to this inventory. The firm did not identify and test any controls that addressed whether these approved count frequencies were entered into the system accurately and completely. (AS 2201.39)

The issuer performed cycle counts of certain inventory held at one of its warehouses. The following deficiencies were identified: · The firm selected for testing a control that included the issuer's review and approval of count frequencies that had been assigned to this inventory. The firm did not identify and test any controls over the accuracy and completeness of certain system-generated reports used in the operation of this control. (AS 2201.39)

The issuer performed cycle counts of certain inventory held at one of its warehouses. The following deficiencies were identified: · The firm selected for testing an automated control over the selection of items for cycle counting this inventory. The firm did not test whether the system was appropriately configured to achieve the frequency schedule established by management. (AS 2201.42 and .44)

The firm selected for testing a control that included the issuer's cycle-count procedures for certain inventory held at other locations. The firm did not identify and test any controls over the accuracy and completeness of a system-generated report used in the operation of this control. (AS 2201.39)

As a result of the firm's control testing deficiencies the firm did not perform sufficient other audit procedures as follows: · The firm did not obtain sufficient appropriate audit evidence that the cycle-count procedures the issuer used for certain inventory were sufficiently reliable to produce results substantially the same as those that would have been obtained by a count of all items each year. (AS 2510.11)

As a result of the firm's control testing deficiencies the firm did not perform sufficient other audit procedures as follows: · The sample sizes the firm used in certain of its substantive procedures to test inventory were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

As a result of the firm's control testing deficiencies the firm did not perform sufficient other audit procedures as follows: · The firm did not perform sufficient procedures to test or sufficiently test controls over the accuracy and completeness of certain system-generated data or reports the firm used in its substantive testing. (AS 1105.10)

The firm's substantive procedures to test the unit cost of certain inventory included selecting a sample of inventory items for testing. For certain items in its sample the firm did not perform any procedures to test the cost of the raw materials included in the unit costs. (AS 2301.08)

The firm selected for testing a control that consisted of the issuer's review of capitalized cost variances for certain inventory. The firm did not identify and test any controls over the accuracy of certain data that the control owners used in the operation of this control. (AS 2201.39)

The issuer used an IT system to initiate process and record transactions related to revenue and inventory at one of the issuer's locations. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by this IT system. The firm selected for testing an ITGC that consisted of the issuer's review of changes made to this IT system. The firm did not evaluate the specific review procedures that the control owner performed to determine which of these changes required approval prior to implementation into the production environment. (AS 2201.42 and .44)

The issuer used an IT system to initiate process and record transactions related to revenue and inventory at one of the issuer's locations. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by this IT system. The firm selected for testing an ITGC that consisted of the issuer's review of changes made to this IT system. The firm did not evaluate the specific review procedures that the control owner performed to determine which of these changes required approval prior to implementation into the production environment. As a result of this deficiency in the firm's testing of ITGCs the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)