Explorer

The issuer used an application to process revenue transactions and maintain related data. A service organization provided software and data center hosting services related to this application. The firm did not evaluate whether the service auditor's report provided sufficient evidence because the firm did not assess the scope of the examination and applications covered the controls tested the way in which tested controls relate to the issuer's controls and the results of those tests of controls. (AS 2201.B21)

The firm selected for testing a control that consisted of the issuer's review of revenue and was dependent on system information. The firm did not sufficiently evaluate the design of this control because the firm did not identify that the procedures that the control owner performed to ensure that the system information was accurate and complete were limited to reviewing the parameters that were applied to generate the system information. (AS 2201.42)

The issuer used an application to process revenue transactions and maintain related data. A service organization provided software and data center hosting services related to this application. The firm did not perform any procedures to ascertain whether there were any changes in the service organization's controls from the date of the service auditor's report to year end given the length of period under audit not covered by the service auditor's report. (AS 2201.39 .B24 and .B25)

The issuer used an application to process revenue transactions and maintain related data. A service organization provided software and data center hosting services related to this application. The application interfaced with a revenue recognition and reporting application. The firm selected for testing controls over change management for these applications. The firm did not evaluate whether users with access to develop program changes also had the ability to implement program changes. (AS 2201.42 and .44)

The issuer used an application to process revenue transactions and maintain related data. A service organization provided software and data center hosting services related to this application. The application interfaced with a revenue recognition and reporting application. The firm tested a control over the periodic review of access to these two applications at an interim date but did not perform any procedures to update the results of that testing from the interim date to year end. (AS 2201.55)

The firm did not identify and test any controls over changes and privileged access to the database that supports these two applications. (AS 2201.39)

The firm identified certain of the issuer's locations as “in-scope” locations for purposes of testing controls over the revenue. The firm selected for testing certain controls over the processing and recording of the revenue that consisted of the issuer's review and/or approval of (1) the detail sales price list (2) sales price and other information in contracts (3) certain sales reports and (4) changes in estimated contract costs. The following deficiencies were identified: · The firm did not perform sufficient procedures to test the operating effectiveness of these controls because the firm did not test the operating effectiveness of the controls at certain “in-scope” locations which reported a significant amount of the revenue. (AS 2201.44)

The issuer recognized revenue for each of its three segments based on the terms underlying its contracts with customers. The firm did not identify and test any controls over the identification and consideration of contract terms that would affect revenue recognition. (AS 2201.39)

The firm did not identify and test any controls over the review of contracts that provided preferred pricing to certain customers or controls to determine that the prices charged to customers were consistent with the contracts. (AS 2201.39)

The firm did not identify and test any controls over the review of contracts that provided preferred pricing to certain customers or controls to determine that the prices charged to customers were consistent with the contracts. (AS 2201.39)

With respect to user access: · The firm selected for testing a control over the periodic review of user access for each of these IT systems. The firm did not evaluate whether items identified by the control owners for follow up were appropriately resolved. (AS 2201.44)

The issuer used multiple IT systems to initiate process and record transactions related to certain revenue at two of these business units. The firm tested controls over user access to these systems. The following deficiencies were identified: · The firm selected for testing a control over the granting or modification of user access. For the first business unit the firm did not test the operating effectiveness of this control. For the second the firm did not test the design and operating effectiveness of the aspect of this control related to the modification of user access. (AS 2201.42 and .44)

For certain revenue transactions that occurred throughout the audit period the firm did not identify and test any controls that addressed the risk related to the accuracy of prices and quantities invoiced. (AS 2201.39)

With respect to user access: · The firm selected for testing a control over the removal of access for terminated employees. For one of these IT systems the firm did not evaluate the control owner's procedures to determine whether access was appropriately removed for users identified as terminated. (AS 2201.42 and .44)

With respect to both user access and change management: · For certain IT systems the firm did not (1) identify and test controls and/or (2) test identified controls that addressed certain risks over change management and user access. (AS 2201.39)

With respect to both user access and change management: · For one of these IT systems the firm selected for testing controls related to (1) the monitoring of database changes and (2) privileged access review but did not perform any procedures beyond inquiry to test the design and operating effectiveness of these controls. (AS 2201.42 and .44)

The firm selected for testing two controls that consisted of the issuer's reviews of revenue transactions for appropriate revenue recognition. For the first control the firm did not test whether the control addressed all revenue transactions. For the second control the firm did not evaluate whether the issuer's review was sufficient to address the risks of material misstatement given not all revenue transactions were covered by this control. (AS 2201.42 and .44)

The firm selected for testing a control that consisted of the issuer's reviews of comparisons of current-period revenue to prior-period revenue. The firm did not identify and test any controls over the accuracy of certain revenue data used in the operation of this control. (AS 2201.39)

The issuer recognized certain revenue over time based on estimates of the goods and services it would provide to customers and the payments it would receive for those goods and services. The following deficiencies were identified: · The firm selected for testing a control that consisted of the issuer's review of the reasonableness of the forecasted information that the issuer used to develop these estimates. The firm did not identify and test any controls over the accuracy of the data that were used to develop this forecasted information. (AS 2201.39)

Certain of the issuer's revenue arrangements included multiple performance obligations. The issuer allocated the total transaction price for each of these arrangements to the separate performance obligations based on the relative standalone selling price. The issuer disclosed that it used observable prices to determine the standalone selling prices for certain performance obligations in these arrangements. The following deficiencies were identified: · The firm did not identify and test any controls that addressed the establishment of the standalone selling price for new products. (AS 2201.39)

The firm did not identify and test any controls that addressed the risk that certain cash receipts from revenue transactions were not properly recorded to support that these revenue transactions were valid. (AS 2201.39)

For this type of revenue the issuer entered into arrangements where it could either be acting in the capacity of a principal or an agent and as a result would record revenue on either a gross or net basis. The following additional deficiencies were identified: · The firm did not identify and test any controls that addressed whether the issuer was acting as a principal or an agent in these arrangements. (AS 2201.39)

For two types of revenue one of which was affected by other audit deficiencies certain of the issuer's revenue arrangements included multiple performance obligations. The issuer allocated the total transaction price for each of these arrangements to the separate performance obligations based on the relative standalone selling prices. The following additional deficiencies were identified: · The firm did not identify and test any controls that addressed the estimate of the standalone selling prices of the performance obligations. (AS 2201.39)

For two types of revenue one of which was affected by other audit deficiencies certain of the issuer's revenue arrangements included multiple performance obligations. The issuer allocated the total transaction price for each of these arrangements to the separate performance obligations based on the relative standalone selling prices. The following additional deficiencies were identified: · For certain contracts the firm did not identify and test any controls that addressed whether the allocation of the transaction price to the separate performance obligations was based on the standalone selling prices. (AS 2201.39)

For certain revenue at one business unit the following deficiencies were identified: · For contracts with recurring monthly revenue the firm did not identify and test any controls over the recording of certain of this revenue. (AS 2201.39)

For certain revenue at two other business units the firm selected for testing controls that addressed whether the performance obligation had been satisfied before revenue was recognized. The number of occurrences selected for testing did not provide sufficient appropriate audit evidence in light of either the assessed inherent risk associated with the account or the frequency of the operation of the control. (AS 2201.46)

The issuer recorded revenue net of customer rebates and other deductions. The following deficiency was identified: · The firm did not identify and test any controls over accrued rebates and other deductions. (AS 2201.39)

For one type of revenue at one business unit the firm did not identify and test any controls over the accuracy of certain order information from the issuer's customer ordering system that the issuer used to record revenue. (AS 2201.39)

For a second business unit the following deficiencies were identified: · The firm did not identify and test any controls that addressed the risk related to accuracy of the quantity of items ordered. (AS 2201.39)

The issuer used an information-technology (IT) system to initiate transactions related to certain revenue. The firm identified a control deficiency related to change management for this IT system. The following audit deficiencies were identified: · The firm identified and tested a compensating control that it believed mitigated this deficiency but did not identify that the control owner used information in the performance of this control that was produced by this IT system. (AS 2201.68) In connection with our review the issuer reevaluated its controls over this revenue and concluded that a material weakness existed that had not been previously identified. The issuer subsequently reflected this material weakness in a revision to its report on ICFR and the firm revised its opinion on the effectiveness of the issuer's ICFR to express an adverse opinion and reissued its report.

The issuer used an information-technology (IT) system to initiate transactions related to certain revenue. The firm identified a control deficiency related to change management for this IT system. The following audit deficiencies were identified: · The firm did not sufficiently evaluate the severity of the control deficiency because it did not accurately calculate the magnitude of the potential misstatement resulting from this deficiency. (AS 2201.62) In connection with our review the issuer reevaluated its controls over this revenue and concluded that a material weakness existed that had not been previously identified. The issuer subsequently reflected this material weakness in a revision to its report on ICFR and the firm revised its opinion on the effectiveness of the issuer's ICFR to express an adverse opinion and reissued its report.

The firm's internal inspection program had inspected this audit reviewed these areas and also identified the deficiencies below. The issuer used an IT system to record transactions related to revenue. The firm did not identify and test any controls that addressed the risk that users with the ability to develop changes also had the ability to implement those changes. (AS 2201.39)

With respect to change management the firm selected for testing a control over the issuer's review of changes to the production environments for these IT systems. The firm did not identify that this control was not designed to address the risk that unauthorized changes were made to these systems as certain users with the ability to develop and implement changes also had administrative access to the monitoring tools used in the operation of this control. (AS 2201.42)

The firm did not identify and test any controls that addressed whether transactions processed by the issuer's revenue application were accurately recorded. (AS 2201.39)

The firm did not identify and test any controls to address revenue adjustments. (AS 2201.39)

The firm's internal inspection program had inspected this audit and reviewed these areas but did not identify the deficiencies below. The firm selected for testing certain controls over revenue. The following deficiency was identified: · For certain controls over the recording of revenue that consisted of matching information from the invoice to other data the firm did not directly test the operating effectiveness of the controls because its procedures were substantive in nature. (AS 2201.42 .44 and .B9)

The issuer also reported revenue from the performance of services. The firm did not identify and test any controls over the satisfaction of performance obligations for this revenue. (AS 2201.39)

The firm's internal inspection program inspected this audit and reviewed this area but did not identify certain of the deficiency below. The firm identified a control deficiency related to the issuer's lack of controls over amounts invoiced to customers. The firm identified various controls that it believed would compensate for this deficiency but did not identify that these controls did not address whether amounts invoiced to customers were accurate. (AS 2201.68)

The firm relied on controls it selected for testing in its approach to testing revenue at two of the issuer's business units. The following deficiencies were identified: · For the first business unit the only control the firm selected for testing over the occurrence of revenue consisted of the issuer's reconciliation of the sales subledger to the general ledger and its review of this reconciliation. The firm did not evaluate whether the design of this control was sufficient to address the risks of material misstatement related to the occurrence of sales transactions in the sales subledger. (AS 2301.19)

The issuer had three categories of revenue that were derived from contractual agreements with varying terms and conditions that could affect the amount and timing of revenue to be recognized. The following deficiencies were identified: · The firm did not determine the likely sources of potential misstatements associated with these categories of revenue to identify and test controls that addressed the risks of misstatement for the relevant assertions of each category of revenue beyond testing one control related to the issuer's review of sales orders for one category of revenue. (AS 2201.30 and .39)

The firm's internal inspection program inspected this audit and reviewed these areas but did not identify the deficiencies below. The firm did not identify and test any controls that address whether the relevant revenue recognition criteria were met prior to recognizing revenue. (AS 2201.39)

The firm's internal inspection program inspected this audit and reviewed this area but did not identify the deficiencies below. The issuer recognized revenue when customer invoices were generated based on shipment information that was entered into the issuer's systems. The firm did not identify and test any controls that addressed whether customer invoices were associated with valid customer orders and shipments. Further the firm did not identify and test any controls that addressed whether the performance obligation had been satisfied when revenue was recognized. (AS 2201.39)

The issuer disclosed the amounts of unsatisfied performance obligations. The following deficiencies were identified: · The firm did not identify and test any controls over the unsatisfied performance obligations the issuer expected to be recognized as revenue within the next 12 months. (AS 2201.39)

The issuer disclosed the amounts of unsatisfied performance obligations. The following deficiencies were identified: · The firm established its threshold for investigating differences based on a level of control reliance that was not supported due to the above deficiencies in the firm's testing of controls. As a result the threshold that the firm used did not provide the desired level of assurance that misstatements that could have been material would be identified. (AS 2301.16 .18 and .37; AS 2305.20)

The issuer recognized revenue from multiple revenue streams. The following deficiency was identified: · The firm did not identify and test any controls over the occurrence of certain revenue. (AS 2201.39)

With respect to other types of revenue that were recorded at certain of the issuer's business units ('other revenue types') the following deficiencies were identified: · The firm did not evaluate whether specific risks of material misstatement existed for these other revenue types including whether the risks of material misstatement that the firm associated with revenue types at other business units subject to more extensive audit procedures also applied to these other revenue types. (AS 2101.11 and .12; AS 2201.B10)

The firm identified a control deficiency in that the component had not designed and implemented a control over review of new contracts and amendments for the first three quarters of the year. In response to the control deficiency identified the component designed and implemented and the firm tested a control in the fourth quarter that consisted of the review of new or amended contracts with customers whose annual sales exceeded an established threshold for appropriate revenue recognition. In testing this control the firm did not evaluate whether the threshold the control owner used to select contracts for review was sufficiently precise to detect misstatements that could be material. (AS 2201.68)

The component recognized revenue from a variety of sources. The following deficiencies were identified: · The firm selected for testing controls that consisted of management's review of certain financial results including the amount of revenue recognized during the period as compared to forecasted and/or budgeted amounts and investigation of variances. The firm the firm did not identify and test any controls over the accuracy of data used in the operation of these controls. (AS 2201.39)

The component recognized revenue from a variety of sources. The following deficiencies were identified: · The firm selected for testing another control that consisted of a comparison of data used in the determination of certain revenue from the component's source system to an external source. The firm did not identify and test any controls over the completeness of data used in the operation of this control. (AS 2201.39)

Deficiencies testing controls over sales agreements and sampling revenue transactions across the full year.