Explorer

For a third business unit the firm identified a control deficiency related to the issuer's review of the accuracy of pricing information used to record revenue. For a fourth business unit the firm identified a significant deficiency related to change management over an information-technology (IT) system that the issuer used to manage customer pricing and process revenue transactions. The firm identified and tested a compensating control that it believed mitigated these deficiencies but did not identify that this control was not designed to address the risks of material misstatement related to inaccurate pricing information and inappropriate changes made to the issuer's IT system. (AS 2201.68)

With respect to revenue for certain other business units that the firm subjected to less extensive audit procedures the following deficiencies were identified: · The firm did not identify and test any controls over the issuer's revenue for certain of these business units. (AS 2201.39)

With respect to revenue for certain other business units that the firm subjected to less extensive audit procedures the following deficiencies were identified: · For the remainder of these business units the firm selected for testing a control that consisted of the issuer's reconciliation of revenue recorded to cash receipts. The firm did not identify that this control was not designed to address revenue for which payment had not been collected by the issuer. (AS 2201.42)

For certain of the issuer's revenue the firm did not identify and test any controls that addressed whether the issuer satisfied its performance obligation before recognizing revenue. (AS 2201.39)

The issuer identified segregation of duties conflicts related to individuals who had the ability to both develop and implement changes to this system and implemented controls to monitor these conflicts. The firm identified and tested these controls but did not identify that the individuals that the issuer identified as having the segregation of duties conflicts also had administrative access to the tool that the control owners used to monitor the conflicts. (AS 2201.42 and .44)

During the year the issuer recorded revenue from bill-and-hold arrangements with one of its customers. The following deficiencies were identified: · The firm did not identify and test any controls that addressed whether the issuer had met certain revenue recognition criteria for these bill-and-hold arrangements. (AS 2201.39)

The issuer's revenue transactions can be initiated by customers through electronic data interchange ('EDI') email or phone call. The issuer used a system to process credit card orders. The firm did not obtain an understanding of (1) how revenue transactions were initiated authorized processed and recorded; (2) how IT systems affected the flow of transactions; and (3) the likely sources of potential misstatements necessary to identify and test controls that would prevent or detect a material misstatement in the financial statements. (AS 2201.30)

The firm did not identify and test the controls over the (1) revenue recognition method; (2) review and approval of the prices; (3) processing of EDI orders; and (4) processing and recording of credit card sales. (AS 2201.39)

The firm selected for testing controls that consisted of the reconciliation of data from the issuer's revenue input system to its billing systems. The firm did not identify and test any controls over the accuracy of the data used in the operation of these controls. (AS 2201.39)

The firm selected for testing controls that consisted of (1) the approval of new customers and creation of customer accounts in the billing systems and (2) the review and approval of new contracts and sales orders. The firm did not test or in the alternative test any controls over the completeness of the reports that the firm used in its testing of these controls. (AS 1105.10)

The issuer accrues a provision for customer rebates. The firm selected for testing a control that consisted of management's review of the rebate accrual and an investigation of certain variances over established thresholds. The firm did not evaluate whether the thresholds that the control owner used were sufficiently precise to detect misstatements that could be material. (AS 2201.42 and .44)

The issuer recognized revenue from multiple revenue streams. The following deficiency was identified: • The firm selected for testing a control over the disclosure of certain revenue that consisted of the issuer's review and approval of its financial statement disclosures. The firm did not identify and test any controls over the accuracy of certain data used in the operation of this control. (AS 2201.39)

With respect to Revenue which was affected by the audit deficiencies related to change management and user access the following additional deficiencies were identified: · The firm selected for testing other controls over certain revenue. The firm tested these controls through an interim date but did not perform any procedures to update the results of its testing from that interim date to year end. (AS 2201.55)

With respect to Revenue which was affected by the audit deficiencies related to change management and user access the following additional deficiencies were identified: · For certain revenue the firm selected for testing controls that consisted of the (1) reconciliation and review of certain data used to recognize revenue and (2) reconciliation and review of billed amounts prior to the recording of revenue. For the items selected for testing the firm did not test the management review aspects of these controls involving the review of (1) data used to recognize revenue and (2) billed amounts prior to the recording of revenue. (AS 2201.44)

For one category of revenue that comprised six types of revenue arrangements the firm selected for testing a control that consisted of a monthly comparison by project type of certain financial information and the investigation of variances over established thresholds. The firm did not evaluate whether certain thresholds the control owners used were sufficiently precise to detect misstatements that could be material. (AS 2201.42 and .44)

In addition the firm did not identify and test any controls over the accuracy of certain data that the control owners used in the performance of this control. (AS 2201.39)

For four types of these revenue arrangements the firm selected for testing a control that included the review of invoices. The firm did not test the procedures the control owners performed to determine whether the services were provided for the revenue recorded for three of these types of revenue arrangements. (AS 2201.44)

In addition the firm did not identify and test any controls over the accuracy of certain data that the control owners used in the performance of this control for one of these three types of arrangements. (AS 2201.39)

For another category of revenue the firm selected for testing a control that consisted of the review of revenue transactions greater than an established monetary threshold. The firm did not identify and test any controls over revenue transactions that were less than this established threshold. (AS 2201.39)

The issuer recognized certain other revenue from contracts based on costs incurred. The following deficiencies were identified: · The firm did not identify and test any controls over the costs incurred to date for these contracts including whether these costs were allowable under the contracts. (AS 2201.39)

The issuer recognized revenue from certain other types of arrangements based on the amount of time incurred to provide professional services and the rates in the agreements with its customers. The firm did not identify and test any controls over the accuracy of the time information that the issuer used to calculate this revenue. (AS 2201.39)

For one business unit the firm selected for testing a control that consisted of the comparison of the invoice price for the sale of a product to the issuer's supporting documentation of the approved price for that product. The firm identified exceptions in the operation of this control and concluded without evaluating the effect of these exceptions on the operating effectiveness of the control that these exceptions did not result in a control deficiency. (AS 2201.48)

For the other business unit the firm did not identify and test any controls that addressed whether customer orders were processed using approved prices. (AS 2201.39)

The issuer entered into contracts with customers at certain of its locations that required revenue to be recognized over time based on costs incurred to date relative to total estimated costs to complete these contracts. The firm excluded from the scope of its audits a large number of these locations. The firm did not (1) evaluate whether the risks of material misstatement the firm identified related to revenue recognized over time for the in-scope locations also applied to the excluded locations and (2) consider whether specific risks of material misstatement related to the issuer's use of centralized service centers to determine the amount of revenue to be recognized over time existed at the excluded locations. (AS 2101.11 and .12; AS 2201.B10)

The firm used the issuer's time information in its substantive testing of this revenue. The firm did not test or (as discussed above) test controls over the accuracy of this information. (AS 1105.10)

Revenue for certain of the issuer's sales transactions was processed by one of the issuer's information-technology ('IT') systems. This system automatically assigned predefined codes to each transaction based on the customer and type of service being provided. These codes were used by the issuer's billing system to record the related revenue. The firm did not identify and test any controls that addressed whether these codes were appropriately assigned by the IT system. (AS 2201.39)

The issuer recognized certain revenue from contracts using the percentage-of-completion method. The following deficiencies were identified: · The firm selected for testing a control over this revenue that consisted of the review of an analysis of estimated gross margin by contract. The firm did not test the aspect of this control related to the control owner's assessment of whether the costs incurred to date included in the analysis were accurate complete and allowable under the contracts. (AS 2201.42 and. 44)

The issuer used two information-technology (IT) systems to process and record certain revenue transactions related to services provided to its customers; one of these systems was maintained by an external service organization. The following deficiencies were identified: · With respect to the IT system that was maintained by an external service organization the firm selected for testing a control over access by employees of the service organization to this system and identified control exceptions related to inappropriate access for numerous employees. The firm did not sufficiently evaluate the effect of these exceptions on the effectiveness of this control because its evaluation was limited to inquiring of management of the service organization regarding access privileges. (AS 2201.48)

The issuer recorded certain other revenue based on the completion of services provided to its customers. The following deficiencies were identified: · The firm did not identify and test any controls that addressed the risk that revenue was recognized before the performance obligation for these services was satisfied. (AS 2201.39)

For certain revenue related to services that the issuer provided to its customers the issuer used two IT systems to process and record revenue transactions. The issuer assigned service codes to each customer based on the prices for the services provided and the specific terms of the customer arrangement. These systems calculated and recorded revenue using those service codes. The following deficiencies were identified: · For certain of this revenue the firm did not identify and test any controls that addressed the risks that the service codes used to record revenue did not represent the services ordered and terms agreed to by the customer. (AS 2201.39)

For certain revenue related to services that the issuer provided to its customers the issuer used two IT systems to process and record revenue transactions. The issuer assigned service codes to each customer based on the prices for the services provided and the specific terms of the customer arrangement. These systems calculated and recorded revenue using those service codes. The following deficiencies were identified: · For the remainder of this revenue the firm selected for testing a control that included an aspect that addressed the appropriateness of the service codes used to record revenue. The firm however did not test this aspect of the control. (AS 2201.42 and .44)

For certain revenue related to services that the issuer provided to its customers the issuer used two IT systems to process and record revenue transactions. The issuer assigned service codes to each customer based on the prices for the services provided and the specific terms of the customer arrangement. These systems calculated and recorded revenue using those service codes. The following deficiencies were identified: · For revenue processed and recorded by one of these IT systems the firm did not identify and test any controls to address certain other risks related to the accuracy of customer invoices and revenue calculated by this system. (AS 2201.39)

The firm selected for testing certain manual controls over this revenue that used reports that were generated by these IT systems. The firm's testing of these controls was not sufficient due to the deficiencies in testing controls over the IT systems discussed above. (AS 2201.46)

The issuer entered into contracts with certain customers that required revenue to be recognized over time based on costs incurred to date relative to total estimated costs to complete these contracts. The following deficiencies were identified: · The firm selected for testing a control that included a preliminary review of certain profit margin metrics by contract to identify items for further investigation. The firm did not identify and test any controls over the completeness of certain data underlying these performance metrics. (AS 2201.39)

The issuer recognized certain revenue when a product was shipped or upon completion of a service. The firm selected for testing a control over this revenue that consisted of the comparison of the terms of each sales transaction entered into the issuer's system to corresponding invoices purchase orders and shipping or service documents before revenue was recognized. The firm's procedures were not sufficient because the firm did not test whether the control owners reviewed evidence that products had been shipped or services had been rendered. (AS 2201.42 and .44)

The issuer disclosed the amount of revenue assigned to each of its reportable segments. The firm selected for testing an automated control that used information from the issuer's general ledger to assign revenue to each reportable segment in the issuer's financial reporting system. The firm did not evaluate beyond inquiring of management whether this control was designed to assign revenue related to a business acquired during the year to the appropriate reportable segments. (AS 2201.42)

The firm identified a control deficiency related to the review of the prices the issuer used to recognize revenue for certain locations. The firm identified compensating controls that it believed would mitigate this deficiency but did not test these controls. (AS 2201.68)

The firm did not identify and test any controls related to certain revenue disclosures. (AS 2201.39)

The firm did not identify and test any controls over sales allowances. (AS 2201.39)

The firm's internal inspection program had inspected this audit and reviewed this area but did not identify the deficiencies below. The issuer used two internally developed IT systems to process transactions related to certain revenue. In its testing of controls over this revenue the firm tested various automated controls that used data generated or maintained by these IT systems. With respect to change management: · The firm selected for testing controls over change management for these IT systems but did not perform any procedures to determine whether the population of changes from which it made its selections for testing represented the complete population of changes made to these systems. (AS 1105.10)

The firm's internal inspection program had inspected this audit and reviewed this area but did not identify the deficiencies below. The issuer used two internally developed IT systems to process transactions related to certain revenue. In its testing of controls over this revenue the firm tested various automated controls that used data generated or maintained by these IT systems. With respect to change management: · The firm selected for testing a control that consisted of the review of segregation of duties for these IT systems. The firm did not test beyond inquiry the aspect of the control that addressed whether certain users with the ability to develop changes also had the ability to implement those changes. (AS 2201.42 and .44)

At two of the issuer's business units the issuer recognized certain revenue over time based on information that was provided by an external party. The following deficiencies were identified: · The firm did not identify and test any controls over the reliability of the information provided by the external party. (AS 2201.39)

At certain other business units the following deficiencies were identified: · The firm did not identify and test any controls that addressed whether the performance obligations had been satisfied before revenue was recognized. (AS 2201.39)

The issuer recognized certain revenue over time from contracts for which it had an enforceable right to payment for inventory that did not have an alternative use to the issuer. The issuer's IT system for this revenue was configured to recognize revenue upon shipment and the issuer recorded manual adjustments to recognize revenue at period end based on the progress it made to manufacture goods in inventory that had not been shipped. The firm selected for testing 1) an automated control that included the designation of sales orders in the system as “on hold” until the issuer completed a review of each sales order prior to shipment and 2) the control related to the issuer's review of each sales order with the “on hold” designation in the system to ensure it was associated with a valid contract. The following deficiencies were identified: · For the automated control the firm did not test the aspect that addressed whether all types of sales orders received this “on hold” designation. (AS 2201.42 and .44)

The issuer recognized certain revenue over time from contracts for which it had an enforceable right to payment for inventory that did not have an alternative use to the issuer. The issuer's IT system for this revenue was configured to recognize revenue upon shipment and the issuer recorded manual adjustments to recognize revenue at period end based on the progress it made to manufacture goods in inventory that had not been shipped. The firm selected for testing 1) an automated control that included the designation of sales orders in the system as “on hold” until the issuer completed a review of each sales order prior to shipment and 2) the control related to the issuer's review of each sales order with the “on hold” designation in the system to ensure it was associated with a valid contract. The following deficiencies were identified: · The firm identified a control deficiency related to the lack of a requirement for the sales order review control to be performed before the issuer began to manufacture the inventory. In determining whether the deficiency represented a material weakness the firm did not sufficiently evaluate the severity of this deficiency because (1) its procedures to evaluate the magnitude of the potential misstatement were limited to determining the total inventory amount that would represent a material misstatement and (2) the firm did not perform procedures to evaluate whether there was a reasonable possibility that the issuer's controls would fail to prevent or detect a misstatement beyond concluding that the possibility of that type of misstatement would be remote without performing procedures to support that conclusion. (AS 2201.62)

The issuer recognized certain revenue based in part on transaction data provided by an external service provider. The firm did not identify and test any controls that addressed the reliability of the majority of these data. (AS 2201.39)

The issuer recognized revenue from multiple revenue streams. The following deficiency was identified: · The firm selected for testing other controls over this revenue stream that consisted of the issuer's reconciliation of (1) revenue data between the general ledger system and one of its financial reporting systems and (2) revenue data among certain financial reporting systems. The firm did not sufficiently test the operating effectiveness of these controls because it did not evaluate how identified deficiencies in certain systems interface controls between these systems could impact the operating effectiveness of the revenue reconciliation controls. (AS 2201.44)

The issuer recognized revenue from multiple revenue streams. The following deficiency was identified: · The firm selected for testing a control over another revenue stream that consisted of the issuer's (1) review of customer contracts in excess of a specified threshold and (2) determination as to whether the revenue from the selected contracts was recognized in conformity with the relevant accounting standard. The firm did not evaluate whether the threshold used in the control could effectively prevent or detect a material misstatement. (AS 2201.42)

The issuer operated an e-commerce platform. The following deficiency was identified: · The firm selected for testing a control over revenue that consisted of the issuer's review and approval of third-party invoices including the performance of certain two-way and three-way matches between those invoices and documents and/or information produced by the issuer. The firm did not test the aspects of the control related to the two-way and three-way matches. (AS 2201.42 and .44)

The issuer operated an e-commerce platform. The following deficiency was identified: · The firm selected for testing another control over revenue that consisted of the issuer's review and approval of certain changes the issuer made to data in its system that affected revenue recognition. The firm identified a deficiency in the design and operating effectiveness of this control. The firm identified and tested a compensating control that it believed would mitigate the deficiency. The firm did not identify that the other control did not address the appropriateness of changes made by authorized personnel. (AS 2201.68)