Explorer

For one of its business units the issuer entered into revenue arrangements with multiple performance obligations and allocated the total transaction price for each arrangement to the separate performance obligations on a relative standalone selling price basis. The following deficiencies were identified: · For certain other revenue recorded from these arrangements the firm did not identify and test any controls that addressed whether certain of these revenue transactions were valid and accurate. (AS 2201.39)

For another business unit the firm did not identify and test any controls that addressed whether the (1) quantities shipped and invoiced by the issuer represented quantities ordered by customers and (2) prices were agreed to by customers prior to recording revenue. (AS 2201.39)

The firm selected for testing a control that consisted of the issuer's review and approval of changes to the prices maintained in the pricing master file. The firm did not identify and test any controls that addressed whether all approved price changes were made to the pricing master file. (AS 2201.39)

For a third business unit the firm identified control deficiencies related to the issuer's controls over the review and approval of sales orders and changes to prices maintained in the pricing master file. The firm identified and tested various controls that it believed would mitigate these deficiencies. The firm did not identify that these compensating controls did not address the risks of material misstatement related to fictitious sales orders and inaccurate prices. (AS 2201.68)

Certain of the issuer's revenue arrangements included multiple performance obligations. The issuer allocated the total transaction price for each of these arrangements to the separate performance obligations based on the issuer's estimate of the relative standalone selling prices. The following deficiencies were identified: · The firm did not identify and test any controls over the issuer's determination of the standalone selling prices. (AS 2201.39)

Certain of the issuer's revenue arrangements included multiple performance obligations. The issuer allocated the total transaction price for each of these arrangements to the separate performance obligations based on the issuer's estimate of the relative standalone selling prices. The following deficiencies were identified: · The firm selected for testing a control that included the issuer's review of certain contracts under these types of arrangements for appropriate revenue recognition. The firm did not identify that the control was not designed to address whether the issuer considered all reasonably available information when estimating the standalone selling prices. (AS 2201.42)

Certain of the issuer's revenue arrangements included multiple performance obligations. The issuer allocated the total transaction price for each of these arrangements to the separate performance obligations based on the issuer's estimate of the relative standalone selling prices. The following deficiencies were identified: · The firm did not identify and test any controls over the issuer's determination of the standalone selling prices. (AS 2201.39)

The firm identified control deficiencies related to controls over certain revenue contracts at one of the issuer's locations. The firm did not evaluate the severity of these control deficiencies individually or in combination to determine whether they represented a material weakness. (AS 2201.62)

Deficiencies testing controls and substantive procedures over a revenue recognition judgment.

The issuer used multiple IT systems to calculate and record certain revenue based on the related order information. The following deficiency was identified: · The firm selected for testing certain automated controls that consisted of the configuration of various IT systems to automatically process and record certain revenue. The firm did not identify and test any controls over the accuracy of the order information included in the source systems that were used in the operation of these controls. (AS 2201.39)

The issuer used multiple IT systems to calculate and record certain revenue based on the related order information. The following deficiency was identified: · The firm did not identify and test any controls over the accuracy of the order information used to calculate and record certain other revenue. (AS 2201.39).

The issuer recognized certain revenue based on quantity and specified rates. The following deficiencies were identified: · The firm selected for testing a control over the completeness of reported quantities that consisted of management's comparison of the quantity reported by customers to information provided by external parties. The firm did not identify and test any controls over the relevance and reliability of the information provided by the external parties that was used in this control. (AS 2201.39)

The issuer recognized revenue from services provided to customers based on certain agreed-upon specifications (“service revenue”). The following deficiencies were identified: · The firm did not identify and test any controls over another type of service revenue. (AS 2201.39)

The issuer recognized certain revenue from contracts based on labor hours recorded in the issuer's time system. The following deficiencies were identified: · The firm did not identify and test any controls over the accuracy of these labor hours. (AS 2201.39)

The issuer recognized certain revenue from contracts based on labor hours recorded in the issuer's time system. The following deficiencies were identified: · Certain of this revenue was generated from contracts that specified the maximum amount of revenue that could be earned under each contract. The firm did not identify and test any controls that addressed the risk that revenue may have been recognized in excess of these contractual maximums. (AS 2201.39)

The issuer used multiple service organizations to host and/or maintain and manage IT systems that the issuer used to initiate process and record transactions related to certain revenue for another business unit. The following deficiencies were identified: · The firm did not perform any procedures to test controls at certain other service organizations or identify and test any other controls over the revenue processed by the systems maintained and managed by these service organizations. (AS 2201.39 and .B19)

For certain business units the firm selected for testing an automated control over the timing of revenue recognition. The firm did not test the configuration of this automated control or perform other procedures that would have provided sufficient appropriate audit evidence that the control was designed and operating effectively. (AS 2201.42 and .44)

The issuer recognized certain revenue based on the daily market price of a commodity that the issuer obtained from a service organization. The following deficiencies were identified: · The firm selected for testing a control that included the issuer's investigation of daily price variances that exceeded a certain threshold. The firm did not evaluate whether the threshold the control owner used to investigate variances was sufficiently precise to detect misstatements that could be material. (AS 2201.42)

The issuer recognized certain revenue based on the daily market price of a commodity that the issuer obtained from a service organization. The following deficiencies were identified: · The firm selected for testing a control that included the issuer's investigation of daily price variances that exceeded a certain threshold. The firm did not perform any procedures to obtain evidence regarding the service organization's controls for the year under audit. (AS 2201.39 and .B19)

The issuer initiated and processed sales transactions at numerous business units. The firm designated certain business units as subject to more extensive audit procedures and used an other accounting firm to test one of these business units. The following deficiencies were identified: · The firm did not identify and test any controls over the accuracy of the pricing information the issuer used to record revenue at the business units it tested. (AS 2201.39)

The issuer's revenue included revenue recognized from contracts over time based on hours incurred to date relative to total estimated hours to complete. The following deficiency was identified: · The firm did not identify and test any controls over the identification of performance obligations in contracts determination of the transaction price and allocation of the transaction price to the identified performance obligations. (AS 2201.39)

The issuer recognized revenue through multiple segments from foreign and domestic sales. The firm did not identify and test any controls over the recognition of revenue by one of the issuer's segments during the year from domestic sales to ensure that revenue was recognized only after performance obligations were satisfied and customers obtained control of the goods. (AS 2201.39)

The issuer used multiple point-of-sale (POS) applications to initiate and process revenue transactions. The firm selected for testing two controls related to the automated calculation of sales discounts and the review of those discounts by designated individuals with certain access levels. For two of the POS applications the firm did not perform any procedures to test these controls. (AS 2201.42 and .44)

The issuer used multiple point-of-sale (POS) applications to initiate and process revenue transactions. The firm selected for testing two controls related to the automated calculation of sales discounts and the review of those discounts by designated individuals with certain access levels. For the other POS applications the firm did not: · perform any procedures to test that the access to change the configuration was appropriately restricted; · identify and test the controls for all of the discount types that were applied to the issuer's sales transactions; and · perform sufficient procedures to determine that certain of the designated access levels were the only designations that allowed for approval of sales discounts because the procedures were limited to testing one level of access. (AS 2201.42 and .44)

The issuer used multiple point-of-sale (POS) applications to initiate and process revenue transactions. The firm selected for testing two controls related to the automated calculation of sales discounts and the review of those discounts by designated individuals with certain access levels. For restaurant sales the following deficiency was identified: · The firm performed certain dual-purpose testing for its substantive testing and its testing of the operating effectiveness of certain related controls: - The firm did not achieve the objectives of both the test of controls and the substantive test because the sampling unit and attributes tested were not the same. (AS 2301.47)

The issuer used information technology ('IT') applications to initiate process and record revenue. The firm identified multiple control deficiencies related to controls over logical access and program changes. The firm concluded that these deficiencies represented a significant deficiency after identifying and testing several compensating controls. The firm did not sufficiently evaluate the severity of the control deficiencies because it did not determine whether the compensating controls addressed the same objective and assertions as the ineffective controls. (AS 2201.68)

The firm selected for testing an automated control over revenue that was designed to record revenue once the issuer processed an invoice in its system. The firm did not sufficiently test this automated control because it only tested one instance which was not appropriate due to the control deficiencies described above. (AS 2201.42 .44 and .46)

The firm did not identify and test any controls that addressed whether the performance obligation was satisfied before revenue was recognized. (AS 2201.39)

For one type of revenue the firm did not identify and test any controls that addressed whether the performance obligation was satisfied before revenue was recognized. (AS 2201.39)

The firm selected for testing a control that consisted of a quarterly comparison of a system-generated list of invoices used to recognize revenue to the related shipping documents to determine whether revenue was recorded in the correct period. The firm's testing of this control did not provide sufficient appropriate audit evidence of the control's operating effectiveness because the firm limited its testing to one invoice from each instance in which the control was selected for testing. (AS 2201.46)

The issuer used a service organization to provide management reporting related to certain revenue. The firm did not perform any procedures to evaluate whether the issuer implemented the appropriate CUECs as described in the service auditor's report. (AS 2201.39 and .B22)

The issuer recognized revenue at numerous locations based on the contractual terms of each sales arrangement and certain contractually determined price adjustments. The firm selected for testing a control that consisted of management's review and approval of contractual terms entered into the issuer's revenue system and used to recognize revenue. The firm did not evaluate certain information obtained during its testing that appeared to be inconsistent with the contractual terms in the issuer's revenue system. (AS 2201.44)

The issuer recognized revenue at numerous locations based on the contractual terms of each sales arrangement and certain contractually determined price adjustments. The firm selected for testing a control that consisted of management's review and approval of contractual terms entered into the issuer's revenue system and used to recognize revenue. The firm did not identify and test any controls over the determination of price adjustments used to recognize revenue at one location. (AS 2201.39)

For certain revenue which was affected by the audit deficiencies related to user access the following additional deficiency was identified: The firm did not identify and test any controls over the manually recorded transaction prices used to recognize the revenue to ensure that they agreed with the prices associated with the respective sales orders. (AS 2201.39)

The firm selected for testing certain user access controls over this IT system that consisted of the configuration of the IT systems to restrict access to authorized users depending on the nature of the activities performed by the users. The firm did not test aspects of these controls that would address certain risks identified by the firm associated with certain personnel having privileged access to specific functions of the IT system. (AS 2201.42 and .44)

The issuer used a service organization to invoice customers when services were rendered. The following deficiencies were identified: · The firm selected for testing a complementary user control over the review of sales orders. The firm did not test certain attributes of this control intended to validate both the accuracy of rates charged to customers and the timing of services rendered. In addition the firm did not identify and test any other complementary user controls designed to ensure that the services were rendered as scheduled in the service organization's system. (AS 2201.B22)

A third IT system was hosted by a service organization. The firm did not perform any procedures to test the design and operating effectiveness of complementary user controls the issuer implemented to address a stated control objective in the service auditor's report. (AS 2201.42 .44 and .B22)

The firm selected for testing a complementary user control that consisted of the issuer's reviews of user access to the service organization's IT system. The firm did not perform any procedures to evaluate whether the issuer had implemented any complementary user controls related to change management. (AS 2201.39 and .B22)