Explorer

The firm did not perform sufficient substantive procedures to test or identify and test controls over the completeness of reports it used to make selections for testing these change management controls and certain other controls over logical access because it limited its procedures to observing the issuer generate the reports. (AS 1105.10)

The firm tested information technology (IT) dependent manual controls that used reports generated by the two applications. The firm's approach to test the accuracy and completeness of these reports depended on effective IT general controls. In addition the firm tested certain automated application controls within the two applications as of a point in time. As a result of the above deficiencies the firm's testing of these controls was not sufficient. (AS 2201.46)

The issuer used two information-technology (IT) systems to initiate process and/or record transactions related to certain revenue recognized at various locations. In its testing of controls over this revenue the firm tested two IT-dependent manual controls that used data and reports generated or maintained by these IT systems. The accuracy and completeness of these data and reports depended on effective IT general controls (ITGCs). The firm however did not test the operating effectiveness of the ITGCs over these IT systems. (AS 2201.44)

The issuer used two information-technology (IT) systems to initiate process and/or record transactions related to certain revenue recognized at various locations. In its testing of controls over this revenue the firm tested two IT-dependent manual controls that used data and reports generated or maintained by these IT systems. The accuracy and completeness of these data and reports depended on effective IT general controls (ITGCs). As a result of the deficiency in the firm's testing of ITGCs the firm's testing of these IT-dependent manual controls was not sufficient. (AS 2201.46)

The issuer used an information technology (IT) system to process certain revenue transactions under multiple revenue recognition scenarios. To reduce the extent of its substantive procedures for this revenue the firm tested and placed reliance on certain IT general controls (ITGCs). The following deficiencies were identified: · The firm selected for testing a change management control over this IT system that consisted of the testing and approval of system changes prior to their migration into the production environment. The issuer documented system changes in tickets that were entered into a change ticket tracking system. The firm did not perform sufficient procedures to test or test any controls over the completeness of the population of changes from which it made its selections for testing this control because it limited its procedures to obtaining a list of change tickets from the change ticket tracking system without performing procedures to determine if there were changes that were not captured in that system. (AS 1105.10)

The issuer used an information technology (IT) system to process certain revenue transactions under multiple revenue recognition scenarios. To reduce the extent of its substantive procedures for this revenue the firm tested and placed reliance on certain IT general controls (ITGCs). The following deficiencies were identified: · The firm selected for testing another change management control over this IT system that consisted of the restriction of access to migrate system changes from the development environment into the production environment. The firm did not identify and evaluate a control design deficiency related to certain IT users that had the ability to develop system changes and migrate system changes from the development environment into the production environment. (AS 2301.19)

The issuer used an information technology (IT) system to process certain revenue transactions under multiple revenue recognition scenarios. To reduce the extent of its substantive procedures for this revenue the firm tested and placed reliance on certain IT general controls (ITGCs). The following deficiencies were identified: · The firm did not perform sufficient procedures to test this revenue because it did not test (1) whether this IT system appropriately processed this revenue under each of the revenue recognition scenarios and (2) the inputs used in determining the revenue recognized. (AS 2301.08)

The issuer used an information technology (IT) system to process certain revenue transactions under multiple revenue recognition scenarios. To reduce the extent of its substantive procedures for this revenue the firm tested and placed reliance on certain IT general controls (ITGCs). The firm did not perform procedures to test or sufficiently test controls over the accuracy and completeness of certain system-generated data that it used to substantively test this revenue and certain other revenue. (AS 1105.10)

The firm's internal inspection program inspected this audit and reviewed these areas but did not identify the deficiencies below. The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to revenue. In its testing of controls over revenue the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by the IT systems that depended on effective IT general controls (ITGCs). As a result of the deficiencies in the firm's testing of ITGCs the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

The firm's internal inspection program inspected this audit and reviewed these areas but did not identify the deficiencies below. The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to revenue. In its testing of controls over revenue the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by the IT systems that depended on effective IT general controls (ITGCs). With respect to change management: The firm selected for testing a change management control over certain IT systems that consisted of the recording of non-emergency changes in the issuer's ticketing system and the review and approval of such changes. The firm did not perform procedures to test or test any controls over the completeness of the population of changes from which it made its selections for testing. (AS 1105.10)

The firm's internal inspection program inspected this audit and reviewed these areas but did not identify the deficiencies below. The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to revenue. In its testing of controls over revenue the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by the IT systems that depended on effective IT general controls (ITGCs). With respect to developer access: The firm did not identify and test any controls over the ability of developers to develop and migrate changes to the production environment for certain IT systems. (AS 2201.39)

The firm's internal inspection program inspected this audit and reviewed these areas but did not identify the deficiencies below. The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to revenue. In its testing of controls over revenue the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by the IT systems that depended on effective IT general controls (ITGCs). With respect to the firm's testing of other controls including automated and IT-dependent manual controls over the recognition of certain revenue which were affected by the audit deficiencies related to change management and developer access the following additional deficiencies were identified: · For certain controls the firm did not identify and test any controls over the accuracy and completeness of data and reports generated by various IT systems that the control owners used in the operation of the controls. (AS 2201.39)

The firm's internal inspection program inspected this audit and reviewed these areas but did not identify the deficiencies below. The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to revenue. In its testing of controls over revenue the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by the IT systems that depended on effective IT general controls (ITGCs). With respect to the firm's testing of other controls including automated and IT-dependent manual controls over the recognition of certain revenue which were affected by the audit deficiencies related to change management and developer access the following additional deficiencies were identified: · For certain controls the firm did not perform procedures to test or test any controls over the completeness of the populations from which it made its selections for testing. (AS 1105.10)

The firm's internal inspection program inspected this audit and reviewed these areas but did not identify the deficiencies below. The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to revenue. In its testing of controls over revenue the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by the IT systems that depended on effective IT general controls (ITGCs). With respect to the firm's testing of other controls including automated and IT-dependent manual controls over the recognition of certain revenue which were affected by the audit deficiencies related to change management and developer access the following additional deficiencies were identified: · For certain controls the firm did not test controls over the completeness of data and reports generated by various IT systems that were used in the operation of the controls beyond comparing information from these reports to data from the same reports and/or reviewing emails retained by the control owners. (AS 2201.42 and .44)

The firm tested certain automated and information technology (“IT”) dependent manual controls over revenue that used data and reports generated or maintained by the issuer's revenue systems. The firm tested IT general controls (“ITGCs”) over these systems and identified multiple control deficiencies at two of the issuer's segments. In performing its testing of identified compensating controls for those segments the firm did not identify that the control owners used information in the performance of two of these compensating controls that was produced by the systems that were subject to the ITGC deficiencies. (AS 2201.68)

The issuer used two service organizations to process certain revenue. For one service organization the firm did not perform any procedures to obtain evidence regarding the service organization's controls for the year under audit. For the other service organization the firm did not perform any procedures to ascertain whether there were any changes in the service organization's controls from the date of the service auditor's report which was 11 months before year end. In addition the firm selected for testing certain IT-dependent manual controls over this revenue that used data and reports from the two service organizations. The firm's testing of these controls was insufficient due to the deficiencies discussed above. (AS 2201.39 .B19 .B24 and .B25)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions. In its testing of controls over certain revenue and related accounts the firm tested various IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. As a result of the following deficiencies in the firm's testing of IT general controls (ITGCs) the firm's testing of these IT-dependent controls was not sufficient. (AS 2201.46)

The firm used system-generated data and reports in its testing of revenue. The following deficiencies were identified: · The extent of the firm's procedures to test the accuracy of certain of these system-generated reports was not sufficient because when calculating its sample size the firm did not take into account an identified significant deficiency over ITGCs for this system. (AS 1105.10)

The issuer used an information-technology (IT) system to initiate transactions related to certain revenue. In its testing of controls over this revenue the firm tested various automated and IT-dependent manual controls that used data generated by this IT system. As a result of the following audit deficiencies the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46) In connection with our review the issuer reevaluated its controls over this revenue and concluded that a material weakness existed that had not been previously identified. The issuer subsequently reflected this material weakness in a revision to its report on ICFR and the firm revised its opinion on the effectiveness of the issuer's ICFR to express an adverse opinion and reissued its report.

The firm's internal inspection program had inspected this audit reviewed these areas and also identified the deficiencies below. The issuer used an IT system to record transactions related to revenue. In its testing of controls over revenue the firm tested an IT-dependent manual control that used a report generated from this system. As a result of this deficiency in the firm's testing of ITGCs the firm's testing of this IT-dependent manual control was not sufficient. (AS 2201.46)

The issuer used two IT systems to initiate process and record transactions related to certain revenue. In its testing of controls over this revenue the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. As a result of the following deficiencies in the firm's testing of ITGCs the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

The firm's internal inspection program inspected this audit and reviewed the revenue area but did not identify the deficiency below. The issuer used multiple service organizations to host and/or maintain information technology (IT) systems that the issuer used to initiate process and record transactions related to this revenue. In its testing of controls over this account the firm tested certain IT-dependent manual controls that used data and reports generated or maintained by these IT systems. As a result of the deficiencies in the firm's testing of IT general controls the firm's testing of these IT-dependent manual controls was not sufficient. (AS 2201.46)

The issuer used direct labor costs from its timekeeping system in its actual costs incurred used to determine revenue recognition. The firm tested certain information-technology ('IT') dependent manual controls that used data from the timekeeping system but the firm did not identify and test any ITGCs or other controls over the issuer's timekeeping system. As a result the firm's testing of IT dependent manual controls was not sufficient. (AS 2201.46)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to Revenue which was affected by the audit deficiencies related to user access and change management the following additional deficiency was identified: · The firm selected for testing a control that consisted of the issuer's review of price changes made in the accounting system as reflected in a customized system-generated report to determine whether they were properly approved. The firm did not identify and test any controls over the accuracy and completeness of the report used in the operation of the control. (AS 2201.39)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to Revenue which was affected by the audit deficiencies related to user access and change management the following additional deficiency was identified: · The firm selected for testing a control that consisted of the issuer's review of price changes made in the accounting system as reflected in a customized system-generated report to determine whether they were properly approved. The firm did not test an aspect of the control related to the issuer's review of certain price changes. (AS 2201.42 and .44)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to Revenue which was affected by the audit deficiencies related to user access and change management the following additional deficiency was identified: · The firm selected for testing an automated control that consisted of the configuration of the issuer's accounting system to automatically update invoiced sales prices to reflect those within the system's price list and used a 'test of one' approach to test the control. The firm did not perform sufficient procedures to support the use of such an approach because it did not test the configuration or programming of the control during the audit period or perform other procedures that would have provided sufficient appropriate audit evidence that the control was designed and operating effectively. (AS 2201.46)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to Revenue which was affected by the audit deficiencies related to user access and change management the following additional deficiency was identified: · The firm selected for testing controls that consisted of management's review and approval of printed sales orders. The firm did not perform procedures to test or test any controls over the completeness of the population of certain sales orders from which it made its selections for testing. (AS 1105.10)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to Revenue which was affected by the audit deficiencies related to user access and change management the following additional deficiency was identified: · The firm selected for testing controls that consisted of the reconciliation of revenue and inventory sold and management's review and approval of the reconciliations. The firm did not identify and test any controls over the accuracy and completeness of the reports used in the operation of these controls. (AS 2201.39)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to Revenue which was affected by the audit deficiencies related to user access and change management the following additional deficiency was identified: · The firm selected for testing an automated control that consisted of automatic interfaces between the issuer's accounting system and certain of its production and dispatch related systems and used a 'test of one' approach to test the control. The firm did not perform sufficient procedures to support the use of such an approach because it did not test the interface configuration or programming of the control or perform procedures to test the design of the control as it relates to each relevant interface. (AS 2201.46)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to Revenue which was affected by the audit deficiencies related to user access and change management the following additional deficiency was identified: · The firm's approach for substantively testing revenue consisted primarily of performing a software-assisted analysis to test the relationships among revenue accounts receivable and cash receipts. The reliability of the audit evidence obtained from this analysis was dependent upon the firm's testing of cash receipts data underlying the analysis. To test this data the firm reconciled certain cash activity used in the analysis to the respective cash accounts in the issuer's general ledger and agreed a sample of cash receipts to bank statements and customer remittance advices. The firm did not perform sufficient procedures to evaluate whether the cash receipts data was appropriate for use in the analysis because it (1) did not reconcile all cash activity used in the analysis to the respective cash accounts in the issuer's general ledger (2) made the majority of its cash receipts selections from the population of trade accounts receivable and unallocated receivable journal entries rather than the cash journal entries used in the analysis and (3) did not evaluate whether certain cash receipts selected for testing related to revenue and were appropriately included in the cash data underlying the analysis. (AS 1105.10)

The sample sizes the firm used in certain of its substantive procedures to test revenue were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to deficiencies in the firm's testing of ITGCs discussed and the deficiency in the firm's control testing related to certain revenue discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The issuer used an information technology (IT) system to process certain transactions related to revenue. In its testing of controls over revenue the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by this IT system. As a result of the following deficiencies in the firm's testing of IT general controls (ITGCs) the firm's testing of these automated and IT-dependent controls was not sufficient. (AS 2201.46)

For certain revenue which was affected by the audit deficiencies discussed above the following additional deficiencies related to the firm's testing of controls were identified: · The firm selected for testing three IT-dependent manual controls over the processing of certain customer orders and invoices. For two of these controls the firm did not identify and test any controls over the accuracy and completeness of certain data used in the operation of these controls. (AS 2201.39)

For certain revenue which was affected by the audit deficiencies discussed above the following additional deficiencies related to the firm's testing of controls were identified: · The firm selected for testing three IT-dependent manual controls over the processing of certain customer orders and invoices. For the third control the firm's testing of controls over the accuracy and completeness of a report used in the operation of this control using a sample of only one instance was not sufficient because the firm did not test whether changes to configurations within these controls were subject to effective ITGCs over these IT systems. (AS 2201.46)

The firm tested information technology ('IT') dependent manual controls that used reports generated by certain of these applications. The firm's approach to test the accuracy and completeness of these reports depended on effective IT general controls. As a result of the above deficiencies the firm's testing of these IT-dependent manual controls was not sufficient. (AS 2201.46)

For a third type of revenue consisting of three categories the following deficiencies were identified: · The firm did not perform substantive procedures to test or (as a result of the control testing and the ITGC deficiencies discussed above) sufficiently test controls over the completeness of system-generated reports that the firm used in its substantive testing of this type of revenue. (AS 1105.10)

For two types of revenue the following deficiencies were identified: · The firm's substantive procedures to test this revenue consisted of recalculating the invoices it selected for testing using the billing rates in one of the revenue systems that was subject to the ITGC deficiencies discussed above. The firm did not perform sufficient substantive procedures to test or (as a result of the control testing and ITGC deficiencies discussed above) sufficiently test controls over the accuracy of these billing rates. (AS 1105.10)

The firm identified a significant deficiency in certain ITGCs over source code change management for the system that the issuer used to process revenue. The issuer implemented a control intended to mitigate the significant deficiency. This control consisted of the issuer's review of a report of source code changes to the system. The firm did not identify and test any controls over the accuracy and completeness of this report. (AS 2201.39)

The firm selected for testing various automated controls over the recording of revenue related to loans receivable. The firm designed its procedures including its sample sizes to test the operating effectiveness of these automated controls based on effective ITGCs. As a result of the ITGC deficiency discussed above these sample sizes were too small to provide sufficient appropriate audit evidence. (AS 2201.44)

The issuer used an information-technology (IT) system to process and record transactions related to revenue at one segment. In its testing of controls over this revenue the firm tested an IT-dependent manual control that used data and reports generated or maintained by this system. As a result of the deficiencies in the firm's testing of IT general controls (ITGCs) discussed below the firm's testing of this IT-dependent manual control was not sufficient. (AS 2201.46)

The issuer used two information-technology (IT) systems to process and record certain revenue transactions related to services provided to its customers; one of these systems was maintained by an external service organization. The following deficiencies were identified: · The firm selected for testing certain automated and IT-dependent manual controls over this revenue. The firm's approach to testing these controls depended on effective IT general controls (ITGCs) including controls over access to the systems. Due to the deficiencies in the firm's testing of these controls discussed above the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

The issuer used an internally developed IT system to track the volume of services provided for one type of revenue. In its testing of controls over this revenue the firm tested various automated and IT-dependent manual controls that used data from this system. The firm selected for testing a control over change management that consisted of a review of activity of certain developers with change access to this system. The firm did not evaluate whether this control was designed to address the risk of material misstatement with respect to developers with change access that were not selected for review. (AS 2201.42)

The issuer used an internally developed IT system to track the volume of services provided for one type of revenue. In its testing of controls over this revenue the firm tested various automated and IT-dependent manual controls that used data from this system. The firm selected for testing a control over change management that consisted of a review of activity of certain developers with change access to this system. As a result of the deficiency in the firm's testing of the IT general control the firm's testing of the various automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

The firm's internal inspection program had inspected this audit and reviewed this area but did not identify the deficiencies below. The issuer used two internally developed IT systems to process transactions related to certain revenue. In its testing of controls over this revenue the firm tested various automated controls that used data generated or maintained by these IT systems. As a result of deficiencies in the firm's testing of IT general controls the firm's testing of these automated controls was not sufficient. (AS 2201.46)

The issuer used an information technology (IT) system at one component to initiate process and record certain revenue transactions. In its testing of controls over this revenue the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by this IT system. The accuracy and completeness of these data and reports depended on effective IT general controls (ITGCs). As a result of the following deficiencies in the firm's testing of change management ITGCs the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46) Unrelated to our review the issuer filed a Form 8-K indicating that its previously issued financial statements and the firm's related audit reports should not be relied upon because of certain material misstatements contained in the financial statements. The issuer corrected the misstatements and reported that its ICFR was not effective. The firm also expressed an adverse opinion on the effectiveness of the issuer's ICFR.

The issuer used a different IT system at another component which was an outsourced application to initiate process and record revenue transactions. The firm inspected the related service auditor's report for this system and noted that the accuracy and completeness of standard reports generated from this system were addressed through certain ITGCs over the system that were tested by the service auditor. The service auditor's report however did not specifically identify the standard reports that were addressed through these ITGC's. For certain revenue transactions invoices were generated and revenue was recognized once the order fulfillment status in the system indicated that the orders had been fulfilled. The following deficiency was identified: · The firm did not identify and evaluate a departure from GAAP related to the issuer's recognition of certain revenue. In this instance the issuer's recognition of revenue appears not to have been in conformity with ASC 606. (AS 2810.30) Unrelated to our review the issuer filed a Form 8-K indicating that its previously issued financial statements and the firm's related audit reports should not be relied upon because of certain material misstatements contained in the financial statements. The issuer corrected the misstatements and reported that its ICFR was not effective. The firm also expressed an adverse opinion on the effectiveness of the issuer's ICFR.

The firm selected for testing two change management controls over this IT system that consisted of the (1) restricting of access to deploy system changes into the production environment to authorized personnel and (2) documentation review testing and approval of system changes prior to their migration into the production environment. The issuer documented the system changes in tickets that were entered into a change ticket tracking system. The following deficiency was identified: · The firm did not perform sufficient procedures to test or test any controls over the completeness of the population of changes from which it made its selections for testing these controls because it limited its procedures to obtaining listings of change tickets from the change ticket tracking system without contemplating potential changes that were not captured in that system. (AS 1105.10) Unrelated to our review the issuer filed a Form 8-K indicating that its previously issued financial statements and the firm's related audit reports should not be relied upon because of certain material misstatements contained in the financial statements. The issuer corrected the misstatements and reported that its ICFR was not effective. The firm also expressed an adverse opinion on the effectiveness of the issuer's ICFR.

The firm selected for testing two change management controls over this IT system that consisted of the (1) restricting of access to deploy system changes into the production environment to authorized personnel and (2) documentation review testing and approval of system changes prior to their migration into the production environment. The issuer documented the system changes in tickets that were entered into a change ticket tracking system. The following deficiency was identified: · The firm did not test an aspect of the first control related to the segregation of duties between system change developers and deployers. (AS 2201.42 and .44) Unrelated to our review the issuer filed a Form 8-K indicating that its previously issued financial statements and the firm's related audit reports should not be relied upon because of certain material misstatements contained in the financial statements. The issuer corrected the misstatements and reported that its ICFR was not effective. The firm also expressed an adverse opinion on the effectiveness of the issuer's ICFR.

The issuer used a different IT system at another component which was an outsourced application to initiate process and record revenue transactions. The firm inspected the related service auditor's report for this system and noted that the accuracy and completeness of standard reports generated from this system were addressed through certain ITGCs over the system that were tested by the service auditor. The service auditor's report however did not specifically identify the standard reports that were addressed through these ITGC's. For certain revenue transactions invoices were generated and revenue was recognized once the order fulfillment status in the system indicated that the orders had been fulfilled. The following deficiency was identified: · The firm selected for testing controls over this revenue that consisted of (1) management's review and approval of sales orders created in this IT system and (2) management's review of new prices and changes to existing prices before those prices and changes were uploaded into this IT system. The firm identified deficiencies in the design and operating effectiveness of these controls. The firm identified and tested compensating controls that it believed would mitigate the deficiencies. The firm did not identify that these compensating controls did not address the risks of material misstatement related to inaccurate and unauthorized sales orders and prices related to this revenue. (AS 2201.68) Unrelated to our review the issuer filed a Form 8-K indicating that its previously issued financial statements and the firm's related audit reports should not be relied upon because of certain material misstatements contained in the financial statements. The issuer corrected the misstatements and reported that its ICFR was not effective. The firm also expressed an adverse opinion on the effectiveness of the issuer's ICFR.

The issuer used a different IT system at another component which was an outsourced application to initiate process and record revenue transactions. The firm inspected the related service auditor's report for this system and noted that the accuracy and completeness of standard reports generated from this system were addressed through certain ITGCs over the system that were tested by the service auditor. The service auditor's report however did not specifically identify the standard reports that were addressed through these ITGC's. For certain revenue transactions invoices were generated and revenue was recognized once the order fulfillment status in the system indicated that the orders had been fulfilled. The following deficiency was identified: · The firm did not identify and test any controls that would address risks associated with improper revenue recognition from certain sales. (AS 2201.39) Unrelated to our review the issuer filed a Form 8-K indicating that its previously issued financial statements and the firm's related audit reports should not be relied upon because of certain material misstatements contained in the financial statements. The issuer corrected the misstatements and reported that its ICFR was not effective. The firm also expressed an adverse opinion on the effectiveness of the issuer's ICFR.