Explorer

The issuer used a different IT system at another component which was an outsourced application to initiate process and record revenue transactions. The firm inspected the related service auditor's report for this system and noted that the accuracy and completeness of standard reports generated from this system were addressed through certain ITGCs over the system that were tested by the service auditor. The service auditor's report however did not specifically identify the standard reports that were addressed through these ITGC's. For certain revenue transactions invoices were generated and revenue was recognized once the order fulfillment status in the system indicated that the orders had been fulfilled. The following deficiency was identified: · The firm did not identify and test any controls over the accuracy of the fulfillment status in this IT system. (AS 2201.39) Unrelated to our review the issuer filed a Form 8-K indicating that its previously issued financial statements and the firm's related audit reports should not be relied upon because of certain material misstatements contained in the financial statements. The issuer corrected the misstatements and reported that its ICFR was not effective. The firm also expressed an adverse opinion on the effectiveness of the issuer's ICFR.

The issuer used a different IT system at another component which was an outsourced application to initiate process and record revenue transactions. The firm inspected the related service auditor's report for this system and noted that the accuracy and completeness of standard reports generated from this system were addressed through certain ITGCs over the system that were tested by the service auditor. The service auditor's report however did not specifically identify the standard reports that were addressed through these ITGC's. For certain revenue transactions invoices were generated and revenue was recognized once the order fulfillment status in the system indicated that the orders had been fulfilled. The following deficiency was identified: · The firm selected for testing a control that consisted of management's review of a sales discounts/rebates analysis workbook and the related journal entry to record the sales discounts/rebates. The firm did not perform sufficient procedures to test the accuracy and completeness of the revenue report which was used in the operation of this control because it did not perform procedures to verify that it was a standard report within the scope of the service auditor's report beyond inquires of management. (AS 2201.42) Unrelated to our review the issuer filed a Form 8-K indicating that its previously issued financial statements and the firm's related audit reports should not be relied upon because of certain material misstatements contained in the financial statements. The issuer corrected the misstatements and reported that its ICFR was not effective. The firm also expressed an adverse opinion on the effectiveness of the issuer's ICFR.

The issuer used a different IT system at another component which was an outsourced application to initiate process and record revenue transactions. The firm inspected the related service auditor's report for this system and noted that the accuracy and completeness of standard reports generated from this system were addressed through certain ITGCs over the system that were tested by the service auditor. The service auditor's report however did not specifically identify the standard reports that were addressed through these ITGC's. For certain revenue transactions invoices were generated and revenue was recognized once the order fulfillment status in the system indicated that the orders had been fulfilled. The following deficiency was identified: · The firm did not perform sufficient procedures to evaluate whether certain revenue was recognized in conformity with FASB ASC Topic 606 Revenue from Contracts with Customers ('ASC 606') because at the time revenue was recognized for certain transactions the firm did not obtain any evidence that a legally enforceable contract existed or that the performance obligation was satisfied. (AS 2301.08 and .11) Unrelated to our review the issuer filed a Form 8-K indicating that its previously issued financial statements and the firm's related audit reports should not be relied upon because of certain material misstatements contained in the financial statements. The issuer corrected the misstatements and reported that its ICFR was not effective. The firm also expressed an adverse opinion on the effectiveness of the issuer's ICFR.

The firm's internal inspection program had inspected this audit and reviewed this area but did not identify the deficiencies below. The issuer used a customized application for processing and recording transactions related to revenue. The firm tested the design and operating effectiveness of information technology general controls (ITGCs) and certain automated and IT-dependent manual controls over this application in order to rely on the completeness and accuracy of data and reports produced by the application and used by the firm in its substantive procedures. The following deficiencies were identified: · The firm selected for testing controls over the review and approval of program changes but did not evaluate whether the controls were designed to address the risk that developers have the ability to develop and promote changes to production environments. (AS 2301.19)

The firm tested the design and operating effectiveness of certain ITGCs over the issuer's general ledger and other systems in order to rely on the accuracy and completeness of underlying data produced by the issuer that was used in the firm's substantive testing of certain revenue. The firm identified deficiencies in its testing of certain ITGCs. The following deficiencies were identified: · The firm identified compensating controls but did not perform any procedures to test the design and operating effectiveness of those controls during the entire period of reliance. (AS 2301.16)

The firm's internal inspection program had inspected this audit and reviewed this area but did not identify the deficiencies below. The issuer used a customized application for processing and recording transactions related to revenue. The firm tested the design and operating effectiveness of information technology general controls (ITGCs) and certain automated and IT-dependent manual controls over this application in order to rely on the completeness and accuracy of data and reports produced by the application and used by the firm in its substantive procedures. The following deficiencies were identified: · The firm selected for testing controls over change management but did not perform procedures to determine whether the population of changes from which it made its selections for testing represented the complete population of changes made to this application. (AS 1105.10)

The firm tested the design and operating effectiveness of certain ITGCs over the issuer's general ledger and other systems in order to rely on the accuracy and completeness of underlying data produced by the issuer that was used in the firm's substantive testing of certain revenue. The firm identified deficiencies in its testing of certain ITGCs. The following deficiencies were identified: · The firm selected for testing certain automated and IT-dependent manual controls over this revenue. The firm's approach to testing these controls depended on effective IT general controls (ITGCs). As a result of the deficiency in the firm's testing of the controls discussed above the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2301.18)

The firm's internal inspection program had inspected this audit and reviewed this area but did not identify the deficiencies below. The issuer used a customized application for processing and recording transactions related to revenue. The firm tested the design and operating effectiveness of information technology general controls (ITGCs) and certain automated and IT-dependent manual controls over this application in order to rely on the completeness and accuracy of data and reports produced by the application and used by the firm in its substantive procedures. The following deficiencies were identified: · The firm selected for testing certain automated and IT-dependent manual controls over this revenue. The firm's approach to testing these controls depended on effective ITGCs including controls over change management. As a result of the deficiencies in the firm's testing of the controls discussed above the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2301.18)

The firm's internal inspection program had inspected this audit and reviewed this area but did not identify the deficiencies below. The issuer used a customized application for processing and recording transactions related to revenue. The firm tested the design and operating effectiveness of information technology general controls (ITGCs) and certain automated and IT-dependent manual controls over this application in order to rely on the completeness and accuracy of data and reports produced by the application and used by the firm in its substantive procedures. The following deficiencies were identified: · The firm did not identify and test controls that addressed the issuer's evaluation of the reliability of external information used in the operation of certain controls the firm selected for testing. (AS 2301.16)

The issuer used a customized application for processing and recording transactions related to revenue. The firm tested the design and operating effectiveness of ITGCs and certain automated controls over this application in order to rely on the completeness and accuracy of data and reports produced by the application and used by the firm in its substantive procedures over certain revenue. The firm determined that certain ITGCs were not effective at year end. The following deficiencies were identified: · The firm did not evaluate the severity of the ITGC deficiencies and the effect on its control risk assessment. (AS 2301.34)

The issuer used a customized application for processing and recording transactions related to revenue. The firm tested the design and operating effectiveness of ITGCs and certain automated controls over this application in order to rely on the completeness and accuracy of data and reports produced by the application and used by the firm in its substantive procedures over certain revenue. The firm determined that certain ITGCs were not effective at year end. The following deficiencies were identified: · The firm's approach to testing certain automated controls depended on effective ITGCs. As a result of the control deficiencies that the firm identified as discussed above the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2301.18)

The issuer used an information technology (IT) system to process certain revenue transactions. The firm's approach to testing revenue included reliance on certain IT change management controls over certain issuer-produced information used in the firm's substantive procedures. The firm did not perform procedures to test the completeness of the information that the firm used to test these IT change management controls. (AS 1105.10)

The issuer used an information technology (IT) system to process certain revenue transactions. The firm's approach to testing revenue included reliance on certain IT change management controls over certain issuer-produced information used in the firm's substantive procedures. The issuer recognized several types of revenue. To test one type of revenue the firm performed a substantive analytical procedure using sales data produced by the issuer's system. The firm did not perform procedures to test or test any controls over the accuracy and completeness of that data. (AS 2305.16)

The issuer used an information technology (IT) system to process certain revenue transactions. The firm's approach to testing revenue included reliance on certain IT change management controls over certain issuer-produced information used in the firm's substantive procedures. The firm selected a sample of transactions to test another type of revenue. The firm did not perform procedures to test or test any controls over the accuracy and completeness of certain issuer-prepared sales data that was used in testing the selected transactions. (AS 1105.10)

The issuer recorded revenue when a user action in an electronic environment occurred and the revenue recognition criteria had been met. The issuer used an IT application to track user actions define and capture valid billable user actions and generate user activity reports. The firm tested IT general controls (“ITGCs”) and identified control deficiencies related to this IT application and the general ledger. The firm concluded either that the deficiencies were mitigated by other controls or that the deficiencies did not directly affect the firm's reliance on the issuer's controls over the accuracy and completeness of the data derived from the IT application. To test the accuracy and completeness of the reports the firm used in its substantive testing of revenue the firm (1) relied on its testing of ITGCs and application controls over revenue and (2) confirmed user activity with customers. The firm's reliance on these ITGCs and application controls was not supported because the firm did not sufficiently test the application controls used by the issuer to (1) track user actions (2) capture billable user actions and (3) generate the user activity reports used to calculate revenue because the firm did not consider the criteria necessary for valid user actions to occur how user actions were counted and accumulated and whether revenue recognition requirements were met. The firm also did not test compensating controls that mitigated the identified ITGC deficiencies and did not perform an evaluation to support its conclusion that those deficiencies did not affect its reliance on controls in the IT application. (AS 1105.10)

The issuer recorded revenue when a user action in an electronic environment occurred and the revenue recognition criteria had been met. The issuer used an IT application to track user actions define and capture valid billable user actions and generate user activity reports. The firm tested IT general controls (“ITGCs”) and identified control deficiencies related to this IT application and the general ledger. The firm concluded either that the deficiencies were mitigated by other controls or that the deficiencies did not directly affect the firm's reliance on the issuer's controls over the accuracy and completeness of the data derived from the IT application. To test the accuracy and completeness of the reports the firm used in its substantive testing of revenue the firm (1) relied on its testing of ITGCs and application controls over revenue and (2) confirmed user activity with customers. In addition the firm's confirmation procedures were not sufficient because the firm did not consider whether the issuer's customers would have the information necessary to confirm the user activity. (AS 2310.26)

The issuer recognized certain other revenue based on user activity in an electronic environment that was tracked and provided by two external parties. The firm obtained this information from the issuer and used it in its substantive testing of this revenue. The following deficiencies were identified: · With respect to the user activity information provided by the other external party the firm did not sufficiently test the accuracy and completeness of the information because its procedures were limited to obtaining an understanding of and testing certain IT general controls over the IT system that the external party used to track the activity. (AS 1105.10)

The firm's internal inspection program inspected this audit and reviewed the Revenue and Business Combination areas but did not identify the deficiencies below. The issuer used various service organizations to host and/or maintain IT systems that the issuer used to initiate process and record transactions related to revenue at one business unit. In its testing of controls over this account the firm tested certain IT-dependent manual controls that used data and reports generated or maintained by these IT systems. As a result of the deficiencies in the firm's testing of IT general controls (ITGCs) the firm's testing of these IT-dependent manual controls was not sufficient. (AS 2201.46)

For certain revenue which was affected by the ITGC testing deficiencies discussed above the issuer recognized revenue when a product was shipped. The firm selected for testing various automated controls over revenue recognition but did not test the aspects of these controls that addressed whether shipment had occurred before revenue was recognized. (AS 2201.42 and .44)

For revenue at three business units which was affected by the ITGC audit deficiencies discussed above the firm selected for testing various controls that addressed the recognition of revenue when performance obligations were satisfied. The firm did not identify and test any controls over the accuracy and completeness of certain information used in the operation of these controls. (AS 2201.39)

The firm tested the design effectiveness of ITGCs for two applications used to process revenue transactions. The firm's substantive procedures to test certain revenue transactions consisted of testing the automated calculation for a sample of transactions. The sample sizes the firm used were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported because the firm did not test the operating effectiveness of ITGCs for the two applications discussed above. (AS 2301.16 .18 .21 and .37; AS 2315.19 .23 and .23A)

The issuer's process related to revenue was highly automated with transactions being initiated processed and recorded by numerous information-technology (IT) systems. The issuer identified a material weakness related to ineffective IT general controls over certain IT systems. For the sample of revenue transactions that the firm selected for testing the firm did not perform any procedures to test whether certain information that the issuer used to record revenue was appropriate beyond comparing it to information that was generated by and maintained in certain of the issuer's systems that were affected by the material weakness. (AS 2301.08)The issuer's process related to revenue was highly automated with transactions being initiated processed and recorded by numerous information-technology (IT) systems. The issuer identified a material weakness related to ineffective IT general controls over certain IT systems. For the sample of revenue transactions that the firm selected for testing the firm did not perform any procedures to test whether certain information that the issuer used to record revenue was appropriate beyond comparing it to information that was generated by and maintained in certain of the issuer's systems that were affected by the material weakness. (AS 2301.08)

The firm did not (3) test the operating effectiveness of the issuer's information technology general controls ('ITGCs') that it had identified and tested for design effectiveness. (AS 2201.44)

The firm tested IT general controls and identified a control deficiency for a change management control related to developers having direct access to implement changes. The firm concluded it was a significant deficiency based on the firm's testing of a compensating control that consisted of management's review of change requests. The firm did not sufficiently evaluate the severity of the control deficiency because it did not identify that the compensating control did not address the risk related to unauthorized changes being made directly in the system. (AS 2201.68)

The issuer processed and recorded transactions related to revenue inventory and sales commission expense and sales commission payable using several information-technology ('IT') systems including its enterprise resource planning ('ERP') system. The accuracy and completeness of the data and reports from the ERP system depended on effective IT general controls ('ITGCs'). The firm identified a significant deficiency in ITGCs related to user access to the ERP system. The firm selected for testing an automated control designed to recognize revenue when goods were shipped based on interfaces between various IT systems. The firm did not directly test this control because its procedures were substantive in nature. (AS 2201.42 .44 and .B9)

The issuer processed and recorded transactions related to revenue inventory and sales commission expense and sales commission payable using several information-technology ('IT') systems including its enterprise resource planning ('ERP') system. The accuracy and completeness of the data and reports from the ERP system depended on effective IT general controls ('ITGCs'). The firm identified a significant deficiency in ITGCs related to user access to the ERP system. The firm selected for testing a control that consisted of the issuer's review of revenue transactions for appropriate cut-off that used data and reports generated and maintained by the ERP system and an inventory management system. The firm's testing of this control was not sufficient because it did not consider the implications of the ineffective ITGCs over the ERP system as discussed above. Further the firm did not identify and test any controls over the accuracy and completeness of the data and reports from the issuer's inventory management system beyond determining that the control owner had reviewed the parameters of the reports generated by this system. (AS 2201.39 and .46)

The issuer used various information-technology (IT) systems to initiate process and record transactions related to revenue for one business unit. The firm tested IT general controls (ITGCs) for these IT systems. The following deficiencies were identified · The firm identified a deficiency in ITGCs related to an individual's inappropriate administrative rights over user access to these systems but did not evaluate the severity of this control deficiency. (AS 2201.62)

In its testing of controls over certain revenue for both of these business units the firm selected for testing various IT-dependent manual controls that used data and reports generated or maintained by certain of these systems. As a result of the deficiencies in the firm's control testing over these systems as discussed above the firm's testing of these IT-dependent manual controls was not sufficient. (AS 2201.46)

The issuer used two IT systems to process and record transactions related to revenue. In its testing of controls over this account the firm tested certain IT-dependent manual controls that used data and reports generated or maintained by these IT systems. As a result of the deficiencies in the firm's testing of ITGCs discussed below the firm's testing of these IT-dependent manual controls was not sufficient. (AS 2201.46)

The issuer used two IT systems to process and record transactions related to revenue. In its testing of controls over this account the firm tested certain IT-dependent manual controls that used data and reports generated or maintained by these IT systems. The following ITGC deficiencies were identified: · The firm selected for testing a control over change management but did not perform any procedures to test or in the alternative test any controls over the completeness of the population of changes from which it made its selections for testing. (AS 1105.10)

The firm used the work of the issuer's internal audit as evidence of the effectiveness of automated application controls over the accuracy and completeness of reports that the issuer used in the operation of certain other IT-dependent manual controls over revenue that the firm tested. Internal audit relied on the testing of these controls that was performed in prior years. The firm did not sufficiently evaluate whether internal audit's strategy to rely on testing that was performed in prior years was appropriate because the firm did not evaluate (1) whether ITGCs were effective in those prior years and (2) the effect of certain changes to IT systems that the issuer implemented in the current year. (AS 2201.B29 and .B31; AS 2605.24)

The firm's internal inspection program had inspected this audit and reviewed this area but did not identify the deficiencies below. The issuer used multiple information-technology (IT) systems to initiate process and record revenue. In its testing of controls over certain revenue the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. As a result of the following deficiencies in the firm's testing of IT general controls (ITGCs) over certain of these IT systems the firm's testing of these automated and IT-dependent controls was not sufficient. (AS 2201.46)

The firm's internal inspection program had inspected this audit and reviewed this area but did not identify the deficiencies below. The issuer used multiple information-technology (IT) systems to initiate process and record revenue. The firm selected for testing certain ITGCs over user access to these IT systems. Management asserted that logical access to these IT systems was controlled through a third-party hosted IT solution used by the issuer and the firm obtained and evaluated a service auditor's report from this third-party hosted IT solution. The firm did not perform procedures to verify this assertion beyond inquiry of management and therefore the firm did not establish a basis to conclude that the logical access to these IT systems was only controlled through this third-party hosted IT solution. (AS 2201.42 and .44)

The firm selected for testing certain information technology general controls (ITGCs) automated controls and information technology (IT) dependent manual controls that used data and reports generated or maintained by the issuer's IT systems. The following deficiencies were identified: · The firm did not obtain an understanding of how revenue transactions are recorded and processed by certain applications. (AS 2201.30)

The firm selected for testing certain information technology general controls (ITGCs) automated controls and information technology (IT) dependent manual controls that used data and reports generated or maintained by the issuer's IT systems. The following deficiencies were identified: · The issuer used two service organizations for initiating processing and recording certain revenue. The firm did not obtain an understanding of and test any relevant controls at the service organization. (AS 2201.39 and .B19)

The firm selected for testing certain information technology general controls (ITGCs) automated controls and information technology (IT) dependent manual controls that used data and reports generated or maintained by the issuer's IT systems. The following deficiencies were identified: · The firm did not sufficiently test certain application controls because it tested only one instance which was not appropriate due to the deficiencies discussed above. (AS 2201.46)

The firm selected for testing certain information technology general controls (ITGCs) automated controls and information technology (IT) dependent manual controls that used data and reports generated or maintained by the issuer's IT systems. The following deficiencies were identified: · The firm did not test controls over the accuracy and completeness of data and reports used in the operation of certain controls. (AS 2201.39)

The firm selected for testing certain information technology general controls (ITGCs) automated controls and information technology (IT) dependent manual controls that used data and reports generated or maintained by the issuer's IT systems. The following deficiencies were identified: · The firm did not test the completeness of the population of changes made to various application systems that the firm used to evaluate change controls. (AS 1105.10)

The firm selected for testing certain information technology general controls (ITGCs) automated controls and information technology (IT) dependent manual controls that used data and reports generated or maintained by the issuer's IT systems. The following deficiencies were identified: · The firm did not identify and test any controls over the completeness of the population of program code changes the control operators used in the performance of the controls. (AS 2201.39)

The firm selected for testing certain information technology general controls (ITGCs) automated controls and information technology (IT) dependent manual controls that used data and reports generated or maintained by the issuer's IT systems. The following deficiencies were identified: · The firm did not test user access provisioning controls over applications that supported revenue accounting. (AS 2201.42 and .44)

The firm selected for testing certain information technology general controls (ITGCs) automated controls and information technology (IT) dependent manual controls that used data and reports generated or maintained by the issuer's IT systems. The following deficiencies were identified: · The firm did not evaluate the design of a periodic access review control. (AS 2201.42)

The firm selected for testing certain information technology general controls (ITGCs) automated controls and information technology (IT) dependent manual controls that used data and reports generated or maintained by the issuer's IT systems. The following deficiencies were identified: · The firm did not test any controls over the accuracy and completeness of the user profile reports used to perform the periodic access review control. (AS 2201.39)

As a result of the deficiencies in ITGC testing discussed above the firm did not sufficiently test whether the information technology (IT) automated application controls and the IT-dependent manual controls it selected for testing over revenue were effective as each control was dependent on the effectiveness of ITGCs. (AS 2201.46)

The issuer used an information technology (IT) system to initiate process and record revenue transactions. In its testing of controls over revenue the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by this IT system. The accuracy and completeness of these data and reports depended on effective IT general controls (ITGCs). As a result of the deficiencies in the firm's testing of ITGCs the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

The issuer used an IT system to process and record revenue transactions. In its testing of controls over revenue the firm tested various automated controls that used data and reports generated or maintained by this IT system. The accuracy and completeness of these data and reports depended on effective ITGCs. As a result of the following deficiencies in the firm's testing of ITGCs the firm's testing of these automated controls was not sufficient. (AS 2201.46)

The issuer used multiple information-technology (IT) systems to record transactions related to revenue. In its testing of controls over revenue the firm tested an IT-dependent manual control that used data generated by these IT systems. As a result of the deficiencies in the firm's testing of the controls over these IT systems the firm's testing of the IT-dependent manual control was not sufficient. (AS 2201.46)

The issuer used multiple information-technology (IT) systems to record transactions related to revenue. In its testing of controls over revenue the firm tested an IT-dependent manual control that used data generated by these IT systems. With respect to one of these IT systems: · The firm did not perform procedures beyond inquiry and reading the issuer's policies to test certain logical user access controls. (AS 2201.42 and .44)

The issuer used multiple information-technology (IT) systems to record transactions related to revenue. In its testing of controls over revenue the firm tested an IT-dependent manual control that used data generated by these IT systems. With respect to one of these IT systems: · The firm did not identify and test any controls related to IT operations. (AS 2201.39)

The issuer used a service organization to initiate and process transactions related to revenue that are then recorded in the issuer's information-technology (IT) system. In its testing of controls over revenue the firm tested certain automated and IT-dependent manual controls that used data and reports generated by this service organization. The firm obtained a service auditor's report and identified complementary user controls that the service auditor's report described as necessary. As a result of the deficiencies in the firm's testing of the complementary user controls discussed below the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)