Explorer

The firm selected for testing a control that consisted of management's review of data that the issuer used to record revenue including the related revenue journal entries. In testing the operating effectiveness of this control the firm did not evaluate the specific review procedures that the control owner performed to assess the reasonableness of the data. (AS 2201.44)

The firm selected for testing a control over the review of revenue by property. The firm did not evaluate the review procedures that the control owner performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

For one of the issuer's reporting units: · The issuer uses an application to record invoices and the resulting revenue and generate revenue reports. The firm selected for testing change management controls that consisted of the review of changes to this application. The firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

The firm selected for testing a control over certain other revenue that consisted of management's review of customer invoices. The firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

For one of the issuer's reporting units: · The firm selected for testing a control that consisted of management's review of customer invoices. The firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

The firm selected for testing two controls over revenue that consisted of (1) management's review of information related to order entry shipping invoicing and accounts receivable and (2) the issuer's performance of a gross to net revenue analysis. The firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

The firm identified control deficiencies in the issuer's sales process related to segregation of duties conflicts and individuals having inappropriate access to the issuer's revenue system that provided these users with the ability to create and modify customer accounts enter sales orders and record adjustments to accounts receivable. The firm identified and tested various compensating controls including controls that the issuer implemented in response to these control deficiencies. The following audit deficiencies were identified: · One of the controls that the issuer implemented consisted of the review of a report of all users who created or modified sales orders during the year. In testing this control the firm did not evaluate the specific review procedures that the control owners performed to identify users with inappropriate access and assess whether the sales orders these users created or modified were appropriate. (AS 2201.68) In connection with our review the issuer reevaluated its controls over segregation of duties and access to the revenue system and concluded that material weaknesses existed that had not been previously identified. The issuer subsequently revised its report on ICFR to reflect these material weaknesses and the firm modified its opinion on the effectiveness of the issuer's ICFR to express an adverse opinion and reissued its report.

The firm selected for testing a control that consisted of the issuer's review and approval of changes to the prices maintained in the pricing master file. The firm did not evaluate the review procedures that the control owner performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

Certain of the issuer's revenue arrangements included multiple performance obligations. The issuer allocated the total transaction price for each of these arrangements to the separate performance obligations based on the issuer's estimate of the relative standalone selling prices. The following deficiencies were identified: · The firm selected for testing a control that consisted of the issuer's review of certain contracts under these types of arrangements for appropriate revenue recognition. The firm did not evaluate the specific review procedures that the control owners performed to evaluate whether the contracts contained embedded leases and whether all performance obligations were identified. (AS 2201.42 and .44)

The firm's internal inspection program inspected this audit and reviewed this area but did not identify the deficiency below. The firm selected for testing a control that consisted of the issuer's review of changes made to customer master file data that the issuer used to record revenue transactions. The firm did not evaluate the review procedures that the control owner performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

The issuer recognized revenue from services provided to customers based on certain agreed-upon specifications (“service revenue”). The following deficiencies were identified: · The firm selected for testing a control that included management's review of billing information for the service revenue discussed above. The firm did not evaluate the review procedures that the control owner performed including the criteria that the control owner used to identify items for follow up and whether those items were appropriately resolved. (AS 2201.42 and .44)

The issuer also recognized revenue from fees associated with granting certain rights to its customers (“contract revenue”). The firm identified a control deficiency over this revenue related to a lack of segregation of duties and concluded that it was a significant deficiency based on the firm's testing of compensating controls that included management's review of contract revenue and financial reporting checklists. The firm did not evaluate the review procedures that the control owner performed including the criteria that the control owner used to identify items for follow up and whether those items were appropriately resolved. (AS 2201.68)

The issuer used various information-technology (IT) systems to initiate process and record transactions related to revenue for one business unit. The firm tested IT general controls (ITGCs) for these IT systems. The following deficiencies were identified · The firm selected for testing controls over user access to one of these systems. The firm did not evaluate the specific review procedures that the control owners performed to determine whether previously granted access continued to be appropriate. Further the firm identified users who had the ability to initiate process and record transactions but did not evaluate whether those rights represented a control deficiency. (AS 2201.42 and .44)

The issuer used two IT systems to process and record transactions related to revenue. In its testing of controls over this account the firm tested certain IT-dependent manual controls that used data and reports generated or maintained by these IT systems. The following ITGC deficiencies were identified: · The firm selected for testing controls over the issuer's review of user access to these IT systems but did not evaluate the specific review procedures that the control owners performed to determine whether to approve user access that had been requested or whether user access that had been previously approved continued to be appropriate. (AS 2201.42 and .44)

For another business unit the firm selected for testing a control that consisted of the issuer's monthly review of revenue and gross margins. The firm did not evaluate the specific review procedures that the control owner performed to assess whether revenue was appropriately recognized. (AS 2201.42 and .44)

The issuer recognized certain revenue over time based on costs incurred to date relative to total estimated costs to complete the contract. The following deficiencies were identified: · The firm selected for testing controls that consisted of the issuer's reviews of project budgets and status by contract including the estimated costs to complete. The firm did not evaluate the specific review procedures that the control owners performed to evaluate the reasonableness of the project budgets and related assumptions. (AS 2201.42 and .44)

The issuer's revenue included revenue recognized from contracts over time based on hours incurred to date relative to total estimated hours to complete. The following deficiency was identified: · The firm selected for testing controls that included the review of revenue. The firm did not evaluate the specific review procedures performed by the control owners to assess (i) that revenue was recognized in the appropriate period and (ii) the reasonableness of estimated hours to complete. (AS 2201.42 and .44)

The issuer's revenue included revenue recognized from contracts over time based on hours incurred to date relative to total estimated hours to complete. The following deficiency was identified: · The firm selected for testing a control over the review of hours incurred. The firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

The issuer's revenue included revenue recognized from contracts over time based on hours incurred to date relative to total estimated hours to complete. The following deficiency was identified: · The firm selected for testing two controls that included the review of the presentation and disclosure of the financial statements. The firm did not evaluate the specific review procedures performed by the control owners to evaluate the reasonableness of a disclosure related to revenue. (AS 2201.42 and .44)

The firm selected for testing certain controls that included management's review of sales contracts and comparisons of expected to actual sales. The firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44).

The firm selected for testing controls that consisted of the review and approval of (1) the quantity price and other terms and conditions for each customer order and (2) any changes to customer orders. The firm did not evaluate the specific review procedures that the control owners performed to determine the appropriateness of (1) the price and quantity for each customer order and (2) changes to customer orders. (AS 2201.42 and .44)

The firm selected for testing certain information technology general controls (ITGCs) automated controls and information technology (IT) dependent manual controls that used data and reports generated or maintained by the issuer's IT systems. The following deficiencies were identified: · The firm selected for testing certain ITGCs that included a review element. The firm did not evaluate whether the control owners possessed the necessary authority and competence to perform the controls effectively. Further the firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

The firm selected for testing a review control over the determination that performance obligations related to revenue recognition had been met. The firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

The firm selected for testing a review control over the approval of customer change orders. The firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

The firm did not perform sufficient procedures to evaluate and test various controls in the revenue cycle because it did not: · Evaluate the review procedures the control owner performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

The issuer used an information technology (IT) system to initiate process and record revenue transactions. In its testing of controls over revenue the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by this IT system. The accuracy and completeness of these data and reports depended on effective IT general controls (ITGCs). The firm selected for testing two user access controls over this IT system that consisted of the issuer's review and approval of privileged system access including a review of the activity performed by users that are granted such access to confirm that it was aligned with the access request/requirement. The firm did not evaluate the specific review procedures that the control owner performed to (1) evaluate whether the activity was aligned with the access request/requirement and (2) investigate and timely resolve any activity performed by the user beyond the access request/requirement. (AS 2201.42 and .44)

The issuer used a service organization to invoice customers when services were rendered. The following deficiencies were identified: · The firm selected for testing a complementary user control over the review of a comparison of a system-generated discrepancy report to a manually prepared service log. The firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.B22)

The issuer used multiple information-technology (IT) systems to record transactions related to revenue. In its testing of controls over revenue the firm tested an IT-dependent manual control that used data generated by these IT systems. With respect to one of these IT systems: · The firm did not identify and test controls over program change management except for one control over the final approval of program changes. For this control the firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.39 .42 and .44)

The issuer used multiple information-technology (IT) systems to record transactions related to revenue. In its testing of controls over revenue the firm tested an IT-dependent manual control that used data generated by these IT systems. With respect to one of these IT systems: · The firm selected for testing a control over a review of an annual IT general controls assessment performed by the issuer's internal auditor. The firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

The firm selected for testing a complementary user control that consisted of the issuer's reviews of user access to the service organization's IT system. The firm did not evaluate the specific review procedures that the control owners performed to determine whether previously granted access continued to be appropriate. (AS 2201.42 .44 and .B22)

The issuer used certain IT systems to process and record transactions related to revenue. The following deficiency was identified: · The firm selected for testing a control that consisted of management's review of a billing workbook to ensure that the calculations and billing details were accurate. The firm did not evaluate the specific review procedures that the control owner performed to identify billing changes for review. (AS 2201.42 and .44)