Explorer

For certain revenue related to services that the issuer provided to its customers the issuer used two IT systems to process and record revenue transactions. The issuer assigned service codes to each customer based on the prices for the services provided and the specific terms of the customer arrangement. These systems calculated and recorded revenue using those service codes. The following deficiencies were identified: · For revenue processed and recorded by one of these IT systems the firm did not identify and test any controls to address certain other risks related to the accuracy of customer invoices and revenue calculated by this system. (AS 2201.39)

The issuer used two information-technology (IT) systems to process and record certain revenue transactions related to services provided to its customers; one of these systems was maintained by an external service organization. The following deficiencies were identified: · With respect to the other IT system the firm selected for testing a control over access by employees of the issuer to this system and identified control exceptions related to inappropriate access for numerous employees. The firm concluded that this control was operating effectively based on its evaluation of these exceptions and the effectiveness of a complementary control and that the combination of these two controls addressed the risks of inappropriate access. The firm's conclusion was inappropriate because the complementary control was not designed to operate during the fourth quarter of the issuer's fiscal year and therefore the two controls discussed above did not address the risks related to inappropriate access to this system as of the date of management's assessment. (AS 2201.48)

The firm selected for testing certain manual controls over this revenue that used reports that were generated by these IT systems. The firm's testing of these controls was not sufficient due to the deficiencies in testing controls over the IT systems discussed above. (AS 2201.46)

The firm's substantive procedures to test the occurrence and accuracy of this revenue did not provide sufficient appropriate audit evidence because its procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the engagement team's control testing discussed above. (AS 2301.16 .18 and .37)

The issuer used two information-technology (IT) systems to process and record certain revenue transactions related to services provided to its customers; one of these systems was maintained by an external service organization. The following deficiencies were identified: · The firm selected for testing certain automated and IT-dependent manual controls over this revenue. The firm's approach to testing these controls depended on effective IT general controls (ITGCs) including controls over access to the systems. Due to the deficiencies in the firm's testing of these controls discussed above the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

The firm used information that was produced by these IT systems in performing certain of its substantive procedures to test this revenue but did not have a basis to rely on this information due to the deficiencies in the firm's testing of access controls discussed above. The firm did not perform any substantive procedures to test or (as discussed above) sufficiently test controls over the accuracy and completeness of this information. (AS 1105.10)

The sample size the firm used in certain of its substantive procedures to test this revenue was too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The issuer recorded certain revenue based on information about the quantities sold and delivery dates that was provided by a third-party administrator. The following deficiencies were identified: · The firm did not identify and test any controls over the accuracy and completeness of the information provided by the third-party administrator. (AS 2201.39)

The issuer entered into contracts with certain customers that required revenue to be recognized over time based on costs incurred to date relative to total estimated costs to complete these contracts. The following deficiencies were identified: · The firm selected for testing a control that included a preliminary review of certain profit margin metrics by contract to identify items for further investigation. The firm did not identify and test any controls over the completeness of certain data underlying these performance metrics. (AS 2201.39)

The issuer entered into contracts with certain customers that required revenue to be recognized over time based on costs incurred to date relative to total estimated costs to complete these contracts. The following deficiencies were identified: · The firm's approach for substantively testing this revenue was to review and test management's process. The firm did not sufficiently evaluate the reasonableness of certain significant assumptions that management used as inputs into its revenue recognition model because its procedures were limited to inquiring of management and performing a retrospective review to determine whether prior projections were consistent with actual results. (AS 2501.09 .10 and .11) [This citation refers to AS 2501 Auditing Accounting Estimates which was in effect for this audit. This standard was replaced by AS 2501 Auditing Accounting Estimates Including Fair Value Measurements which became effective for audits of financial statements for fiscal years ending on or after December 15 2020.]

The issuer used an internally developed IT system to track the volume of services provided for one type of revenue. In its testing of controls over this revenue the firm tested various automated and IT-dependent manual controls that used data from this system. The firm selected for testing a control over change management that consisted of a review of activity of certain developers with change access to this system. The firm did not evaluate whether this control was designed to address the risk of material misstatement with respect to developers with change access that were not selected for review. (AS 2201.42)

The issuer used an internally developed IT system to track the volume of services provided for one type of revenue. In its testing of controls over this revenue the firm tested various automated and IT-dependent manual controls that used data from this system. The firm selected for testing a control over change management that consisted of a review of activity of certain developers with change access to this system. As a result of the deficiency in the firm's testing of the IT general control the firm's testing of the various automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

As a result of the audit deficiencies the firm did not perform sufficient substantive procedures to test or sufficiently test controls over the accuracy and completeness of certain system-generated data it used in its substantive testing of this revenue. (AS 1105.10)

The issuer recognized certain revenue when a product was shipped or upon completion of a service. The firm selected for testing a control over this revenue that consisted of the comparison of the terms of each sales transaction entered into the issuer's system to corresponding invoices purchase orders and shipping or service documents before revenue was recognized. The firm's procedures were not sufficient because the firm did not test whether the control owners reviewed evidence that products had been shipped or services had been rendered. (AS 2201.42 and .44)

The sample sizes the firm used in certain of its substantive procedures to test this revenue for these locations were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiency in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

For certain revenue the issuer provided qualified customers with volume rebates that it estimated based on historical sales data. The firm selected for testing a control that consisted of the recalculation and reconciliation to the general ledger of these rebates. The firm did not identify and test any controls over the accuracy and completeness of the historical sales data used in the operation of this control. (AS 2201.39)

The firm did not perform substantive procedures to test or in the alternative identify and test any controls over the accuracy and completeness of the historical sales data that the firm used in its substantive testing of the volume rebates. (AS 1105.10)

The sample size the firm used in certain of its substantive procedures to test the volume rebates was too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The issuer entered into a contract with a customer in which revenue was recognized on a gross or net basis depending on the nature of the sales transactions and terms of the contract. In its testing the firm identified evidence indicating that revenue from certain sales transactions recognized on a net basis may have met the criteria prescribed in International Financial Reporting Standard 15 Revenue from Contracts with Customers ('IFRS 15') for recognition on a gross basis. The firm did not perform any substantive procedures to evaluate (1) this contradictory evidence and the related effect on revenue recognition and (2) whether the issuer's recognition of revenue from these transactions was in conformity with IFRS 15. (AS 2810.03 and .30)

The issuer recognized revenue based on contractual rates and hours incurred for services provided to its customers and the firm selected a sample of these revenue transactions by business unit for testing. The following deficiencies were identified: · For revenue for two business units the firm did not perform any procedures to test the contractual rates and hours incurred. (AS 2301.08 and .13)

The issuer recognized revenue based on contractual rates and hours incurred for services provided to its customers and the firm selected a sample of these revenue transactions by business unit for testing. The following deficiencies were identified: · For revenue for another business unit the firm used contractual rate and service hour information from one of the issuer's systems in its testing but did not perform any procedures to test or test any controls over the accuracy of the contractual rates and the accuracy and completeness of the service hours. (AS 1105.10)

The issuer recognized revenue based on contractual rates and hours incurred for services provided to its customers and the firm selected a sample of these revenue transactions by business unit for testing. The following deficiencies were identified: · For revenue for two other business units the firm used service hour information from another of the issuer's systems in its testing but did not perform any procedures to test or test any controls over the accuracy and completeness of this information. (AS 1105.10)

The issuer recognized revenue based on contractual rates and hours incurred for services provided to its customers and the firm selected a sample of these revenue transactions by business unit for testing. The following deficiencies were identified: · For revenue for one business unit the firm did not perform any procedures to test the contractual rates. (AS 2301.08)

The issuer disclosed the amount of revenue assigned to each of its reportable segments. The firm selected for testing an automated control that used information from the issuer's general ledger to assign revenue to each reportable segment in the issuer's financial reporting system. The firm did not evaluate beyond inquiring of management whether this control was designed to assign revenue related to a business acquired during the year to the appropriate reportable segments. (AS 2201.42)

The firm used the assigned revenue amounts from the issuer's financial reporting system in its substantive testing of this disclosure but did not test or sufficiently test the control over the appropriateness of the revenue assigned to the reportable segments. (AS 1105.10)

The issuer recognized revenue from a contract over time using an input method based on labor hours incurred. The firm did not perform any substantive procedures to evaluate the reasonableness of the estimated labor hours to complete this contract at year end beyond inquiring of management and for a sample of employees confirming their labor hours budgeted for the contract as of year end. (AS 2501.16)

The firm identified a control deficiency related to the review of the prices the issuer used to recognize revenue for certain locations. The firm identified compensating controls that it believed would mitigate this deficiency but did not test these controls. (AS 2201.68)

The firm did not identify and test any controls related to certain revenue disclosures. (AS 2201.39)

The firm did not perform any substantive procedures to test these revenue disclosures. (AS 2301.08)

The firm did not identify and test any controls over sales allowances. (AS 2201.39)

The firm did not perform any substantive procedures to test sales allowances. (AS 2301.08)

The issuer recognized revenue from certain contracts as single performance obligations satisfied over time. With respect to the issuer's revenue recognition: The firm did not identify and test any controls over the issuer's identification and evaluation of contract terms with its customers that could affect revenue recognition. (AS 2201.39)

The issuer recognized revenue from certain contracts as single performance obligations satisfied over time. With respect to the issuer's revenue recognition: The firm did not perform any substantive procedures to evaluate the issuer's contract terms with its customers to determine whether the issuer recognized this revenue in conformity with FASB ASC Topic 606 Revenue from Contracts with Customers. (AS 2301.08)

The issuer recognized revenue from certain contracts as single performance obligations satisfied over time. With respect to the issuer's disclosures of its unsatisfied performance obligations: The firm did not identify and test any controls over the issuer's identification and evaluation of contracts that could be cancelled by the customer which could affect the issuer's disclosures of unsatisfied performance obligations. (AS 2201.39)

The issuer recognized revenue from certain contracts as single performance obligations satisfied over time. With respect to the issuer's disclosures of its unsatisfied performance obligations: The firm did not perform any substantive procedures to identify whether the issuer's contracts could be cancelled by the customer and evaluate the effect of those contract terms to determine whether the issuer's disclosures of unsatisfied performance obligations were in conformity with FASB ASC Topic 606. (AS 2301.08)

The issuer disclosed the aggregate amount of transaction prices allocated to unsatisfied performance obligations and during the year made modifications to certain existing contracts that resulted in a change in the time frame for a performance obligation to be satisfied. The following deficiencies were identified: · The firm did not identify and test any controls over the accuracy and completeness of the issuer-prepared schedules used to develop the disclosure of unsatisfied performance obligations. (AS 2201.39)

The issuer disclosed the aggregate amount of transaction prices allocated to unsatisfied performance obligations and during the year made modifications to certain existing contracts that resulted in a change in the time frame for a performance obligation to be satisfied. The following deficiencies were identified: · The firm used these issuer-prepared schedules in its testing of this disclosure but did not perform any procedures to test or test any controls over the accuracy and completeness of these schedules. (AS 1105.10)

The issuer disclosed the aggregate amount of transaction prices allocated to unsatisfied performance obligations and during the year made modifications to certain existing contracts that resulted in a change in the time frame for a performance obligation to be satisfied. The following deficiencies were identified: · The firm did not perform any substantive procedures to evaluate the modifications to certain existing contracts to determine whether the issuer's disclosures of unsatisfied performance obligations were in conformity with FASB ASC Topic 606. (AS 2301.08)

The firm's internal inspection program had inspected this audit and reviewed this area but did not identify the deficiencies below. The issuer used two internally developed IT systems to process transactions related to certain revenue. In its testing of controls over this revenue the firm tested various automated controls that used data generated or maintained by these IT systems. As a result of deficiencies in the firm's testing of IT general controls the firm's testing of these automated controls was not sufficient. (AS 2201.46)

The firm's internal inspection program had inspected this audit and reviewed this area but did not identify the deficiencies below. The issuer used two internally developed IT systems to process transactions related to certain revenue. In its testing of controls over this revenue the firm tested various automated controls that used data generated or maintained by these IT systems. With respect to change management: · The firm selected for testing controls over change management for these IT systems but did not perform any procedures to determine whether the population of changes from which it made its selections for testing represented the complete population of changes made to these systems. (AS 1105.10)

The firm's internal inspection program had inspected this audit and reviewed this area but did not identify the deficiencies below. The issuer used two internally developed IT systems to process transactions related to certain revenue. In its testing of controls over this revenue the firm tested various automated controls that used data generated or maintained by these IT systems. With respect to change management: · The firm selected for testing a control that consisted of the review of segregation of duties for these IT systems. The firm did not test beyond inquiry the aspect of the control that addressed whether certain users with the ability to develop changes also had the ability to implement those changes. (AS 2201.42 and .44)

The firm's internal inspection program had inspected this audit and reviewed this area but did not identify the deficiencies below. The sample size that the firm used in certain of its substantive procedures to test this revenue was too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The issuer used two IT systems to initiate process and record transactions related to one type of revenue. The firm tested automated controls that used certain data that were input into these systems but did not identify and test any controls that addressed the accuracy and completeness of these data. (AS 2201.39)

The issuer recognized certain of this revenue upon delivery based on the delivery dates that were manually entered into the system. The firm did not identify and test any controls that addressed the accuracy and completeness of those delivery dates. (AS 2201.39)

The firm used certain data from these systems in its substantive testing of this revenue but did not perform any procedures to test or test any controls over the accuracy and completeness of these data. (AS 1105.10)

The issuer used an information technology (IT) system at one component to initiate process and record certain revenue transactions. In its testing of controls over this revenue the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by this IT system. The accuracy and completeness of these data and reports depended on effective IT general controls (ITGCs). As a result of the following deficiencies in the firm's testing of change management ITGCs the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46) Unrelated to our review the issuer filed a Form 8-K indicating that its previously issued financial statements and the firm's related audit reports should not be relied upon because of certain material misstatements contained in the financial statements. The issuer corrected the misstatements and reported that its ICFR was not effective. The firm also expressed an adverse opinion on the effectiveness of the issuer's ICFR.

The issuer used a different IT system at another component which was an outsourced application to initiate process and record revenue transactions. The firm inspected the related service auditor's report for this system and noted that the accuracy and completeness of standard reports generated from this system were addressed through certain ITGCs over the system that were tested by the service auditor. The service auditor's report however did not specifically identify the standard reports that were addressed through these ITGC's. For certain revenue transactions invoices were generated and revenue was recognized once the order fulfillment status in the system indicated that the orders had been fulfilled. The following deficiency was identified: · The firm did not identify and evaluate a departure from GAAP related to the issuer's recognition of certain revenue. In this instance the issuer's recognition of revenue appears not to have been in conformity with ASC 606. (AS 2810.30) Unrelated to our review the issuer filed a Form 8-K indicating that its previously issued financial statements and the firm's related audit reports should not be relied upon because of certain material misstatements contained in the financial statements. The issuer corrected the misstatements and reported that its ICFR was not effective. The firm also expressed an adverse opinion on the effectiveness of the issuer's ICFR.

The firm selected for testing two change management controls over this IT system that consisted of the (1) restricting of access to deploy system changes into the production environment to authorized personnel and (2) documentation review testing and approval of system changes prior to their migration into the production environment. The issuer documented the system changes in tickets that were entered into a change ticket tracking system. The following deficiency was identified: · The firm did not perform sufficient procedures to test or test any controls over the completeness of the population of changes from which it made its selections for testing these controls because it limited its procedures to obtaining listings of change tickets from the change ticket tracking system without contemplating potential changes that were not captured in that system. (AS 1105.10) Unrelated to our review the issuer filed a Form 8-K indicating that its previously issued financial statements and the firm's related audit reports should not be relied upon because of certain material misstatements contained in the financial statements. The issuer corrected the misstatements and reported that its ICFR was not effective. The firm also expressed an adverse opinion on the effectiveness of the issuer's ICFR.

The firm selected for testing two change management controls over this IT system that consisted of the (1) restricting of access to deploy system changes into the production environment to authorized personnel and (2) documentation review testing and approval of system changes prior to their migration into the production environment. The issuer documented the system changes in tickets that were entered into a change ticket tracking system. The following deficiency was identified: · The firm did not test an aspect of the first control related to the segregation of duties between system change developers and deployers. (AS 2201.42 and .44) Unrelated to our review the issuer filed a Form 8-K indicating that its previously issued financial statements and the firm's related audit reports should not be relied upon because of certain material misstatements contained in the financial statements. The issuer corrected the misstatements and reported that its ICFR was not effective. The firm also expressed an adverse opinion on the effectiveness of the issuer's ICFR.

The sample sizes the firm used in certain of its substantive procedures to test certain revenue was too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A) Unrelated to our review the issuer filed a Form 8-K indicating that its previously issued financial statements and the firm's related audit reports should not be relied upon because of certain material misstatements contained in the financial statements. The issuer corrected the misstatements and reported that its ICFR was not effective. The firm also expressed an adverse opinion on the effectiveness of the issuer's ICFR.