Explorer

The issuer recorded revenue when a user action in an electronic environment occurred and the revenue recognition criteria had been met. The issuer used an IT application to track user actions define and capture valid billable user actions and generate user activity reports. The firm tested IT general controls (“ITGCs”) and identified control deficiencies related to this IT application and the general ledger. The firm concluded either that the deficiencies were mitigated by other controls or that the deficiencies did not directly affect the firm's reliance on the issuer's controls over the accuracy and completeness of the data derived from the IT application. To test the accuracy and completeness of the reports the firm used in its substantive testing of revenue the firm (1) relied on its testing of ITGCs and application controls over revenue and (2) confirmed user activity with customers. The firm's reliance on these ITGCs and application controls was not supported because the firm did not sufficiently test the application controls used by the issuer to (1) track user actions (2) capture billable user actions and (3) generate the user activity reports used to calculate revenue because the firm did not consider the criteria necessary for valid user actions to occur how user actions were counted and accumulated and whether revenue recognition requirements were met. The firm also did not test compensating controls that mitigated the identified ITGC deficiencies and did not perform an evaluation to support its conclusion that those deficiencies did not affect its reliance on controls in the IT application. (AS 1105.10)

The issuer recorded revenue when a user action in an electronic environment occurred and the revenue recognition criteria had been met. The issuer used an IT application to track user actions define and capture valid billable user actions and generate user activity reports. The firm tested IT general controls (“ITGCs”) and identified control deficiencies related to this IT application and the general ledger. The firm concluded either that the deficiencies were mitigated by other controls or that the deficiencies did not directly affect the firm's reliance on the issuer's controls over the accuracy and completeness of the data derived from the IT application. To test the accuracy and completeness of the reports the firm used in its substantive testing of revenue the firm (1) relied on its testing of ITGCs and application controls over revenue and (2) confirmed user activity with customers. In addition the firm's confirmation procedures were not sufficient because the firm did not consider whether the issuer's customers would have the information necessary to confirm the user activity. (AS 2310.26)

The firm did not perform any procedures to evaluate (1) the terms and conditions of an arrangement under which the issuer recorded revenue and which involved other participants and a counterparty including the method used by the counterparty to allocate consideration to the issuer and other participants and (2) whether the revenue the issuer recognized under this arrangement was in conformity with FASB ASC Topic 606 Revenue from Contracts with Customers. (AS 2810.30)

The firm used certain information obtained from the issuer and from outside sources in its substantive testing of revenue but did not perform any procedures to evaluate whether this information was reliable accurate and complete. (AS 1105.04 .06 and .10)

The firm did not identify and test any controls other than certain cut-off controls over the issuer's revenue transactions for certain types of revenue. (AS 2201.39)

The issuer recognized revenue from a contract with a new customer. The firm did not sufficiently evaluate whether collectability of substantially all of the consideration was probable at contract inception because its procedures were limited to inquiring of management and reading an issuer-prepared memorandum. (AS 2301.08)

For one type of revenue the issuer's system generated customer invoices and recorded revenue once the issuer processed invoices from the manufacturer of its products indicating that customer orders had been completed and shipped. The following deficiencies were identified: · The firm selected for testing a control that consisted of the issuer's review of support for revenue transactions. In testing the operating effectiveness of this control the firm did not test the aspect related to whether the manufacturer's invoices processed by the issuer were consistent with the customers' orders. (AS 2201.44)

For one type of revenue the issuer's system generated customer invoices and recorded revenue once the issuer processed invoices from the manufacturer of its products indicating that customer orders had been completed and shipped. The following deficiencies were identified: · The firm selected for testing an automated control over the generation of a customer invoice and the recording of revenue once the manufacturer's invoice was processed in the issuer's system. The firm did not obtain an understanding of how the issuer's system was configured to initiate process and record revenue transactions. As a result the firm did not test the configuration of this control or perform other procedures that would have provided sufficient appropriate audit evidence that the control was designed and operating effectively. (AS 2201.34 .42 and 44)

For one type of revenue the issuer's system generated customer invoices and recorded revenue once the issuer processed invoices from the manufacturer of its products indicating that customer orders had been completed and shipped. The following deficiencies were identified: · The firm selected for testing a control over manually recorded period-end adjustments to reverse revenue for shipped products that had not been delivered to the issuer's customers by the end of the period. The firm did not identify and test any controls over the accuracy and completeness of the delivery dates obtained from the manufacturer that the control owners used to determine whether adjustments were necessary. (AS 2201.39)

For two other types of revenue the issuer recognized revenue monthly based on sales reported by external parties. The firm selected for testing controls that consisted of the issuer's reviews of the reasonableness of the sales reported by these external parties. The firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

The firm used the sales reported by the external parties in its substantive testing of this revenue but did not perform any procedures to test or (as discussed above) sufficiently test controls over the accuracy and completeness of this information. (AS 1105.10)

The firm did not identify and test any controls over the accuracy and completeness of the shipment information from the system that the issuer used to record revenue. (AS 2201.39)

The firm identified the issuer's omission of a required disclosure under FASB ASC Topic 606 Revenue from Contracts with Customers related to the disaggregation of revenue recognized over time and at a point in time. The firm concluded that the omission did not represent a material misstatement but did not evaluate the significance of a misstatement in the total amount of point-in-time revenue disclosed. (AS 2810.17)

The issuer recognized certain revenue based on electronic activity that was tracked using an internally developed information-technology (IT) system. In its substantive testing of this revenue the firm used activity information obtained from external parties to test the electronic activity in this system but did not perform any procedures to evaluate the reliability of this activity information. (AS 1105.04 and .06)

The issuer recognized certain other revenue based on user activity in an electronic environment that was tracked and provided by two external parties. The firm obtained this information from the issuer and used it in its substantive testing of this revenue. The following deficiencies were identified: · With respect to the user activity information provided by one external party the firm did not sufficiently test the accuracy and completeness of the information because it did not test the parameters that the issuer input into the IT system that the external party used to track the activity. (AS 1105.10)

The issuer recognized certain other revenue based on user activity in an electronic environment that was tracked and provided by two external parties. The firm obtained this information from the issuer and used it in its substantive testing of this revenue. The following deficiencies were identified: · With respect to the user activity information provided by the other external party the firm did not sufficiently test the accuracy and completeness of the information because its procedures were limited to obtaining an understanding of and testing certain IT general controls over the IT system that the external party used to track the activity. (AS 1105.10)

The issuer entered into revenue arrangements with multiple performance obligations. The firm did not perform any substantive procedures to evaluate whether the issuer's identification of the performance obligations was in conformity with FASB ASC Topic 606 and whether such obligations had been satisfied before revenue was recognized. (AS 2810.30)

The issuer recognized revenue from certain other arrangements based on information provided by external parties. The firm obtained this information from the issuer and used it in its substantive testing of this revenue. The following deficiencies were identified: · The firm did not perform any procedures to test or in the alternative test any controls over the accuracy and completeness of this information. (AS 1105.10)

The issuer recognized revenue from certain other arrangements based on information provided by external parties. The firm obtained this information from the issuer and used it in its substantive testing of this revenue. The following deficiencies were identified: · The firm selected the issuer's largest revenue transactions for testing but did not perform any substantive procedures to test the remaining portion of this revenue. (AS 1105.27)

The issuer recorded two types of revenue for one of its subsidiaries net of customer discounts rebates and other deductions. The firm did not perform any substantive procedures to test these sales deductions beyond comparing the total amount recorded by the issuer to an amount the firm calculated by applying the issuer's historical sales deduction rates to the gross sales for each revenue type. (AS 2301.08)

The firm selected for testing controls that consisted of the issuer's review of sales orders. The firm used the results of its substantive testing of this revenue as evidence that these controls were operating effectively. The firm's procedures did not provide sufficient appropriate audit evidence because the firm did not directly test the review procedures that the control owners performed. (AS 2201.42 .44 and .B9)

The firm selected for testing a control that consisted of the issuer's review of the calculation of the rebate accrual. The firm did not identify and test any controls over the accuracy and completeness of the system-generated reports used in the operation of this control. (AS 2201.39)

The issuer recognized certain revenue from contracts over time using an input method based on costs incurred. The following deficiencies were identified: · The firm did not perform any substantive procedures to evaluate the reasonableness of the estimated costs to complete open contracts at year end beyond (1) comparing in the aggregate estimated total costs for open contracts as of the prior year end to the revised estimated total costs for those contracts as of the current year end and (2) obtaining for two open contracts a summary of actual costs incurred during a period of time subsequent to year end and inquiring of management. (AS 2501.07)

The issuer recognized certain revenue from contracts over time using an input method based on costs incurred. The following deficiencies were identified: · The firm used certain labor information in its substantive testing of the costs incurred to date that the issuer used to recognize this revenue but did not test or in the alternative test any controls over the accuracy and completeness of this information. (AS 1105.10)

The issuer recognized certain revenue based on electronic activity that was processed by a third-party service provider and the firm used certain reports produced by the third-party service provider in its substantive testing. The firm did not sufficiently test the accuracy and completeness of the data included in such reports because its procedures were limited to testing only a small number of revenue types and for those revenue types selected for testing it tested only one of multiple types of transactions. (AS 2301.08)

The firm relied on an outside source to provide reasonable assurance that the transactions processed by the third-party service provider were accurate. The firm however did not perform any procedures to determine whether it was appropriate to place such reliance on the outside source. (AS 1105.04)

The issuer recognized a certain type of revenue based on the volume of product it delivered to its customers. The firm used volume data in its substantive testing of this revenue but did not perform any procedures to test or in the alternative identify and test any controls that addressed the accuracy and completeness of the volume data. (AS 1105.10)

The issuer used information-technology (IT) systems to initiate process and record transactions related to certain revenue. The following deficiencies were identified: · The firm selected for testing an automated control but its testing of a sample of only one item was not sufficient because the firm did not test the configuration or programming of the automated control or perform other procedures that would have provided sufficient appropriate audit evidence that the automated control was designed and operating effectively. (AS 2201.42 and .44)

The issuer used information-technology (IT) systems to initiate process and record transactions related to certain revenue. The following deficiencies were identified: · The firm did not identify and test any controls over the accuracy and completeness of the shipment information that was entered into one of the IT systems and that the issuer used to record this revenue. (AS 2201.39)

For certain revenue the firm did not identify and evaluate that the issuer's determination that it was acting as an agent was not in conformity with FASB ASC Topic 606 Revenue from Contracts with Customers. (AS 2810.30)

The firm did not identify and evaluate the issuer's omission of a required disclosure under FASB ASC Topic 606 related to how the issuer recognized this revenue. (AS 2810.30 and .31) Unrelated to our review the issuer reevaluated its accounting and disclosures for this revenue and concluded that material misstatements existed that had not been previously identified. The issuer subsequently filed a Form 8-K indicating that its previously issued financial statements should not be relied on and corrected these misstatements in a subsequent filing.

For two types of revenue the firm did not evaluate whether the issuer was acting as a principal or as an agent. (AS 2301.08 and .13)

For one of these types of revenue and another type the issuer recognized revenue based on electronic activity. The firm used activity information produced by certain of the issuer's service organizations in its substantive testing of this revenue but did not perform any procedures to test the accuracy and completeness of this information. (AS 2301.08 and .13)

For one type of revenue the firm did not perform any substantive procedures to test whether the performance obligations had been satisfied before revenue was recognized. (AS 2301.08 and .13)

For this same type of revenue the firm did not identify and evaluate misstatements related to contract assets under FASB ASC Topic 606. (AS 2810.30 and .31)

For another type of revenue the firm selected for testing an automated control over the initiation processing and recording of revenue transactions in order to rely on the accuracy and completeness of certain issuer-produced information that the firm used in its substantive testing. The firm did not sufficiently test the configuration of this control as it limited its testing to only certain scenarios without addressing the risks of material misstatement associated with the untested scenarios. (AS 2301.19 and .21)

The issuer recorded certain revenue based on information provided by its customers. In the firm's substantive testing of this revenue the firm used this information but did not evaluate its reliability. (AS 1105.04 and .06)

The firm did not identify and evaluate the issuer's (1) misstatement in and (2) omission of certain disclosures related to the disaggregation of revenue that are required under FASB ASC Topic 606. (AS 2810.30 and .31)

The issuer recognized certain revenue based on electronic activity. The firm used activity information produced by certain of the issuer's service organizations in its substantive testing of this revenue but did not perform any procedures to test the accuracy and completeness of this information. (AS 2301.08 and .13)

For revenue at three business units one of which was affected by the audit deficiencies discussed above the following additional deficiencies were identified: · The firm did not test whether revenue was recognized according to the contractual pricing. (AS 2301.08)

For revenue at three business units one of which was affected by the audit deficiencies discussed above the following additional deficiencies were identified: · For two of these business units the firm's procedures to test this revenue consisted of testing a sample of transactions from certain periods. The firm did not perform any procedures to test the remaining population of this revenue. (AS 2315.24)

The firm's substantive procedures to test certain revenue included selecting a sample of transactions for testing. The firm's sample was too small to provide sufficient appropriate audit evidence because in determining the sample size the firm did not take into account tolerable misstatement the allowable risk of incorrect acceptance and the characteristics of the population. (AS 2315.16 .23 and .23A)

The firm did not identify and evaluate a misstatement in a disclosure required under FASB ASC Topic 606. (AS 2810.30 and .31)

The issuer used multiple service organizations to host and/or maintain IT systems that the issuer used to initiate process and/or record transactions related to various types of revenue at five other business units. The firm obtained the service auditor's reports for these service organizations and identified certain complementary user controls that the service auditor's reports described as necessary. The following deficiencies were identified: · The firm identified control deficiencies related to several complementary user controls that consisted of the issuer's (1) granting and removal of access to these IT systems and/or (2) monitoring of computer operations. The firm did not evaluate the effect of these deficiencies on the issuer's ability to meet control objectives stated in the service auditor's reports. (AS 2201.62 and .B22)

The firm did not identify and evaluate the issuer's omission of a disclosure required under FASB ASC Topic 250 Accounting Changes and Error Corrections related to a change in estimate. (AS 2810.30 and .31)

Certain of the issuer's revenue arrangements included multiple performance obligations. The issuer allocated the total transaction price for each of these arrangements to the separate performance obligations based on the relative standalone selling prices. The firm selected a sample of these arrangements for testing. The following deficiencies were identified: · The firm did not perform any substantive procedures to evaluate whether the issuer's identification of performance obligations was in conformity with FASB ASC Topic 606. (AS 2301.08 and .13)

Certain of the issuer's revenue arrangements included multiple performance obligations. The issuer allocated the total transaction price for each of these arrangements to the separate performance obligations based on the relative standalone selling prices. The firm selected a sample of these arrangements for testing. The following deficiencies were identified: · The firm did not perform any substantive procedures to test whether the allocation of the transaction prices was based on standalone selling prices. (AS 2301.08)

Certain of the issuer's revenue arrangements included multiple performance obligations. The issuer allocated the total transaction price for each of these arrangements to the separate performance obligations based on the relative standalone selling prices. The firm selected a sample of these arrangements for testing. The following deficiencies were identified: · For certain of the arrangements selected for testing the firm did not perform any procedures to test whether certain performance obligations had been satisfied before revenue was recognized. (AS 2301.08 and .13)

The issuer used multiple service organizations to host and/or maintain IT systems that the issuer used to initiate process and/or record transactions related to various types of revenue at five other business units. The firm obtained the service auditor's reports for these service organizations and identified certain complementary user controls that the service auditor's reports described as necessary. The following deficiencies were identified: · The firm did not perform any procedures to evaluate whether the issuer had implemented certain of these controls. (AS 2201.39 and .B22)

The issuer used multiple service organizations to host and/or maintain IT systems that the issuer used to initiate process and/or record transactions related to various types of revenue at five other business units. The firm obtained the service auditor's reports for these service organizations and identified certain complementary user controls that the service auditor's reports described as necessary. The following deficiencies were identified: · The firm did not identify that certain of these controls were not designed to satisfy the control objectives described in certain of the service auditor's reports. (AS 2201.42 and .B22)