Explorer

The issuer recognized revenue from services provided to customers based on certain agreed-upon specifications (“service revenue”). The following deficiencies were identified: · The firm selected for testing certain automated controls that were designed to recognize one type of service revenue once certain information was manually entered into the issuer's system. The firm did not identify and test any controls over the accuracy and completeness of the information that was manually entered into the issuer's system. (AS 2201.39)

The issuer recognized revenue from services provided to customers based on certain agreed-upon specifications (“service revenue”). The following deficiencies were identified: · The firm selected for testing a control that included management's review of billing information for the service revenue discussed above. The firm did not evaluate the review procedures that the control owner performed including the criteria that the control owner used to identify items for follow up and whether those items were appropriately resolved. (AS 2201.42 and .44)

The issuer recognized revenue from services provided to customers based on certain agreed-upon specifications (“service revenue”). The following deficiencies were identified: · The firm did not identify and test any controls over another type of service revenue. (AS 2201.39)

The issuer recognized revenue from services provided to customers based on certain agreed-upon specifications (“service revenue”). The following deficiencies were identified: · The firm selected a sample of invoices to perform its substantive testing of both types of service revenue. For certain of the items selected the firm compared the invoice to a system-generated activity report of service by customer to determine whether the service had been provided in accordance with the customer's order specifications. The firm did not test or in the alternative test controls over the accuracy and completeness of the activity report. (AS 1105.10)

The issuer recognized revenue from services provided to customers based on certain agreed-upon specifications (“service revenue”). The following deficiencies were identified: · The firm selected a sample of invoices to perform its substantive testing of both types of service revenue. For the remaining items selected the system-generated activity report was not relevant to determining whether the service had been provided as it was a different type of service and the firm did not otherwise obtain support to test the occurrence of revenue for these selections. (AS 2315.25)

The issuer recognized certain revenue based on quantity and specified rates. The following deficiencies were identified: · The firm used the quantities reported by the issuer's customers in its procedures to test this revenue. The firm did not test or in the alternative (as discussed above) sufficiently test the control over the completeness of this data. (AS 1105.10)

The issuer recognized revenue from services provided to customers based on certain agreed-upon specifications (“service revenue”). The following deficiencies were identified: · The sample sizes the firm used in certain of its substantive procedures to test both types of service revenue were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The issuer also recognized revenue from fees associated with granting certain rights to its customers (“contract revenue”). The firm identified a control deficiency over this revenue related to a lack of segregation of duties and concluded that it was a significant deficiency based on the firm's testing of compensating controls that included management's review of contract revenue and financial reporting checklists. The firm did not evaluate the review procedures that the control owner performed including the criteria that the control owner used to identify items for follow up and whether those items were appropriately resolved. (AS 2201.68)

The firm selected for testing controls that consisted of management's review of system-generated reports used to recognize revenue. The firm did not test beyond inquiry any controls that addressed the accuracy and completeness of these system-generated reports used in the performance of these controls. (AS 2201.39)

The firm did not test or in the alternative test controls over the accuracy and completeness of data the firm used to develop the expectation used in the performance of its substantive analytical procedures to test revenue. (AS 2305.16)

The issuer recognized certain revenue based on quantity and specified rates. The following deficiencies were identified: · The sample sizes the firm used in certain of its substantive procedures to test this revenue were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiency in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The issuer processed and recorded transactions related to revenue inventory and sales commission expense and sales commission payable using several information-technology ('IT') systems including its enterprise resource planning ('ERP') system. The accuracy and completeness of the data and reports from the ERP system depended on effective IT general controls ('ITGCs'). The firm identified a significant deficiency in ITGCs related to user access to the ERP system. The firm selected for testing an automated control designed to recognize revenue when goods were shipped based on interfaces between various IT systems. The firm did not directly test this control because its procedures were substantive in nature. (AS 2201.42 .44 and .B9)

The issuer processed and recorded transactions related to revenue inventory and sales commission expense and sales commission payable using several information-technology ('IT') systems including its enterprise resource planning ('ERP') system. The accuracy and completeness of the data and reports from the ERP system depended on effective IT general controls ('ITGCs'). The firm identified a significant deficiency in ITGCs related to user access to the ERP system. The firm selected for testing a control that consisted of the issuer's review of revenue transactions for appropriate cut-off that used data and reports generated and maintained by the ERP system and an inventory management system. The firm's testing of this control was not sufficient because it did not consider the implications of the ineffective ITGCs over the ERP system as discussed above. Further the firm did not identify and test any controls over the accuracy and completeness of the data and reports from the issuer's inventory management system beyond determining that the control owner had reviewed the parameters of the reports generated by this system. (AS 2201.39 and .46)

The issuer used various information-technology (IT) systems to initiate process and record transactions related to revenue for one business unit. The firm tested IT general controls (ITGCs) for these IT systems. The following deficiencies were identified · The firm identified a deficiency in ITGCs related to an individual's inappropriate administrative rights over user access to these systems but did not evaluate the severity of this control deficiency. (AS 2201.62)

The issuer recognized certain revenue from contracts based on labor hours recorded in the issuer's time system. The following deficiencies were identified: · The firm did not identify and test any controls over the accuracy of these labor hours. (AS 2201.39)

The issuer recognized certain revenue from contracts based on labor hours recorded in the issuer's time system. The following deficiencies were identified: · Certain of this revenue was generated from contracts that specified the maximum amount of revenue that could be earned under each contract. The firm did not identify and test any controls that addressed the risk that revenue may have been recognized in excess of these contractual maximums. (AS 2201.39)

The issuer recognized certain revenue from contracts based on labor hours recorded in the issuer's time system. The following deficiencies were identified: · The firm used labor hours in its substantive testing of this revenue but did not perform any substantive procedures to test or in the alternative test any controls over the accuracy of these labor hours. (AS 1105.10)

The issuer recognized certain revenue from contracts based on labor hours recorded in the issuer's time system. The following deficiencies were identified: · The sample sizes the firm used in certain of its substantive procedures to test this revenue were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The issuer used various information-technology (IT) systems to initiate process and record transactions related to revenue for one business unit. The firm tested IT general controls (ITGCs) for these IT systems. The following deficiencies were identified · The firm selected for testing controls over user access to one of these systems. The firm did not evaluate the specific review procedures that the control owners performed to determine whether previously granted access continued to be appropriate. Further the firm identified users who had the ability to initiate process and record transactions but did not evaluate whether those rights represented a control deficiency. (AS 2201.42 and .44)

The firm's substantive procedures to test certain revenue consisted of analytical procedures. To develop its expectation the firm used the quantities of units sold that had been recorded in the issuer's revenue system. The firm's testing of these quantities was not sufficient because its sample size was too small to assess whether the quantities recorded in this system were reliable. (AS 2305.16)

The issuer used a service organization to accumulate customer activity data initiated in and processed by the issuer's mobile or web-based applications and recorded certain revenue based on these data. The firm did not identify and test any controls over the accuracy and completeness of the customer activity data within the applications. (AS 2201.39)

The issuer used multiple service organizations to host and/or maintain and manage IT systems that the issuer used to initiate process and record transactions related to certain revenue for another business unit. The following deficiencies were identified: · The firm identified a control deficiency related to the issuer's evaluation of service auditor reports for certain service organizations. The firm identified and tested three compensating controls that it believed would mitigate this deficiency but did not sufficiently evaluate the effect of these controls because it (1) determined that one of these controls was ineffective and (2) did not identify that the control owner of the other two controls was an individual the firm had identified as having inappropriate access to the systems hosted by these service organizations. (AS 2201.68)

The issuer used multiple service organizations to host and/or maintain and manage IT systems that the issuer used to initiate process and record transactions related to certain revenue for another business unit. The following deficiencies were identified: · The firm did not perform any procedures to test controls at certain other service organizations or identify and test any other controls over the revenue processed by the systems maintained and managed by these service organizations. (AS 2201.39 and .B19)

In its testing of controls over certain revenue for both of these business units the firm selected for testing various IT-dependent manual controls that used data and reports generated or maintained by certain of these systems. As a result of the deficiencies in the firm's control testing over these systems as discussed above the firm's testing of these IT-dependent manual controls was not sufficient. (AS 2201.46)

The firm selected for testing certain other controls over this revenue for these business units. The firm did not identify and test any controls over the accuracy and completeness of the reports or data that the control owners used in the performance of these controls. (AS 2201.39)

The firm did not perform substantive procedures to test or sufficiently test controls over the accuracy and completeness of certain reports or data that the firm used in its substantive testing of certain revenue for both of these business units. (AS 1105.10)

The issuer used two IT systems to process and record transactions related to revenue. In its testing of controls over this account the firm tested certain IT-dependent manual controls that used data and reports generated or maintained by these IT systems. As a result of the deficiencies in the firm's testing of ITGCs discussed below the firm's testing of these IT-dependent manual controls was not sufficient. (AS 2201.46)

The issuer used two IT systems to process and record transactions related to revenue. In its testing of controls over this account the firm tested certain IT-dependent manual controls that used data and reports generated or maintained by these IT systems. The following ITGC deficiencies were identified: · The firm selected for testing controls over the issuer's review of user access to these IT systems but did not evaluate the specific review procedures that the control owners performed to determine whether to approve user access that had been requested or whether user access that had been previously approved continued to be appropriate. (AS 2201.42 and .44)

The issuer used two IT systems to process and record transactions related to revenue. In its testing of controls over this account the firm tested certain IT-dependent manual controls that used data and reports generated or maintained by these IT systems. The following ITGC deficiencies were identified: · The firm selected for testing a control over change management but did not perform any procedures to test or in the alternative test any controls over the completeness of the population of changes from which it made its selections for testing. (AS 1105.10)

The firm used the work of the issuer's internal audit as evidence of the effectiveness of automated application controls over the accuracy and completeness of reports that the issuer used in the operation of certain other IT-dependent manual controls over revenue that the firm tested. Internal audit relied on the testing of these controls that was performed in prior years. The firm did not sufficiently evaluate whether internal audit's strategy to rely on testing that was performed in prior years was appropriate because the firm did not evaluate (1) whether ITGCs were effective in those prior years and (2) the effect of certain changes to IT systems that the issuer implemented in the current year. (AS 2201.B29 and .B31; AS 2605.24)

The sample sizes the firm used in certain of its substantive procedures to test revenue were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

For certain business units the firm selected for testing an automated control over the timing of revenue recognition. The firm did not test the configuration of this automated control or perform other procedures that would have provided sufficient appropriate audit evidence that the control was designed and operating effectively. (AS 2201.42 and .44)

For another business unit the firm selected for testing a control that consisted of the issuer's monthly review of revenue and gross margins. The firm did not evaluate the specific review procedures that the control owner performed to assess whether revenue was appropriately recognized. (AS 2201.42 and .44)

The issuer recognized certain revenue based on the daily market price of a commodity that the issuer obtained from a service organization. The following deficiencies were identified: · The firm selected for testing a control that included the issuer's investigation of daily price variances that exceeded a certain threshold. The firm did not evaluate whether the threshold the control owner used to investigate variances was sufficiently precise to detect misstatements that could be material. (AS 2201.42)

The issuer recognized certain revenue based on the daily market price of a commodity that the issuer obtained from a service organization. The following deficiencies were identified: · The firm selected for testing a control that included the issuer's investigation of daily price variances that exceeded a certain threshold. The firm did not perform any procedures to obtain evidence regarding the service organization's controls for the year under audit. (AS 2201.39 and .B19)

The issuer recognized certain revenue based on the daily market price of a commodity that the issuer obtained from a service organization. The following deficiencies were identified: · The firm obtained the service organization's pricing information from the issuer and used it in its substantive testing of this revenue but did not perform any procedures to evaluate the reliability of this information. (AS 1105.04 and .06)

The issuer recognized certain revenue over time based on costs incurred to date relative to total estimated costs to complete the contract. The following deficiencies were identified: · The firm selected for testing controls that consisted of the issuer's reviews of project budgets and status by contract including the estimated costs to complete. The firm did not evaluate the specific review procedures that the control owners performed to evaluate the reasonableness of the project budgets and related assumptions. (AS 2201.42 and .44)

The issuer recognized certain revenue from a contract with a customer based on specific formulas that measured the amount of consideration the issuer would receive for satisfaction of its performance obligation. The firm's substantive procedures to test this revenue included testing a sample of revenue transactions. For the transactions selected for testing the firm did not recalculate the consideration that the issuer used to record revenue to determine whether the consideration was calculated in accordance with the contract. (AS 2301.08 and .13)

The issuer initiated and processed sales transactions at numerous business units. The firm designated certain business units as subject to more extensive audit procedures and used an other accounting firm to test one of these business units. The following deficiencies were identified: · The firm did not identify and test any controls over the accuracy of the pricing information the issuer used to record revenue at the business units it tested. (AS 2201.39)

The issuer initiated and processed sales transactions at numerous business units. The firm designated certain business units as subject to more extensive audit procedures and used an other accounting firm to test one of these business units. The following deficiencies were identified: · The firm identified a risk of material misstatement that applied to all of these business units and tested a control that addressed this risk at the business units it tested but it did not instruct the other accounting firm to test this control at the business unit that firm tested. (AS 2101.11 and .12; AS 2201.B10)

The issuer recognized certain revenue over time based on costs incurred to date relative to total estimated costs to complete the contract. The firm did not perform any procedures beyond inquiring of management to evaluate the reasonableness of the significant assumptions that the issuer used to develop the estimated costs to complete the contracts the firm selected for testing. (AS 2501.16)

The issuer recognized certain revenue over time based on costs incurred to date relative to total estimated costs to complete the contract. The following deficiencies were identified: · The firm did not perform any procedures beyond inquiring of project managers to evaluate the reasonableness of the significant assumptions that the issuer used to develop the estimated costs to complete the contracts the firm selected for testing. (AS 2501.16)

The issuer recognized certain revenue over time based on costs incurred to date relative to total estimated costs to complete the contract. The firm did not perform any procedures beyond inquiring of management to evaluate the reasonableness of the significant assumptions that the issuer used to develop the estimated costs to complete the contracts the firm selected for testing. (AS 2501.16)

The issuer recognized revenue based on the rates in the contracts with its customers and the amount of time incurred to provide its services that was maintained in one of the issuer's information-technology (IT) systems. The firm did not perform sufficient procedures to test the accuracy and completeness of the time data because its procedures were limited to comparing the issuer's data to data from an external source and inspecting the issuer's reconciliation of the data to data the issuer obtained from its customers without evaluating the reliability of the data from these external sources. (AS 1105.04 .06 and .10)

The issuer recognized revenue from certain contracts over time based on estimated costs incurred relative to total estimated costs to complete the contract. The firm did not evaluate the reasonableness of the significant standard cost assumption that the issuer used to develop the estimated costs incurred on and the estimated costs to complete the contracts the firm selected for testing. (AS 2501.16)

The firm identified a control deficiency related to the issuer's control over the occurrence and cut-off of certain revenue. The firm identified and tested various controls that it believed would mitigate this deficiency but did not identify that these compensating controls either did not address the risk of material misstatement related to whether revenue occurred and was recorded in the appropriate period or did not operate at a level of precision that would prevent or detect a misstatement that could be material. (AS 2201.68)

The issuer recognized revenue from certain contracts over time based on costs incurred to date relative to total estimated costs to complete the contract. The firm did not sufficiently test the estimated total costs to complete a certain contract it selected for testing because it did not perform any substantive procedures to evaluate the reasonableness of the remaining number of units the issuer expected to deliver that the issuer used to develop the estimated total costs to complete. (AS 2501.16)

The firm's substantive procedures to test certain revenue included two substantive analytical procedures. The following deficiencies were identified: · For both substantive analytical procedures the firm used certain information obtained from an external source to develop its expectations but did not evaluate the reliability of this information. (AS 2305.16)

The firm's substantive procedures to test certain revenue included two substantive analytical procedures. The following deficiencies were identified: · For one of these substantive analytical procedures the firm developed its expectation based on certain information obtained from another external source but did not evaluate whether this information was sufficiently reliable for purposes of achieving its audit objectives. (AS 2305.16)

The issuer recognized revenue from contracts based on certain inputs. The firm did not perform any procedures to test the specific inputs used by the issuer in recognizing revenue. (AS 2301.08)