Explorer

The firm used system-generated data and reports in its testing of revenue. The following deficiencies were identified: · The extent of the firm's procedures to test the accuracy of certain of these system-generated reports was not sufficient because when calculating its sample size the firm did not take into account an identified significant deficiency over ITGCs for this system. (AS 1105.10)

The firm's internal inspection program had inspected this audit and reviewed these areas but did not identify the deficiencies below. The issuer recorded revenue at the time its services were provided to its customers. The firm did not perform any substantive procedures to test whether the performance obligation had been fully satisfied before revenue was recognized. (AS 2301.08)

For certain revenue at one business unit the following deficiencies were identified: · For contracts with recurring monthly revenue the firm did not identify and test any controls over the recording of certain of this revenue. (AS 2201.39)

For certain revenue at one business unit the following deficiencies were identified: · The firm selected for testing a control that included the issuer's review of the accuracy and completeness of customer contract information in the issuer's system that it used to record revenue. In its testing of the operating effectiveness of this control the firm did not test this aspect of the control. (AS 2201.44)

For certain revenue at one business unit the following deficiencies were identified: · As a result of the deficiency identified the firm did not perform sufficient procedures to test or sufficiently test controls over the completeness of a report used in its substantive testing. (AS 1105.10)

For certain revenue at two other business units the firm selected for testing controls that addressed whether the performance obligation had been satisfied before revenue was recognized. The number of occurrences selected for testing did not provide sufficient appropriate audit evidence in light of either the assessed inherent risk associated with the account or the frequency of the operation of the control. (AS 2201.46)

For one of these two business units the firm did not perform any substantive procedures to test whether the performance obligation was satisfied before revenue was recognized for the first 10 months of the year. (AS 2301.08)

The sample sizes the firm used in certain of its substantive procedures to test revenue were too small to provide sufficient appropriate audit evidence because (1) these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above and/or (2) in determining the sample size the firm did not take into account the allowable risk of incorrect acceptance. (AS 2301.16 .18 and .37; AS 2315.16 .19 .23 and .23A)

The issuer used a service organization to accumulate revenue data initiated in and processed by the issuer's various IT systems and the issuer recorded certain revenue based on these data. The following deficiency was identified: · The firm did not identify and test any controls over the accuracy and completeness of the revenue data that had been accumulated by the service organization from the various IT systems. (AS 2201.39)

The issuer used a service organization to accumulate revenue data initiated in and processed by the issuer's various IT systems and the issuer recorded certain revenue based on these data. The following deficiency was identified: · The firm did not perform procedures to test or identify and test controls over the accuracy and/or completeness of certain of these data that the firm used in its substantive testing of this revenue. (AS 1105.10)

The issuer used a service organization to accumulate revenue data initiated in and processed by the issuer's various IT systems and the issuer recorded certain revenue based on these data. The following deficiency was identified: · The sample size the firm used in its substantive procedures to test certain of this revenue was too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiency in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The issuer recognized certain revenue based on customer activity that was tracked using the issuer's various IT systems and it used service organizations to process customer payments. The firm's approach for substantively testing certain of this revenue consisted primarily of performing a software-assisted analysis to test the relationships between revenue and cash receipts. The reliability of the audit evidence obtained from this analysis was dependent upon the firm's testing of the underlying data. The firm did not sufficiently test the accuracy of the underlying data because the firm did not perform any procedures to (1) test or test controls over certain internally generated information that it used and (2) test the issuer's complementary user controls that the service auditor's reports described as necessary to rely on this payment information. (AS 1105.10; AS 2301.08 and .13)

The issuer recorded revenue net of customer rebates and other deductions. The following deficiency was identified: · The firm selected for testing a control that consisted of the issuer's review of the reconciliation between net revenue and cash receipts. The firm did not evaluate the specific review procedures that the control owner performed to assess certain adjustments between net revenue and cash receipts. (AS 2201.42 and .44)

The issuer recorded revenue net of customer rebates and other deductions. The following deficiency was identified: · The firm did not identify and test any controls over accrued rebates and other deductions. (AS 2201.39)

For one type of revenue at one business unit the firm did not identify and test any controls over the accuracy of certain order information from the issuer's customer ordering system that the issuer used to record revenue. (AS 2201.39)

The firm's internal inspection program had inspected this audit and reviewed these areas but did not identify the deficiencies below. The firm used information produced by the issuer in its testing of transaction prices but did not perform any procedures to test or test any controls over the accuracy and/or completeness of certain of this information. (AS 1105.10)

For one business unit the firm's substantive procedures to test revenue consisted of testing a sample of transactions. For certain of the transactions it selected for testing the firm was unable to obtain evidence demonstrating that the performance obligation had been satisfied when revenue was recognized. The firm did not consider the effect of these unexamined transactions on its evaluation of the sample results. (AS 2315.25)

For a second business unit the following deficiencies were identified: · The firm did not identify and test any controls that addressed the risk related to accuracy of the quantity of items ordered. (AS 2201.39)

For a second business unit the following deficiencies were identified: · The sample size the firm used in its substantive procedures to test this revenue was too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiency in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The issuer used an information-technology (IT) system to initiate transactions related to certain revenue. In its testing of controls over this revenue the firm tested various automated and IT-dependent manual controls that used data generated by this IT system. As a result of the following audit deficiencies the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46) In connection with our review the issuer reevaluated its controls over this revenue and concluded that a material weakness existed that had not been previously identified. The issuer subsequently reflected this material weakness in a revision to its report on ICFR and the firm revised its opinion on the effectiveness of the issuer's ICFR to express an adverse opinion and reissued its report.

The firm's substantive procedures to test one type of revenue at one business unit included selecting a sample of transactions for testing. The firm's sample was too small to provide sufficient appropriate audit evidence because in determining the sample size the firm did not take into account the allowable risk of incorrect acceptance. (AS 2315.16 .23 and .23A)

The firm subjected this type of revenue from certain other business units to less extensive audit procedures. In determining the extent to which audit procedures should be performed the firm did not evaluate (1) the materiality of these business units (2) the specific risks associated with these business units and (3) whether the risks of material misstatement that the firm identified for the business unit subject to more extensive audit procedures also applied to these business units. (AS 2101.11 and .12)

For another business unit the issuer contracted with an external party to manufacture and sell products on behalf of the issuer and recognized the associated revenue based on information it obtained from this external party. The following deficiencies were identified: · The firm's procedures to test the completeness of this revenue consisted of performing substantive analytical procedures. The firm did not determine whether the expectations it used in these analytical procedures were based on predictable relationships. (AS 2305.13 and .14)

For another business unit the issuer contracted with an external party to manufacture and sell products on behalf of the issuer and recognized the associated revenue based on information it obtained from this external party. The following deficiencies were identified: · The issuer recognized certain of this revenue based on sales of this product to the external party. The firm obtained and used information from the external party in its substantive testing of this revenue but did not perform procedures to evaluate the reliability of this information. (AS 1105.04 and .06)

For another business unit the issuer contracted with an external party to manufacture and sell products on behalf of the issuer and recognized the associated revenue based on information it obtained from this external party. The following deficiencies were identified: · The issuer recognized certain of this revenue based on sales of this product to the external party. The firm did not evaluate the terms and conditions included in the issuer's sales contract with the external party. (AS 2301.08)

The issuer used an information-technology (IT) system to initiate transactions related to certain revenue. The firm identified a control deficiency related to change management for this IT system. The following audit deficiencies were identified: · The firm identified and tested a compensating control that it believed mitigated this deficiency but did not identify that the control owner used information in the performance of this control that was produced by this IT system. (AS 2201.68) In connection with our review the issuer reevaluated its controls over this revenue and concluded that a material weakness existed that had not been previously identified. The issuer subsequently reflected this material weakness in a revision to its report on ICFR and the firm revised its opinion on the effectiveness of the issuer's ICFR to express an adverse opinion and reissued its report.

The issuer used an information-technology (IT) system to initiate transactions related to certain revenue. The firm identified a control deficiency related to change management for this IT system. The following audit deficiencies were identified: · The firm did not sufficiently evaluate the severity of the control deficiency because it did not accurately calculate the magnitude of the potential misstatement resulting from this deficiency. (AS 2201.62) In connection with our review the issuer reevaluated its controls over this revenue and concluded that a material weakness existed that had not been previously identified. The issuer subsequently reflected this material weakness in a revision to its report on ICFR and the firm revised its opinion on the effectiveness of the issuer's ICFR to express an adverse opinion and reissued its report.

The firm's substantive procedures to test the issuer's disclosure related to remaining performance obligations included selecting a sample of contracts for testing. For certain of these contracts the firm did not perform procedures to evaluate the reasonableness of a significant assumption used by the issuer to develop this disclosure. (AS 2501.16)

For this revenue the following additional deficiencies were identified: · The firm did not identify and test any controls over the accuracy and completeness of certain information used to record revenue. (AS 2201.39) In connection with our review the issuer reevaluated its controls over this revenue and concluded that a material weakness existed that had not been previously identified. The issuer subsequently reflected this material weakness in a revision to its report on ICFR and the firm revised its opinion on the effectiveness of the issuer's ICFR to express an adverse opinion and reissued its report.

The firm's internal inspection program had inspected this audit reviewed these areas and also identified the deficiencies below. The issuer used an IT system to record transactions related to revenue. The firm did not identify and test any controls that addressed the risk that users with the ability to develop changes also had the ability to implement those changes. (AS 2201.39)

The firm's internal inspection program had inspected this audit reviewed these areas and also identified the deficiencies below. The issuer used an IT system to record transactions related to revenue. In its testing of controls over revenue the firm tested an IT-dependent manual control that used a report generated from this system. As a result of this deficiency in the firm's testing of ITGCs the firm's testing of this IT-dependent manual control was not sufficient. (AS 2201.46)

The firm's internal inspection program had inspected this audit reviewed these areas and also identified the deficiencies below. For certain revenue the following additional deficiencies were identified: · For one type of revenue the firm did not perform substantive procedures to test whether performance obligations had been satisfied before revenue was recognized beyond comparisons to customer payments and/or issuer-produced information. (AS 2301.08 and .13)

The firm's internal inspection program had inspected this audit reviewed these areas and also identified the deficiencies below. For certain revenue the following additional deficiencies were identified: · For another type of revenue the firm's substantive procedures consisted of selecting a sample of transactions for testing. For certain transactions the firm did not perform procedures to test or test controls over the accuracy of certain issuer-produced information that the firm used in its testing. (AS 1105.10)

For this revenue the following additional deficiencies were identified: · The firm's substantive procedures to test revenue included testing a sample of transactions. The firm did not perform any procedures to test whether performance obligations were satisfied before revenue was recognized. (AS 2301.08)

As a result of the firm's control testing deficiencies the firm did not perform sufficient substantive procedures over revenue as follows: · The firm did not perform procedures to test or sufficiently test controls over the completeness of certain reports that the firm used in its substantive testing of revenue. (AS 1105.10)

As a result of the firm's control testing deficiencies the firm did not perform sufficient substantive procedures over revenue as follows: · The sample sizes the firm used in its substantive procedures to test revenue were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The issuer used two IT systems to initiate process and record transactions related to certain revenue. In its testing of controls over this revenue the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. As a result of the following deficiencies in the firm's testing of ITGCs the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

With respect to change management the firm selected for testing a control over the issuer's review of changes to the production environments for these IT systems. The firm did not evaluate the review procedures that the control owner performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

With respect to change management the firm selected for testing a control over the issuer's review of changes to the production environments for these IT systems. The firm did not identify that this control was not designed to address the risk that unauthorized changes were made to these systems as certain users with the ability to develop and implement changes also had administrative access to the monitoring tools used in the operation of this control. (AS 2201.42)

As a result of the firm's control testing deficiencies the firm did not perform sufficient substantive procedures over this revenue as follows: · The sample sizes that the firm used in certain of its substantive procedures to test this revenue were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

As a result of the firm's control testing deficiencies the firm did not perform sufficient substantive procedures over this revenue as follows: · For certain of this revenue the firm did not perform procedures to test or sufficiently test controls over the accuracy and completeness of certain system-generated data and reports the firm used in its substantive testing. (AS 1105.10)

For this revenue the following additional deficiencies were identified: · For certain of this revenue the firm did not perform procedures to test or test controls over the accuracy and completeness of certain information used in its substantive testing. (AS 1105.10)

The firm's substantive procedures to test certain revenue included selecting a sample of transactions for testing. For certain of these selections the firm did not perform sufficient procedures to evaluate whether the customer contracts met the collectability criteria required to recognize revenue under FASB ASC Topic 606 Revenue from Contracts with Customers because these customers did not meet one or more of the issuer's established credit policies and the firm did not evaluate the basis on which the customer or transaction was approved. (AS 2301.08)

For certain contracts the issuer recognized revenue over time based on costs incurred to date relative to total estimated costs to complete. The firm did not perform procedures to evaluate the reasonableness of the significant assumptions that the issuer used to develop the estimated costs to complete the open contracts the firm selected for testing. (AS 2501.16)

The firm identified a significant deficiency related to an IT system that the issuer used to record revenue. The firm's substantive procedures to test revenue at one business unit included selecting samples of transactions for testing. The sample sizes the firm used were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported as it did not take into account the potential effect of the significant deficiency on the controls it relied upon. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The issuer processed and recorded revenue transactions using its general ledger system. The firm tested certain automated and information technology ('IT')-dependent manual controls that used data and reports generated by or maintained in the general ledger system. The firm's approach to test the accuracy and completeness of these data and reports depended on effective IT general controls ('ITGCs'). In response to an ineffective ITGC over the issuer's general ledger system the firm selected for testing a compensating control that consisted of a review of system changes. The firm did not evaluate the review procedures that the control owner performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. As a result the firm's testing of these automated and IT-dependent manual controls over these areas was not sufficient. (AS 2201.46 and .68)

The firm selected for testing two controls over the review of revenue. The firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. Further the firm did not perform procedures to test whether the controls were operating as designed. (AS 2201.42 and .44)

The firm selected a sample of transactions to test that revenue was appropriately recognized. In its sample the firm did not test certain aspects of the transactions including valuation. (AS 2301.08)

The sample size the firm used in certain of its substantive procedures to test certain revenue was too small to provide sufficient appropriate audit evidence because the firm did not use the appropriate (1) tolerable misstatement for the population and (2) risk assessment in its sampling tool. (AS 2315.16 .23 and .23A)

The firm did not identify and test any controls that addressed whether transactions processed by the issuer's revenue application were accurately recorded. (AS 2201.39)