Explorer

The issuer recognized revenue from two of its business units based in part on labor hours recorded in a timekeeping system hosted by a service organization. The following deficiencies were identified: · The firm was unable to obtain a service auditor's report regarding the effectiveness of the service organization's controls for the year under audit. The firm identified and tested various compensating controls that it believed would mitigate its inability to obtain a service auditor's report. The firm did not identify that the control owners used labor hours in the performance of these compensating controls that were obtained from this timekeeping system. (AS 2201.68)

The firm's internal inspection program inspected this audit reviewed the Revenue and Related Accounts area and also identified the deficiencies below. The issuer recognized certain revenue from one of its business units over time based on units completed to date relative to total contractual units. The firm did not identify and test any controls that addressed whether certain requirements of FASB ASC Topic 606 had been met in determining revenue recognition. (AS 2201.39)

The firm's internal inspection program inspected this audit reviewed the Revenue and Related Accounts area and also identified the deficiencies below. For the unbilled portion of this revenue the following additional deficiencies were identified: · The firm did not identify and test any controls that addressed the accuracy of this revenue. (AS 2201.39)

The firm's internal inspection program inspected this audit reviewed the Revenue and Related Accounts area and also identified the deficiencies below. For the unbilled portion of this revenue the following additional deficiencies were identified: · The firm selected for testing a control that consisted of the issuer's review of contract setup within the issuer's IT system. The firm did not test the aspect of this control that addressed the accuracy of contractual units and rates. (AS 2201.42 and .44)

The firm's internal inspection program inspected this audit reviewed the Revenue and Related Accounts area and also identified the deficiencies below. For another business unit the issuer recognized certain revenue over time based on costs incurred to date relative to total estimated costs to complete these contracts. Certain of this revenue included revenue from contract modifications that had not yet been approved by customers. The following deficiencies were identified: · The firm selected for testing a control that consisted of the issuer's review of revenue recognition for modified contracts. The firm did not test the design of the aspects of this control related to unapproved contract modifications. (AS 2201.42)

The firm's internal inspection program inspected this audit reviewed the Revenue and Related Accounts area and also identified the deficiencies below. The firm selected for testing controls that consisted of the issuer's reviews of allowances for accounts related to certain revenue. The firm did not identify and test any controls over the accuracy of certain reports used in the operation of these controls. (AS 2201.39)

The firm selected for testing a control over the issuer's review of the accuracy of pricing information used to record revenue at this business unit. The firm did not identify and test any controls over the accuracy of certain information used in the operation of this control. (AS 2201.39)

For revenue and related accounts the following additional deficiency related to the firm's testing of controls were identified: the firm selected for testing a control related to a revenue reconciliation. The firm did not perform procedures beyond inquiry to evaluate whether this control could effectively prevent or detect material misstatements. (AS 2201.42 and .44)

For revenue and related accounts the following additional deficiency related to the firm's testing of controls were identified: the firm used the work of the issuer's internal audit as evidence of the operating effectiveness of certain controls selected for testing over revenue and related accounts. The firm or the issuer's internal audit did not perform procedures beyond inquiry to evaluate whether these controls could effectively prevent or detect material misstatements. Further the issuer's internal audit tested certain of these controls through an interim date but the firm did not perform any procedures to update the results of the testing from that interim date to year end. (AS 2201.42 .44 and .55)

For revenue and related accounts the following additional deficiency related to the firm's testing of controls were identified: the firm used the work of the issuer's internal audit as evidence of the operating effectiveness of certain controls selected for testing over revenue and related accounts. The firm or the issuer's internal audit did not perform procedures beyond inquiry to evaluate whether these controls could effectively prevent or detect material misstatements. The firm's use of the work of internal audit did not provide sufficient appropriate audit evidence that controls related to estimating costs to complete were operating as designed given the significant amount of subjectivity and judgment involved in these controls. (AS 2201.19; AS 2605.20 and .21)

The firm's substantive procedures to test three of these types of revenue included analytical procedures. The following deficiencies were identified: · The firm used issuer-produced information to develop its expectation of one of these types of revenue but did not test or in the alternative test any controls over the accuracy of this information. (AS 2305.16)

The issuer used multiple information technology (IT) systems to initiate process and record transactions related to revenue and related accounts and recognized revenue as the respective performance obligations were satisfied. The following deficiency was identified: • The firm did not identify and test any controls over the satisfaction of a performance obligation which determined the point in time in which the related revenue should be recognized. (AS 2201.39)

The issuer used multiple information technology (IT) systems to initiate process and record transactions related to revenue and related accounts and recognized revenue as the respective performance obligations were satisfied. The following deficiency was identified: The firm selected for testing controls over certain revenue and related accounts that consisted of the configuration of certain IT systems to automatically (1) update the order status (2) calculate and allocate revenue and (3) update order payment information. The firm used a “test of one” approach to test these controls but did not perform procedures beyond inquiry to evaluate whether the tested configurations were applied consistently across each processing alternative to support the use of such an approach. (AS 2201.46)

The firm selected for testing a control over certain revenue that consisted of the issuer's inspection of source documents that were used to record the revenue. The firm did not perform sufficient procedures to test the operating effectiveness of this control because it did not test an aspect of the control involving the issuer's inspection of certain of these source documents. (AS 2201.44)

The firm selected for testing certain automated controls over the processing and recording of revenue transactions. The firm's testing of these automated controls using a sample of only one instance of the controls' operation was not sufficient because the firm did not test the configuration or programming of these controls or perform other procedures that would have provided sufficient appropriate audit evidence that these controls were designed and operating effectively. (AS 2201.42 and .44)

The firm identified deficiencies in the design and operating effectiveness of certain controls over revenue transactions. The firm concluded that these deficiencies represented a significant deficiency based on the firm's testing of various compensating controls. The firm did not sufficiently evaluate the severity of the control deficiencies over the processing and recording of revenue transactions because it did not identify that the compensating controls were dependent on the effectiveness of the deficient controls. (AS 2201.68)

The issuer offered various forms of sales incentives to customers that were recorded as deductions from revenue with a corresponding liability for sales incentives. The firm selected for testing controls that consisted of the issuer's review and approval of these sales incentives. The following deficiencies were identified: · For one of these controls the firm did not test the aspect of the control that addressed the control owner's review of the accuracy of certain sales incentives. (AS 2201.42 and .44) In connection with our review the issuer reevaluated its controls over certain of these sales incentives and concluded that a material weakness existed that had not been previously identified. The issuer subsequently reflected this material weakness in a revision to its report on ICFR and the firm revised its opinion on the effectiveness of the issuer's ICFR to express an adverse opinion and reissued its report.

The issuer offered various forms of sales incentives to customers that were recorded as deductions from revenue with a corresponding liability for sales incentives. The firm selected for testing controls that consisted of the issuer's review and approval of these sales incentives. The following deficiencies were identified: · For another of these controls the control owner used an automated tool to assess the accuracy of certain other sales incentives. The firm did not test the configuration or programming of this tool or perform other procedures to test this tool that would have provided sufficient appropriate audit evidence that this aspect of the control was designed and operating effectively. (AS 2201.42 and .44) In connection with our review the issuer reevaluated its controls over certain of these sales incentives and concluded that a material weakness existed that had not been previously identified. The issuer subsequently reflected this material weakness in a revision to its report on ICFR and the firm revised its opinion on the effectiveness of the issuer's ICFR to express an adverse opinion and reissued its report.

With respect to two types of revenue the following deficiencies were identified: · The firm did not identify and test any controls that addressed whether the performance obligation was satisfied before revenue was recognized. (AS 2201.39)

The firm selected for testing an automated control over the appropriateness of the prices that the issuer used to record revenue. The firm did not test the programming of this automated control or perform other procedures to test this control that would have provided sufficient appropriate audit evidence that the control was designed and operating effectively. (AS 2201.42 and .44)

The firm identified control deficiencies related to change management for one of the issuer's IT systems. The firm did not evaluate the severity of these control deficiencies individually or in combination to determine whether they represented a material weakness beyond identifying a mitigating factor that did not address the risk that changes could be migrated into production without appropriate approval and testing. (AS 2201.62)

For certain subsidiaries the firm did not (1) obtain a sufficient understanding of the likely sources of potential misstatements associated with revenue processes and (2) identify and test controls over revenue recognition. (AS 2201.34 and .39)

The issuer's main information technology ('IT') system processed revenue transactions and maintained revenue related data. A service organization provided data center hosting services related to the IT system. The firm did not identify and test any relevant complementary user controls described in the service auditor's report. (AS 2201.B22)

The issuer's main information technology ('IT') system processed revenue transactions and maintained revenue related data. A service organization provided data center hosting services related to the IT system. The service organization used several sub-service organizations to host the issuer's IT system and the controls for the sub-service organizations were not addressed in the service auditor's report. The firm did not (1) obtain an understanding of how the use of sub-service organizations affected the issuer's revenue process; and (2) evaluate whether it was necessary to obtain an understanding of or test any relevant controls at the sub-service organizations. (AS 2201.B19 and .B21)

The issuer's main information technology ('IT') system processed revenue transactions and maintained revenue related data. A service organization provided data center hosting services related to the IT system. The service organization used several sub-service organizations to host the issuer's IT system and the controls for the sub-service organizations were not addressed in the service auditor's report. The firm did not evaluate the effect of exceptions identified in the service auditor's report on the issuer's revenue process. (AS 2201.B25)

The firm identified a material weakness related to an employee having responsibilities for financial statement review controls and administrator access to the issuer's IT system discussed above. The firm selected for testing an automated control that restricts the recording of sales to authorized customers. The firm did not evaluate whether its test of one approach for this control was appropriate in light of the identified material weakness. (AS 2201.65)

The firm determined that a control over management's assessment of the effect on revenue recognition of FASB ASC Topic 606 Revenue from Contracts with Customers was deficient. The firm concluded that this represented a significant deficiency after identifying and testing two compensating controls. The firm did not sufficiently evaluate the severity of the control deficiency because the firm did not evaluate whether and if so how either of the controls identified as compensating controls addressed the effect of ASC Topic 606 on revenue recognition. (AS 2201.68)

The issuer recognized revenue as services were provided and accrued revenue and recorded accounts receivable for services provided but not yet billed. The firm identified an elevated inherent risk related to certain revenue that was recognized over time. The following deficiency was identified: · The firm selected for testing controls over certain revenue and accounts receivable and tested the controls through the second quarter of the year under audit. The firm did not perform procedures to update the results of its testing from this interim date to year end beyond inquiry of management. (AS 2201.55)

The firm did not identify and test any controls over the (1) approval of prices (2) entry of customer orders for both domestic and export sales into the general ledger (3) accuracy of the bills of lading information entered into the general ledger used to initially recognize revenue for export sales and (4) deferral of revenue at year end related to certain export sales. (AS 2201.39)

The issuer used a service organization to initiate and process certain of its revenue transactions related to the sale of products. The firm did not perform any procedures to evaluate whether the issuer implemented the appropriate complementary user controls as described in the service auditor's report. (AS 2201.39 and .B22)

The issuer used another service organization to ship the products and record these transactions. The firm did not perform any procedures to obtain evidence regarding the controls over the activities performed by this service organization. (AS 2201.39 and .B19)

With respect to Revenue and Related Accounts the firm selected for testing certain automated application controls related to revenue. The firm's testing of these controls was not sufficient because the procedures performed were substantive in nature and did not directly test the controls. (AS 2201.42 .44 and .B9)

The firm selected for testing controls over the automated transfer or reconciliation of data between systems. The following deficiencies were identified: · For certain other of these controls the firm did not identify and test any controls over the investigation and resolution of identified variances. (AS 2201.39)

The firm selected for testing controls over the automated transfer or reconciliation of data between systems. The following deficiencies were identified: · For certain of these controls which operated across multiple systems the firm's approach of testing one instance of the controls was based on an unsupported assumption that all systems were configured the same way. (AS 2201.46)

With respect to the firm's testing of manual controls: · For certain other contracts the firm did not identify and test any controls that addressed whether relevant terms and conditions were identified and evaluated for appropriate revenue recognition. (AS 2201.39)

With respect to the firm's testing of manual controls: · For one type of revenue the firm did not identify and test any controls that addressed whether the performance obligation was satisfied before revenue was recognized. (AS 2201.39)

The issuer recognized revenue at the time services were provided to its customers. The following deficiencies were identified: • The firm did not identify and test any controls over the application of cash receipts to customer accounts. (AS 2201.39)

The firm did not identify and test any controls over the issuer's estimates of variable consideration included in the transaction price. (AS 2201.39)

With respect to the firm's testing of controls with an automated component: · The firm selected for testing various automated controls over certain revenue and related accounts. The firm's testing of these automated controls using a sample of only one instance of the controls' operation was not sufficient because the firm did not test the programming of these controls or perform other procedures that would have provided sufficient appropriate audit evidence that these automated controls were designed and operating effectively. (AS 2201.46)

With respect to the firm's testing of controls with an automated component: · For one type of revenue the firm selected for testing a control that consisted of the automated calculation and recording of revenue and related accounts and a manual review of the accuracy of the data used in the operation of this control. The firm did not test the manual aspect of this control. (AS 2201.42 and .44)

With respect to the firm's testing of controls with an automated component: · For certain revenue the firm did not identify and test any controls over certain inputs and assumptions used by the issuer to recognize revenue. (AS 2201.39)

The firm selected for testing controls over the automated transfer or reconciliation of data between systems. The following deficiencies were identified: · Certain of these controls included the manual resolution of any errors in this data transfer. The firm did not test the operating effectiveness of the manual aspect of these controls. (AS 2201.44)

The issuer used certain systems to process sales transactions and compute and record revenue and receivables. The firm selected for testing an automated control over the processing of sales transactions and computation of the final unit prices used in the determination of revenue. The firm did not test the configuration of this automated control for all types of revenue beyond observing the processing of one sales transaction for one system inquiring of management and reviewing the source code for another system. (AS 2201.42 and .44)