Explorer

The issuer valued certain inventory using the last-in first-out (LIFO) method. The following deficiencies were identified: · The firm did not perform any substantive procedures to test the LIFO inventory reserve. (AS 2301.08)

The issuer recorded certain investment securities at fair value based on cash-flow models. The following deficiencies were identified: · The firm did not identify and test any controls over these cash-flow models including the data and assumptions the issuer used in these cash-flow models. (AS 2201.39)

To test other receivables the firm sent positive confirmation requests to a selection of the issuer's customers. The firm did not receive a response to any of the confirmation requests sent and did not perform alternative procedures to test whether the recorded amounts of the other receivables were accurate and existed as of the confirmation date. (AS 2310.31)

The issuer records revenue based on contractual terms with customers. The firm did not perform audit procedures that addressed an assessed risk of material misstatement associated with the recognition of revenue because the firm did not evaluate certain terms used to recognize revenue against the underlying customer contracts or other supporting documentation. (AS 2301.08)

The issuer offered various forms of sales incentives to customers that were recorded as deductions from revenue. The firm selected for testing a control that consisted of the issuer's review and approval of the allocated sales incentives. The firm did not evaluate the specific review procedures that the control owner performed to assess the accuracy of the calculated sales incentives. (AS 2201.42 and .44)

The firm selected for testing controls that consisted of the issuer's review of revenue cut-off and credit balance refunds and write-offs. The firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

The firm selected for testing a control that consisted of management's review of manual journal entries. The firm did not identify and test any controls over the accuracy and completeness of certain data and reports that the control owners used in the operation of this control. (AS 2201.39)

The firm sent positive confirmation requests to the custodians of the component's financial instruments and identified certain differences between the information confirmed by the custodians and the component's records. The firm did not (1) evaluate the nature of exceptions identified in the confirmation replies; (2) evaluate the evidence provided by the confirmation replies; or (3) perform any other procedures to test the existence of the financial instruments given the occurrence of these exceptions. (AS 2310.33)

The firm identified a control deficiency in that the component had not designed and implemented a control over review of new contracts and amendments for the first three quarters of the year. In response to the control deficiency identified the component designed and implemented and the firm tested a control in the fourth quarter that consisted of the review of new or amended contracts with customers whose annual sales exceeded an established threshold for appropriate revenue recognition. In testing this control the firm did not evaluate whether the threshold the control owner used to select contracts for review was sufficiently precise to detect misstatements that could be material. (AS 2201.68)

The sample size the firm used in certain of its substantive procedures to test revenue was too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiency in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The firm did not perform any substantive procedures to test sales returns. (AS 2301.08)

The firm's substantive procedures to test depreciation expense for certain long-lived assets consisted of performing analytical procedures. The firm did not assess the reliability of certain data used by the firm to develop the expectations used in these procedures and did not establish an appropriate amount for investigation of certain differences because the amount exceeded materiality. (AS 2305.16 and .20)

The firm did not perform sufficient procedures to test the equity shares issued in consideration for an acquired business because the firm did not perform procedures to evaluate the terms of the agreement for the shares. (AS 2301.08)

The firm's approach for substantively testing certain revenue was to test the issuer's process. To substantively test this revenue the firm performed tests of details over a sample of revenue transactions including recalculating the revenue and deferred revenue for the selected transactions. The following deficiency was identified: • The firm did not perform procedures to test or test any controls over the accuracy and completeness of certain information it used to substantively test the revenue transactions. (AS 1105.10)

The firm's approach for substantively testing certain revenue was to test the issuer's process. To substantively test this revenue the firm performed tests of details over a sample of revenue transactions including recalculating the revenue and deferred revenue for the selected transactions. The following deficiency was identified: • The firm did not perform sufficient procedures to evaluate whether the revenue transactions were recorded in the proper period because it did not consider the appropriateness of the delivery dates used to recognize the revenue. (AS 2301.08 and .13)

The firm's approach for substantively testing certain revenue was to test the issuer's process. To substantively test this revenue the firm performed tests of details over a sample of revenue transactions including recalculating the revenue and deferred revenue for the selected transactions. The following deficiency was identified: • The firm did not compare the recalculated revenue and deferred revenue to the issuer's general ledger for the revenue transactions selected for testing. (AS 2301.08 and .13)

The firm's approach for substantively testing certain revenue was to test the issuer's process. To substantively test this revenue the firm performed tests of details over a sample of revenue transactions including recalculating the revenue and deferred revenue for the selected transactions. The following deficiency was identified: • The firm did not evaluate the reasonableness of a significant assumption used to estimate the amount of revenue to recognize. (AS 2501.16)

The issuer used multiple information technology (IT) systems to initiate process and/or record transactions related to insurance reserves. In its testing of controls over insurance reserves the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by IT systems it identified as in-scope with respect to insurance reserves. The firm then tested certain controls over insurance reserves that relied on the effectiveness of these IT controls. The firm selected for testing change management controls over these IT systems that consisted of the documentation review testing and approval of changes in a ticketing system prior to their migration into production. The following deficiency was identified: · The firm did not perform procedures beyond inquiry to test whether there was a common set of change management controls across all in-scope IT systems such that all changes related to these IT systems would be recorded tracked and approved through the issuer's ticketing system. (AS 2201.42 and 44)

The issuer used multiple information technology (IT) systems to initiate process and/or record transactions related to insurance reserves. In its testing of controls over insurance reserves the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by IT systems it identified as in-scope with respect to insurance reserves. The firm then tested certain controls over insurance reserves that relied on the effectiveness of these IT controls. The firm selected for testing change management controls over these IT systems that consisted of the documentation review testing and approval of changes in a ticketing system prior to their migration into production. The following deficiency was identified: · The firm did not perform procedures to test or test controls over the completeness of the population of changes used in the change management controls from which it selected its samples for testing. (AS 1105.10)

The issuer used multiple information technology (IT) systems to initiate process and/or record transactions related to insurance reserves. In its testing of controls over insurance reserves the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by IT systems it identified as in-scope with respect to insurance reserves. The firm then tested certain controls over insurance reserves that relied on the effectiveness of these IT controls. For certain controls over privileged user and application access the firm did not identify and test any controls over the accuracy and completeness of the listing of users that was used in the operation of the controls (AS 2201.39).

The issuer used multiple information technology (IT) systems to initiate process and/or record transactions related to insurance reserves. In its testing of controls over insurance reserves the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by IT systems it identified as in-scope with respect to insurance reserves. The firm then tested certain controls over insurance reserves that relied on the effectiveness of these IT controls. For certain controls over privileged user and application access the firm did not evaluate the control owner's review procedures to determine that the permissions assigned were appropriate. (AS 2201.42 and .44)

With respect to the firm's substantive testing of insurance reserves the firm used its own actuarial specialists to develop an independent estimate of a range of reserves. Historical claims and premiums data provided by the issuer was used by the firm's actuarial specialists to develop the independent estimate. As discussed above the firm did not sufficiently test controls over the accuracy and completeness of the system-generated data used by the firm to substantively test insurance reserves. The firm substantively tested this data by vouching a sample of data points from each source of information produced by the company to the relevant system. However the sample sizes the firm used were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The firm was engaged by the principal auditor of the issuer to perform a specific scope audit over the effectiveness of certain ITGCs including controls over user access privileges to support the principal auditor's opinion on ICFR. The principal auditor identified a risk related to improper segregation of duties due to inappropriate user access privileges. In response to this risk the firm selected for testing controls over the review of user access privileges. The firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

The issuer determined that it had a single cash-generating unit ('CGU') based on certain assumptions and grouped certain long-lived assets together at this CGU level for purposes of evaluating these assets for possible impairment. In testing certain long-lived assets for impairment the firm identified evidence that appeared to contradict certain of the issuer's assumptions and to indicate that identifiable cash flows may have been available at a lower level. The firm did not sufficiently evaluate this contradictory evidence because its procedures to test the issuer's assumptions supporting the single CGU determination were limited to inquiring of management inspecting certain information provided by the issuer and reading board minutes. (AS 2501.11; AS 2810.03)

The component recognized revenue from a variety of sources. The following deficiencies were identified: · The firm selected for testing controls that consisted of management's review of certain financial results including the amount of revenue recognized during the period as compared to forecasted and/or budgeted amounts and investigation of variances. The firm did not evaluate the specific review procedures that the control owners performed to investigate identified variances. (AS 2201.42 and .44)

The component recognized revenue from a variety of sources. The following deficiencies were identified: · The firm selected for testing controls that consisted of management's review of certain financial results including the amount of revenue recognized during the period as compared to forecasted and/or budgeted amounts and investigation of variances. The firm the firm did not identify and test any controls over the accuracy of data used in the operation of these controls. (AS 2201.39)

The component recognized revenue from a variety of sources. The following deficiencies were identified: · The firm selected for testing another control that consisted of a comparison of data used in the determination of certain revenue from the component's source system to an external source. The firm did not identify and test any controls over the completeness of data used in the operation of this control. (AS 2201.39)

The component recognized revenue from a variety of sources. The following deficiencies were identified: · The firm selected for testing another control that consisted of management's monthly review of the status of projects to evaluate the appropriateness of the revenue recognized. The firm did not evaluate the review procedures that the control owner performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

The component recognized revenue from a variety of sources. The following deficiencies were identified: · The firm selected for testing another control that consisted of management's monthly review of the status of projects to evaluate the appropriateness of the revenue recognized. The firm did not identify and test any controls over the accuracy and completeness of the report used in the operation of this control. (AS 2201.39)

The component recognized revenue from a variety of sources. The following deficiencies were identified: · The firm did not sufficiently evaluate whether certain revenue was appropriately recognized because the firm did not perform procedures to test various factors and assumptions used by the issuer beyond inquiring of management inspecting internally-generated customer invoices (for certain revenue) and recalculating the revenue recognized. (AS 2301.08 and .13; AS 2501.09 .10 and .11)

The firm selected for testing controls that consisted of management's review of (1) aged accounts receivable and/or (2) a reconciliation of accounts receivable to monthly billings. The firm did not identify and test any controls over the accuracy of the aging report and certain data used in the operation of these controls. (AS 2201.39)

The firm selected for testing controls that consisted of management's review of aged accrued and deferred revenues. The firm did not identify and test any controls over the accuracy of the aging reports used in the operation of these controls. (AS 2201.39)

The firm selected for testing controls that consisted of management's (1) review and approval of proposals and (2) monthly review of reports used to recognize revenue. The firm did not evaluate the specific review procedures that the control owners performed to evaluate the appropriateness of certain assumptions in the proposals and monthly reports used to recognize revenue. (AS 2201.42 and .44)

The issuer derives revenue through consolidated VIEs including their subsidiaries and relies on contractual arrangements with the VIEs and their shareholders to control the business operations of the consolidated VIEs. The issuer engaged an external specialist to provide a legal opinion regarding the issuer's consolidated VIEs including the validity and enforceability of contractual arrangements with the VIEs and their shareholders. The following deficiency was identified: • The firm did not identify and test any controls over the issuer's review of the legal opinion prepared by the company's specialist which described uncertainties regarding the interpretation and application of current laws and regulations related to the structure of the VIEs and evaluation of the effect of such uncertainties on its ability to consolidate the VIEs. (AS 2201.39)

The issuer derives revenue through consolidated VIEs including their subsidiaries and relies on contractual arrangements with the VIEs and their shareholders to control the business operations of the consolidated VIEs. The issuer engaged an external specialist to provide a legal opinion regarding the issuer's consolidated VIEs including the validity and enforceability of contractual arrangements with the VIEs and their shareholders. The following deficiency was identified: • The firm did not perform substantive procedures to evaluate the nature of the uncertainties described in the legal opinion prepared by the company's specialist and perform procedures to address the risks associated with those uncertainties. (AS 2301.08)

The firm selected for testing a control that included monthly reviews of income statement accounts including a comparison of the actual results to forecasted amounts and the investigation of variances over a specified threshold. The firm did not evaluate the specific review procedures that the control owner performed to determine whether items identified for investigation were appropriately resolved. (AS 2201.42 and .44)

The firm selected for testing a control that included monthly reviews of income statement accounts including a comparison of the actual results to forecasted amounts and the investigation of variances over a specified threshold. The firm did not identify and test any controls over the accuracy and completeness of forecasted amounts used in the operation of this control. (AS 2201.39)

The sample size the firm used in its substantive procedures to test revenue was too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The sample size the firm used in its substantive procedures to test revenue was too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

Deficiencies testing controls over sales agreements and sampling revenue transactions across the full year.

The issuer used multiple information technology (IT) systems to initiate process and record transactions related to revenue and related accounts and recognized revenue as the respective performance obligations were satisfied. The following deficiency was identified: • The firm did not identify and test any controls over the satisfaction of a performance obligation which determined the point in time in which the related revenue should be recognized. (AS 2201.39)

The issuer derives revenue through a consolidated variable interest entity and its subsidiaries (“VIE”) and relies on contractual arrangements with the VIE and its shareholders to control the business operations of the consolidated VIE. The issuer engaged an external specialist to provide a legal opinion regarding the issuer's consolidated VIE including the validity and enforceability of contractual arrangements with the VIE and its shareholders and the firm used the work of the company's specialist as audit evidence. The following deficiency was identified: • The firm did not sufficiently evaluate the relevance and reliability of the work performed by the company's specialist and whether the specialist's findings support or contradict the issuer's rights and obligations related to the consolidation of the VIE because it did not (1) evaluate the nature of the uncertainties described in the legal opinion prepared by the company's specialist (2) evaluate the effect of a restriction included in the legal opinion prepared by the company's specialist on the use of the opinion and (3) perform additional procedures to address the risks associated with those uncertainties and the effect of the restriction. (AS 1105.A9 and .A10)

The firm selected for testing a control over short-term investments that consisted of the issuer's review of the fair value calculation of the investments including the expected rate of return. The firm did not evaluate the review procedures that the control owner performed including the procedures to identify items for follow-up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

The issuer used multiple IT systems to initiate process and report transactions related to certain revenue and related accounts and inventory. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. As a result of the following deficiencies in the firm's testing of IT general controls (ITGCs) the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

With respect to change management: • The firm selected for testing change management controls that consisted of management's review and approval of requests for access including privileged-level access to application data files and databases. The firm did not however identify and test any controls over the appropriateness of changes made directly to the financial data within such application data files and databases. (AS 2201.39)

With respect to change management: • The firm selected for testing another change management control that consisted of the testing and approval of changes made to the structure of databases and relationships between data prior to their migration into the production environment. The firm did not perform procedures to test or test any controls over the completeness of the population of changes from which it made its selections to test this control. (AS 1105.10)

As a result of the firm's ITGC testing deficiencies discussed above the firm did not perform sufficient substantive procedures as follows: • The sample sizes the firm used in certain of its substantive procedures to test revenue and related accounts were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

As a result of the firm's ITGC testing deficiencies discussed above the firm did not perform sufficient substantive procedures as follows: • The firm used certain system-generated data to substantively test revenue and related accounts and inventory but did not test or (as discussed above) sufficiently test controls over the accuracy and completeness of this data. (AS 1105.10)

As a result of the firm's ITGC testing deficiencies discussed above the firm did not perform sufficient substantive procedures as follows: • The firm performed substantive analytical procedures as part of its testing of certain revenue. The firm used certain system-generated data to develop its expectations but did not test or (as discussed above) sufficiently test controls over the accuracy and completeness of this data. (AS 2305.16)

The issuer used an IT system to initiate process and record certain inventory and inventory-related transactions and deployed a separate instance of the system at a majority of its warehouses. Changes to this system were first deployed to some warehouses for purposes of pilot testing after which the changes were deployed to the remaining warehouses. The following deficiency was identified: • The firm selected for testing controls over inventory that consisted of the configuration of the IT system to automatically (1) calculate daily inventory cycle count tasks and (2) verify inventory receipts and shipments. The firm did not test the design and operating effectiveness of these controls in instances of the legacy (or unmodified) version of the IT system or perform procedures beyond inquiry to evaluate whether the tested configurations were consistently designed and applied in all instances across the system. (AS 2201.42 and .44)