Explorer

The firm did not perform procedures to test the appropriateness of the issuer's accounting for certain changes to a significant account beyond obtaining external invoices. (AS 2301.08)

The firm did not perform procedures to test the appropriateness of the issuer's accounting for certain changes to a significant account beyond obtaining external invoices. (AS 2301.08)

The firm's approach for substantively testing revenue consisted primarily of performing software-assisted analyses to test the relationships among revenue deferred revenue accounts receivable and cash receipts. The firm's approach to addressing the reliability of the audit evidence obtained from this type of analysis was dependent upon the firm's testing of certain data underlying the analysis. The firm did not perform sufficient procedures to test the accuracy and completeness of this data because the sample sizes the firm used to test the data were smaller than the sample sizes the firm determined necessary for these procedures. (AS 1105.10)

The issuer's accounts receivable included certain credit balances that were reclassified as liabilities of the issuer. The firm did not perform any substantive procedures to obtain an understanding of the nature of certain of these credit balances and evaluate whether they represented valid obligations of the issuer. (AS 2301.08)

Deficiency evaluating the economic substance and accounting treatment of certain revenue.

Deficiencies evaluating the issuer's impairment allocation method and a significant assumption for intangible assets.

The issuer held receivables at numerous business units. The firm performed procedures to test the existence and valuation of receivables at select business units including sending positive confirmation requests to customers for a sample of receivables using a sampling approach that was based on obtaining a certain level of audit evidence from its other substantive procedures. The following deficiency was identified: ?In determining the extent to which audit procedures should be performed at certain business units the firm did not evaluate whether (1) specific risks of material misstatement existed at these business units and (2) the risks of material misstatement the firm identified for the business units subject to audit procedures also applied to these business units such that in combination these risks presented a reasonable possibility of material misstatement. (AS 2101.11 and .12; AS 2201.B10)

The issuer held receivables at numerous business units. The firm performed procedures to test the existence and valuation of receivables at select business units including sending positive confirmation requests to customers for a sample of receivables using a sampling approach that was based on obtaining a certain level of audit evidence from its other substantive procedures. The following deficiency was identified: ? For positive confirmation requests for which the firm did not receive a response the firm did not perform alternative procedures that provided sufficient appropriate audit evidence that the recorded amounts of the receivables were accurate as of the confirmation date. (AS 2310.31)

The issuer held receivables at numerous business units. The firm performed procedures to test the existence and valuation of receivables at select business units including sending positive confirmation requests to customers for a sample of receivables using a sampling approach that was based on obtaining a certain level of audit evidence from its other substantive procedures. The following deficiency was identified: ? For certain business units the sample size the firm used was too small to provide sufficient appropriate audit evidence over the receivables because the firm's other substantive procedures did not provide the level of substantive evidence needed to support its sampling approach. (AS 2315.16 .19 .23 and .23A)

The issuer engaged a specialist to develop certain significant assumptions that the issuer considered in determining a significant estimate. The firm's approach for substantively testing the estimate was to test the issuer's process. The following deficiency was identified: ? The firm did not perform any procedures to evaluate the reasonableness of certain assumptions the specialist and issuer developed that the specialist used to develop the significant assumptions the issuer considered in determining the estimate. (AS 1105.A8b; AS 2501.16)

The issuer engaged a specialist to develop certain significant assumptions that the issuer considered in determining a significant estimate. The firm's approach for substantively testing the estimate was to test the issuer's process. The following deficiency was identified: ? The firm did not perform any procedures to test the accuracy and completeness of company-produced data and evaluate the relevance and reliability of certain other data from sources external to the issuer that the specialist used to develop the significant assumptions the issuer considered in determining the estimate. (AS 1105.A8a)

The firm's approach for substantively testing revenue consisted primarily of performing a software-assisted analysis to test the relationships among revenue accounts receivable and cash receipts. The reliability of the audit evidence obtained from this analysis was dependent upon the firm's testing of cash receipts data underlying the analysis. To test this data the firm selected a sample of cash receipts and compared the amounts to statements generated from the issuer's information technology application used to initiate bank transfers and control its bank accounts. The firm did not perform procedures to test or test any controls over the accuracy and completeness of the system-generated statements that it used to test the cash receipts data. (AS 1105.10)

The firm selected for testing a control over the existence of cash that consisted of the reconciliation of cash accounts and the review and investigation of significant reconciling and/or unusual items. The firm did not identify and test any controls over the accuracy and completeness of system-generated statements used in the operation of this control. (AS 2201.39)

The issuer used eight information-technology (IT) applications to initiate process and record transactions related to revenue trade receivables and derivatives. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and/or reports generated or maintained by certain of these IT applications. As a result of the following deficiencies in the firm's testing of IT general controls (ITGCs) the firm's testing of these automated and IT-dependent controls was not sufficient. (AS 2201.46)

With respect to change management: The firm selected for testing certain change management controls over the eight IT applications discussed above that consisted of the documentation review testing and approval of changes prior to their implementation into production. In addition all changes made in the production environment were to be recorded in a ticketing system. For certain instances tested the firm did not perform procedures to test the operating effectiveness of these change management controls beyond verifying the existence of a change ticket recorded in the issuer's ticketing system. (AS 2201.44)

The firm did not perform procedures to evaluate the reasonableness of a significant assumption used by the issuer to estimate the amount of revenue to recognize for certain sales agreements beyond inquiry of management. (AS 2501.16)

The firm did not identify and test any controls over the existence and valuation of unbilled receivables. (AS 2201.39)

The firm did not perform any substantive procedures to test the existence and valuation of unbilled receivables. (AS 2301.08)

The issuer used service organizations to host and/or maintain and manage various information technology (IT) systems that the issuer used to initiate process and record transactions related to the ALL and Investment Securities. The following deficiencies were identified: · The firm did not perform procedures beyond inquiring of management and reading certain related documentation to test that controls over program changes access to programs and computer operations were designed and operating effectively. (AS 2201.42 and .44)

The firm's approach for substantively testing the quantitative component of the ALL was (1) to review and test management's process and (2) develop an independent expectation. The issuer used loss data from selected peer companies to develop loss rates that it used to estimate the quantitative component of the portion of the ALL related to loans collectively evaluated for impairment. The following deficiencies were identified: · To develop an independent expectation the firm used a combination of the issuer's historical loss rates and the loss rates of the group of peer companies used by the issuer to develop estimated loss ranges and compared these estimated loss ranges to the issuer's loss rates. The firm did not evaluate (1) the reasonableness of the assumptions used to develop these estimated loss ranges and (2) the differences between these estimated loss ranges and issuer's loss rates. (AS 2501.09 .10 and .12)

The firm's approach for substantively testing the qualitative component of the ALL was to review and test management's process. The firm did not sufficiently evaluate the reasonableness of the qualitative reserve component of the ALL because the firm's procedures to test the qualitative factors the issuer used to determine the reserve component were limited to (1) reading the issuer's ALL memorandum (2) testing certain observable inputs related to existing economic conditions that the issuer used to develop its loss estimates and (3) comparing the qualitative factors the issuer used at year end to those used in prior periods. (AS 2501.09 .10 and .11)

The firm did not perform any substantive procedures to test or in the alternative test any controls over the accuracy and/or completeness of certain data and reports the firm used in its substantive testing of the ALL. (AS 1105.10)

The firm did not perform any substantive procedures to test or in the alternative test any controls over the completeness of a report obtained from the issuer that it used in its substantive procedures to test revenue. (AS 1105.10)

The issuer used service organizations to host and/or maintain and manage various information technology (IT) systems that the issuer used to initiate process and record transactions related to the ALL and Investment Securities. The following deficiencies were identified: · The firm did not perform any procedures to evaluate whether the appropriate complementary user entity controls were implemented and operating effectively in order to achieve the control objectives stated in the service organizations' control reports. (AS 2201.B22)

Loan risk ratings were an important input in estimating the issuer's ALL. The firm selected for testing a control designed to validate loan risk ratings assigned by the issuer to certain categories of its loans. The issuer used internal loan reviewers (ILRs) and an external loan reviewer (ELR) in the operation of this control. The following deficiencies were identified: · The firm did not evaluate the review procedures that the ILRs performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

Loan risk ratings were an important input in estimating the issuer's ALL. The firm selected for testing a control designed to validate loan risk ratings assigned by the issuer to certain categories of its loans. The issuer used internal loan reviewers (ILRs) and an external loan reviewer (ELR) in the operation of this control. The following deficiencies were identified: · The ELR reviewed loan risk ratings at an interim date. The firm did not identify and test any controls over the loans that were subject to review by the ELR from the interim date to the issuer's year end. (AS 2201.39)

Loan risk ratings were an important input in estimating the issuer's ALL. The firm selected for testing a control designed to validate loan risk ratings assigned by the issuer to certain categories of its loans. The issuer used internal loan reviewers (ILRs) and an external loan reviewer (ELR) in the operation of this control. The following deficiencies were identified: · The firm did not identify and test any controls over the reasonableness of loan risk ratings for loans that were not subject to this control. (AS 2201.39)

Loan risk ratings were an important input in estimating the issuer's ALL. The firm selected for testing a control designed to validate loan risk ratings assigned by the issuer to certain categories of its loans. The issuer used internal loan reviewers (ILRs) and an external loan reviewer (ELR) in the operation of this control. The following deficiencies were identified: · The firm did not identify and test any controls over the accuracy and completeness of data the ILRs and ELR used in the performance of this control. (AS 2201.39)

The firm identified deficiencies in certain of the issuer's other controls over the ALL it had selected for testing and concluded that these deficiencies in the aggregate represented a significant deficiency. The firm did not sufficiently evaluate whether the identified control deficiencies represented a material weakness because the firm did not evaluate the magnitude of the potential misstatements resulting from these control deficiencies. (AS 2201.62)

The firm's approach for substantively testing the quantitative component of the ALL was (1) to review and test management's process and (2) develop an independent expectation. The issuer used loss data from selected peer companies to develop loss rates that it used to estimate the quantitative component of the portion of the ALL related to loans collectively evaluated for impairment. The following deficiencies were identified: · The firm did not obtain an understanding of how the issuer developed its loss rates. (AS 2501.10)

The firm's approach for substantively testing the quantitative component of the ALL was (1) to review and test management's process and (2) develop an independent expectation. The issuer used loss data from selected peer companies to develop loss rates that it used to estimate the quantitative component of the portion of the ALL related to loans collectively evaluated for impairment. The following deficiencies were identified: · To test management's process the firm compared the loss rates developed by the issuer to the loss rates of certain peer companies identified by the issuer. The firm did not sufficiently evaluate the relevance of the loss rates of the peer companies because the firm did not evaluate the comparability of the composition and risk characteristics of the issuer's loan portfolio to the loan portfolios of the peer companies. (AS 2501.09 .10 and .11)

The issuer used certain qualitative factors to determine the qualitative component of the ALL. The firm selected for testing a review control over certain data used in the calculation of the qualitative reserve. The firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

The issuer also reported a component of the ALL related to loans individually evaluated for impairment of which certain loans were considered collateral dependent and the impairment was determined based on the fair value of the collateral less estimated costs to sell. The issuer engaged a specialist to determine the fair value of certain collateral and for the remaining collateral the issuer used an automated valuation model to determine the fair value. The following deficiencies were identified: · The firm did not perform sufficient procedures to test the fair value of collateral based on the company's specialists' valuation reports that it selected for testing because it did not perform further procedures to use the work of the company's specialist as audit evidence. (AS 1105.A1 - .A10; AS 2501.07)

The issuer also reported a component of the ALL related to loans individually evaluated for impairment of which certain loans were considered collateral dependent and the impairment was determined based on the fair value of the collateral less estimated costs to sell. The issuer engaged a specialist to determine the fair value of certain collateral and for the remaining collateral the issuer used an automated valuation model to determine the fair value. The following deficiencies were identified: · The firm's approach to test the fair value of the collateral based on the issuer's internal model it selected for testing was to develop an independent expectation. The firm did not perform any procedures to demonstrate it had a reasonable basis for the assumptions used (AS 2501.22)

The issuer also reported a component of the ALL related to loans individually evaluated for impairment of which certain loans were considered collateral dependent and the impairment was determined based on the fair value of the collateral less estimated costs to sell. The issuer engaged a specialist to determine the fair value of certain collateral and for the remaining collateral the issuer used an automated valuation model to determine the fair value. The following deficiencies were identified: · The firm's approach to test the fair value of the collateral based on the issuer's internal model it selected for testing was to develop an independent expectation. The firm did not perform any procedures to evaluate the relevance and reliability of certain information it obtained from an external source that it used to develop its independent expectation. (AS 1105.04 and .06)

The issuer's deposit liability transactions included certain deposits processed through information systems that were outside of the issuer's core deposit liability system. The firm did not identify and test any controls over deposit transactions initiated outside of the issuer's core deposit system. (AS 2201.39)

The firm selected for testing a control over deposit liability reconciliations. The firm did not evaluate the specific review procedures that the control owners performed to determine whether reconciling items were appropriately resolved. (AS 2201.42 and 44)

The firm identified journal entries that met certain fraud criteria. The firm judgmentally selected certain of those journal entries for testing without having an appropriate basis for limiting its testing to these journal entries. Further for journal entries meeting one of the identified fraud criteria the firm did not select any of the entries for testing. (AS 2401.61)

Loan risk grades were an important input in estimating the issuer's ALL. The firm selected for testing a control designed to validate loan risk grades assigned by the issuer to certain categories of loans. The control included the review of loan risk grades by the issuer's external loan reviewer (ELR). The following deficiencies were identified: · The firm did not evaluate the review procedures that the control owners performed to evaluate the appropriateness of the issuer's loan grades. (AS 2201.42 and .44)

Loan risk grades were an important input in estimating the issuer's ALL. The firm selected for testing a control designed to validate loan risk grades assigned by the issuer to certain categories of loans. The control included the review of loan risk grades by the issuer's external loan reviewer (ELR). The following deficiencies were identified: · The ELR reviewed loan risk grades as of an interim date. The firm did not identify and test any controls over the loans that were subject to review by the ELR from the interim date to the issuer's year end. (AS 2201.39)

Loan risk grades were an important input in estimating the issuer's ALL. The firm selected for testing a control designed to validate loan risk grades assigned by the issuer to certain categories of loans. The control included the review of loan risk grades by the issuer's external loan reviewer (ELR). The following deficiencies were identified: · The firm did not identify and test any controls over the reasonableness of loan risk grades for loans that were not subject to this control. (AS 2201.39)

On a periodic basis the issuer evaluates potential problem loans. The firm selected for testing a control that included the review of potential problem loans. The following deficiencies were identified: · The firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44)

On a periodic basis the issuer evaluates potential problem loans. The firm selected for testing a control that included the review of potential problem loans. The following deficiencies were identified: · The firm did not identify and test any controls over the accuracy and completeness of reports used by the control owners. (AS 2201.39)

The issuer's ALL included loans individually evaluated for impairment. The firm did not identify and test any controls over the reasonableness of the fair value of the collateral used in the loan impairment calculation for certain individually evaluated loans. (AS 2201.39)

The firm's approach for substantively testing the qualitative component of the ALL was to review and test the issuer's process. The firm did not perform procedures to evaluate whether the issuer had a reasonable basis for the significant assumptions related to basis point qualitative factors used to determine the qualitative component of the ALL beyond obtaining and reading an issuer-prepared narrative. (AS 2501.16)

The issuer also reported a component of the ALL related to loans individually evaluated for impairment of which certain loans were considered collateral dependent and the impairment was determined based on the fair value of the collateral less estimated costs to sell. The issuer engaged a specialist to determine the fair value of certain collateral and for the remaining collateral the issuer used an automated valuation model to determine the fair value. The following deficiencies were identified: · The firm did not perform sufficient procedures to test the fair value of collateral based on the company's specialists' valuation reports that it selected for testing because although it determined it needed additional evidence for valuation reports that were significantly aged it limited its procedures to inquiry and obtaining information from external sources without evaluating the relevance and reliability of that information. (AS 1105.04 .06 and .A10; AS 2501.07)

The issuer developed the ACL for loans collectively evaluated for impairment using various models that were maintained by a service organization. The firm obtained a service auditor's report for this service organization. The following deficiency was identified: • The firm did not identify and test any controls over the appropriateness of certain models that were not addressed by this service auditor's report. (AS 2201.39)

The firm's approach for substantively testing the ACL was to test the issuer's process and the firm used the work of company specialists to evaluate the appropriateness of certain of the models the issuer used to develop the ACL for loans collectively evaluated for impairment. The following deficiency was identified: • The firm did not perform procedures to evaluate the reasonableness of the significant assumptions used to develop the ACL beyond reading an issuer-prepared memorandum. (AS 2501.16)

The firm's approach for substantively testing the ACL was to test the issuer's process and the firm used the work of company specialists to evaluate the appropriateness of certain of the models the issuer used to develop the ACL for loans collectively evaluated for impairment. The following deficiency was identified: • The firm used issuer-prepared loan delinquency data in its substantive testing of the ACL but did not perform procedures to test or test any controls over the accuracy of this data. (AS 1105.10)

The issuer developed the ACL for loans collectively evaluated for impairment using various models that were maintained by a service organization. The firm obtained a service auditor's report for this service organization. The following deficiency was identified: • The firm identified certain complementary user controls related to the issuer's validation and review of the outputs of the service organization's models that the service auditor's report described as necessary. The firm selected for testing a control to address the complementary user controls but did not identify that this control was not designed to satisfy the control objectives of the complementary user controls. (AS 2201.42 and .B22)