Explorer

The issuer used multiple information-technology (IT) systems to initiate process and record inventory and inventory-related transactions. In its testing of controls over inventory the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to other tests of controls and substantive procedures related to inventory certain of which were affected by the audit deficiencies discussed above related to user access and change management the following additional deficiency was identified: · The firm did not perform procedures to extend its conclusions regarding the existence and valuation of inventory assay results from the interim date in which the audit procedures were performed to year-end beyond obtaining and reviewing minutes from certain laboratory quality review meetings and the accompanying presentations. (AS 2301.45)

The firm's approach for substantively testing revenue consisted primarily of performing a software-assisted analysis to test the relationships among revenue accounts receivable and cash receipts. The reliability of the audit evidence obtained from this analysis was dependent upon the firm's testing of cash receipts data underlying the analysis. To test this data the firm agreed a sample of cash receipts to bank statements customer invoices and other documents such as packing lists delivery notes and transfer requests. The firm identified that certain cash receipts selected for testing did not relate to revenue and a corresponding receivable. The firm did not perform sufficient procedures to evaluate whether the cash receipts data was appropriate for use in the analysis because it did not evaluate the implications of these unrelated cash receipts on the sufficiency and appropriateness of the data. (AS 1105.10)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. As a result of the following deficiencies in the firm's testing of ITGCs over certain of these IT systems the firm's testing of these automated and IT-dependent controls was not sufficient. (AS 2201.46)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: The firm performed a review of the security settings in place over the issuer's accounting system using an unapproved custom software audit tool that included tests of privileged access password settings and client production settings. The firm identified certain exceptions involving the segregation of duties of two users who had administrator access to the system which enabled them to migrate changes into production. The firm also identified that the system's production environment had been opened multiple times during the year by these two users. The following deficiency was identified: · The firm did not determine the effect of the exception identified on the operating effectiveness of the user access controls over the system. (AS 2201.48)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: The firm performed a review of the security settings in place over the issuer's accounting system using an unapproved custom software audit tool that included tests of privileged access password settings and client production settings. The firm identified certain exceptions involving the segregation of duties of two users who had administrator access to the system which enabled them to migrate changes into production. The firm also identified that the system's production environment had been opened multiple times during the year by these two users. The following deficiency was identified: · The firm did not identify and test any controls over the appropriateness of the activity that the two privileged access users performed when opening the system's production environment. (AS 2201.39)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: The firm performed a review of the security settings in place over the issuer's accounting system using an unapproved custom software audit tool that included tests of privileged access password settings and client production settings. The firm identified certain exceptions involving the segregation of duties of two users who had administrator access to the system which enabled them to migrate changes into production. The firm also identified that the system's production environment had been opened multiple times during the year by these two users. The following deficiency was identified: · The firm did not perform any procedures to evaluate the reliability of the information produced from the custom software audit tool that was used to test the security settings of this system. (AS 1105.04 and .06)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: The firm selected for testing controls over the assignment of privileged access rights to certain other IT systems that consisted of management's review and approval of privileged access requests. The following deficiency was identified: · The firm did not identify and test any controls over the accuracy and completeness of the reports used in the operation of these controls. (AS 2201.39)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: The firm selected for testing controls over the assignment of privileged access rights to certain other IT systems that consisted of management's review and approval of privileged access requests. The following deficiency was identified: · The firm did not evaluate the specific review procedures that the control owners performed to determine whether access was appropriate and that the roles were adequately restricted or granted to users to prevent unauthorized and inappropriate access to these systems. (AS 2201.42 and .44)

The issuer used multiple information-technology (IT) systems to initiate process and record inventory and inventory-related transactions. In its testing of controls over inventory the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: The issuer's IT systems had development testing/quality assurance (QA) and production environments. Changes to the IT systems were typically tested in the testing environment prior to their migration to the production environment. Changes could however be made directly in the production environment in certain situations on an emergency basis. The firm performed a review of the security settings in place over certain of the issuer's accounting systems using an unapproved custom software audit tool that included tests of privileged access password settings and client production settings. The firm also selected for testing a control over user access to the production environment of these IT systems that consisted of (1) a security setting in these systems that would not allow any direct changes to be made in the production environment by any user and (2) management's review and approval of a system-generated report that listed any changes made to the system security settings. The following deficiency was identified: · The firm did not select for testing any instances in which the control over user access to the production environment of these IT systems operated because there were no changes made to the system security settings during the periods that were selected for testing. (AS 2201.42 and .44)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to change management: The firm selected for testing change management controls over certain IT systems that consisted of (1) the authorization of changes prior to development (2) testing and approval of changes prior to their migration into production and (3) the establishment of segregation of duties and the restriction of users with the ability to develop and migrate changes to production to authorized personnel. The firm did not perform procedures to test or test any controls over the completeness of the population of changes from which it made its selections for testing. (AS 1105.10)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to Revenue which was affected by the audit deficiencies related to user access and change management the following additional deficiency was identified: · The firm selected for testing a control that consisted of the issuer's review of price changes made in the accounting system as reflected in a customized system-generated report to determine whether they were properly approved. The firm did not identify and test any controls over the accuracy and completeness of the report used in the operation of the control. (AS 2201.39)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to Revenue which was affected by the audit deficiencies related to user access and change management the following additional deficiency was identified: · The firm selected for testing a control that consisted of the issuer's review of price changes made in the accounting system as reflected in a customized system-generated report to determine whether they were properly approved. The firm did not test an aspect of the control related to the issuer's review of certain price changes. (AS 2201.42 and .44)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to Revenue which was affected by the audit deficiencies related to user access and change management the following additional deficiency was identified: · The firm selected for testing an automated control that consisted of the configuration of the issuer's accounting system to automatically update invoiced sales prices to reflect those within the system's price list and used a 'test of one' approach to test the control. The firm did not perform sufficient procedures to support the use of such an approach because it did not test the configuration or programming of the control during the audit period or perform other procedures that would have provided sufficient appropriate audit evidence that the control was designed and operating effectively. (AS 2201.46)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to Revenue which was affected by the audit deficiencies related to user access and change management the following additional deficiency was identified: · The firm selected for testing controls that consisted of management's review and approval of printed sales orders. The firm did not perform procedures to test or test any controls over the completeness of the population of certain sales orders from which it made its selections for testing. (AS 1105.10)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to Revenue which was affected by the audit deficiencies related to user access and change management the following additional deficiency was identified: · The firm selected for testing controls that consisted of the reconciliation of revenue and inventory sold and management's review and approval of the reconciliations. The firm did not identify and test any controls over the accuracy and completeness of the reports used in the operation of these controls. (AS 2201.39)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to Revenue which was affected by the audit deficiencies related to user access and change management the following additional deficiency was identified: · The firm selected for testing an automated control that consisted of automatic interfaces between the issuer's accounting system and certain of its production and dispatch related systems and used a 'test of one' approach to test the control. The firm did not perform sufficient procedures to support the use of such an approach because it did not test the interface configuration or programming of the control or perform procedures to test the design of the control as it relates to each relevant interface. (AS 2201.46)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. The issuer used multiple IT systems to initiate process and record transactions related to revenue accounts receivable and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to Revenue which was affected by the audit deficiencies related to user access and change management the following additional deficiency was identified: · The firm's approach for substantively testing revenue consisted primarily of performing a software-assisted analysis to test the relationships among revenue accounts receivable and cash receipts. The reliability of the audit evidence obtained from this analysis was dependent upon the firm's testing of cash receipts data underlying the analysis. To test this data the firm reconciled certain cash activity used in the analysis to the respective cash accounts in the issuer's general ledger and agreed a sample of cash receipts to bank statements and customer remittance advices. The firm did not perform sufficient procedures to evaluate whether the cash receipts data was appropriate for use in the analysis because it (1) did not reconcile all cash activity used in the analysis to the respective cash accounts in the issuer's general ledger (2) made the majority of its cash receipts selections from the population of trade accounts receivable and unallocated receivable journal entries rather than the cash journal entries used in the analysis and (3) did not evaluate whether certain cash receipts selected for testing related to revenue and were appropriately included in the cash data underlying the analysis. (AS 1105.10)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. With respect to Accounts Receivable which was affected by the audit deficiencies related to user access and change management the following additional deficiency was identified: · The firm did not identify and test any controls over the posting of cash receipts to customer accounts and invoices. (AS 2201.39)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. With respect to Accounts Receivable which was affected by the audit deficiencies related to user access and change management the following additional deficiency was identified: · The firm selected for testing a control that consisted of the issuer's review and analysis of accounts receivable as reflected in a customized system-generated accounts receivable aging report. The firm did not evaluate whether the automated aspect of this control which consisted of the system's aging of customer account balances was configurable and programmable and if so perform procedures to test the configuration and programming of the control. (AS 2201.42)

The issuer used multiple information-technology (IT) systems to initiate process and record inventory and inventory-related transactions. In its testing of controls over inventory the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: The issuer's IT systems had development testing/quality assurance (QA) and production environments. Changes to the IT systems were typically tested in the testing environment prior to their migration to the production environment. Changes could however be made directly in the production environment in certain situations on an emergency basis. The issuer managed the provisioning of emergency privileged access rights which allowed users with such rights to make direct changes to the production environments of certain IT systems. The firm selected for testing controls over the assignment of privileged access rights for these systems that consisted of the system administrators' review and approval of privileged access requests. The following deficiency was identified: · The firm did not evaluate the specific review procedures that the control owners performed to assess the appropriateness of the provisioning and activity during the privileged access sessions to ensure that only approved activity was executed on these systems. (AS 2201.42 and .44)

The firm's internal inspection program had inspected this audit and reviewed certain of these areas but did not identify certain of the deficiencies below. With respect to Accounts Receivable which was affected by the audit deficiencies related to user access and change management the following additional deficiency was identified: · The firm selected for testing a control that consisted of the issuer's review and analysis of accounts receivable as reflected in a customized system-generated accounts receivable aging report. The firm did not perform procedures to test the accuracy and completeness of the reports and calculations produced by the system to determine whether the automated aspect of the control operated as it was designed. (AS 2201.44)

The following deficiency was identified: · The firm selected for testing a control that consisted of the configuration of the issuer's accounting system to automatically apply cash receipts to specific invoices and the manual investigation of outstanding items and unapplied cash receipts in the cash in-transit accounts. The firm did not test the automated aspect of this control related to the automatic application of cash receipts to specific invoices. (AS 2201.42 and .44)

The following deficiency was identified: · The firm selected for testing an automated control that consisted of the configuration of the issuer's accounting system to automatically record sales transactions based on revenue recognition triggers contained in the sales order and customer master files. The firm did not test whether the system accurately retrieved information from customer master files that was associated with the recorded sales. (AS 2201.42 and .44)

The following deficiency was identified: · The firm selected for testing a control that consisted of the reconciliation of goods invoiced to goods shipped and delivered. The firm did not perform procedures to test the design and operating effectiveness of this control. (AS 2201.42 and .44)

The following deficiency was identified: · The firm selected for testing a control that consisted of the issuer's verification of the shipment and delivery dates recorded in the accounting system to determine whether the transfer of title and recognition of revenue was based on accurate information. The firm did not identify and test any controls over the completeness of a customized system-generated report used in the operation of this control. (AS 2201.39)

The following deficiency was identified: · The firm selected for testing controls that consisted of the issuer's (1) use of revenue recognition triggers to consistently recognize revenue for each billing type (2) matching of sales invoices to documents supporting proof of delivery and transfer of title and (3) verification of the shipment and delivery dates recorded in the accounting system to determine whether the transfer of title and recognition of revenue was based on accurate information. The firm did not perform procedures to test or test any controls over the completeness of the population of a customized system-generated report from which it made its selections for testing. (AS 1105.10)

The firm selected for testing a control that consisted of the completion of impairment indicator surveys and the issuer's review and approval of impairment calculations and related testing. The firm did not evaluate the specific review procedures that the control owner performed to determine the accuracy and completeness of the consolidated impairment indicator questionnaires. (AS 2201.42 and .44)

The issuer used multiple information-technology (IT) systems to initiate process and record inventory and inventory-related transactions. In its testing of controls over inventory the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: The issuer's IT systems had development testing/quality assurance (QA) and production environments. Changes to the IT systems were typically tested in the testing environment prior to their migration to the production environment. Changes could however be made directly in the production environment in certain situations on an emergency basis. The issuer managed the provisioning of emergency privileged access rights which allowed users with such rights to make direct changes to the production environments of certain IT systems. The firm selected for testing controls over the assignment of privileged access rights for these systems that consisted of the system administrators' review and approval of privileged access requests. The following deficiency was identified: · For one control the firm did not perform sufficient procedures to test or test any controls over the completeness of the population of privileged access requests from which it made its selection for testing because the firm limited its selection to the population of active accounts of users with privileged access rights. (AS 1105.10)

The issuer used multiple information-technology (IT) systems to initiate process and record inventory and inventory-related transactions. In its testing of controls over inventory the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: The issuer's IT systems had development testing/quality assurance (QA) and production environments. Changes to the IT systems were typically tested in the testing environment prior to their migration to the production environment. Changes could however be made directly in the production environment in certain situations on an emergency basis. The issuer managed the provisioning of emergency privileged access rights which allowed users with such rights to make direct changes to the production environments of certain IT systems. The firm selected for testing controls over the assignment of privileged access rights for these systems that consisted of the system administrators' review and approval of privileged access requests. The following deficiency was identified: · The number of privileged access requests selected for testing did not provide sufficient appropriate audit evidence because the firm limited its selection to one account for one month and did not perform any procedures to test the effectiveness of the control over the remaining audit period. (AS 2201.46)

The issuer used multiple information-technology (IT) systems to initiate process and record inventory and inventory-related transactions. In its testing of controls over inventory the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: The issuer's IT systems had development testing/quality assurance (QA) and production environments. Changes to the IT systems were typically tested in the testing environment prior to their migration to the production environment. Changes could however be made directly in the production environment in certain situations on an emergency basis. Access to another IT system was controlled through the assignment of roles such as 'read-only ' 'edit ' and 'administrator ' to users for access to this system and related database for the accounting tables and modules. The firm selected for testing a control over user access to this system and related database that consisted of management's periodic review of a list of users with administrator roles to determine whether (1) the assignment of such roles was authorized (2) the access profiles were valid and (3) all manual changes made to the tables agreed to an approved change request. The following deficiency was identified: · The firm did not identify and test any controls over the accuracy and completeness of the reports used in the operation of the control. (AS 2201.39)

The issuer used multiple information-technology (IT) systems to initiate process and record inventory and inventory-related transactions. In its testing of controls over inventory the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to user access: The issuer's IT systems had development testing/quality assurance (QA) and production environments. Changes to the IT systems were typically tested in the testing environment prior to their migration to the production environment. Changes could however be made directly in the production environment in certain situations on an emergency basis. Access to another IT system was controlled through the assignment of roles such as 'read-only ' 'edit ' and 'administrator ' to users for access to this system and related database for the accounting tables and modules. The firm selected for testing a control over user access to this system and related database that consisted of management's periodic review of a list of users with administrator roles to determine whether (1) the assignment of such roles was authorized (2) the access profiles were valid and (3) all manual changes made to the tables agreed to an approved change request. The following deficiency was identified: · The firm did not evaluate the specific review procedures that the control owners performed to determine whether access was appropriate and that the roles were adequately restricted or granted to users to prevent unauthorized and inappropriate access to this system and related database. (AS 2201.42 and .44)

The issuer used multiple information-technology (IT) systems to initiate process and record inventory and inventory-related transactions. In its testing of controls over inventory the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. With respect to change management: The firm selected for testing change management controls over an IT system that consisted of the documentation review testing and approval of changes in the testing/QA environment prior to their migration into production. The firm did not obtain evidence that testing was performed and reviewed by the control owners for nearly half of the system changes selected for testing. (AS 2201.42 and .44)

For one of the locations the firm identified and tested a compensating control to address a control deficiency it identified related to access and the ability to make changes to the general ledger. This compensating control related to testing reviewing and approving changes prior to migration into the general ledger system. The firm did not evaluate the implications of one type of users' ability to modify certain information used in the operation of this control. (AS 2201.68)

In addition the sample sizes the firm used were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The issuer initiated and processed transactions related to sales accounts receivable and inventory at numerous business units using various IT systems. With respect to controls for these business units the firm selected for testing two entity-level controls that used information generated by the IT systems. The firm did not test IT general controls (“ITGCs”) over the IT systems for these business units or test any other controls over the accuracy and completeness of the information that was generated by the systems and that the issuer used in the performance of the entity-level controls. (AS 2201.39)

The firm's reliance on the entity-level controls discussed above to reduce its substantive procedures was unsupported. As a result its analytical procedures which consisted of comparisons of certain current-year account balances to corresponding prior-period balances to test revenue accounts receivable and inventory for these locations did not provide sufficient appropriate audit evidence. (AS 2301.08)

The firm did not identify and test any controls that addressed whether the inventory subsidiary ledgers for these business units accurately calculated inventory values using the correct item cost at year end. (AS 2201.39)

The firm did not identify and test any controls over the calculation of last-in first-out values for one category of inventory. (AS 2201.39)

The firm selected for testing a control that consisted of the issuer's review of the assumptions underlying the cash-flow forecasts used in the issuer's annual goodwill impairment assessment. The firm did not evaluate the review procedures that the control owners performed including the criteria that the control owners used to identify items for follow up and whether those items were appropriately resolved. (AS 2201.42 and .44)

The firm performed certain substantive procedures to evaluate the significant assumptions underlying the cash-flow forecasts but did not obtain sufficient appropriate audit evidence regarding the issuer's ability to carry out its cost-saving strategies to achieve these forecasts. (AS 2502.26 .28 .31 and .36)

The issuer recognized one type of revenue and the associated deferred revenue using certain customer rates and service dates recorded in the revenue system. The issuer recognized a second type of revenue and determined the asset retirement obligations (“ARO”) and asset retirement costs (“ARC”) using certain measurement information that was recorded in the revenue system. The firm identified various control deficiencies related to controls over both types of revenue and the deferred revenue and identified and tested four compensating controls that it believed mitigated these deficiencies. The following deficiencies were identified: · Two of the four compensating controls involved the review of certain revenue analyses. The firm did not evaluate the review procedures that the control owner performed to be able to conclude that the compensating controls mitigated identified control deficiencies. (AS 2201.68)

The issuer recognized one type of revenue and the associated deferred revenue using certain customer rates and service dates recorded in the revenue system. The issuer recognized a second type of revenue and determined the asset retirement obligations (“ARO”) and asset retirement costs (“ARC”) using certain measurement information that was recorded in the revenue system. The firm identified various control deficiencies related to controls over both types of revenue and the deferred revenue and identified and tested four compensating controls that it believed mitigated these deficiencies. The following deficiencies were identified: · In addition the firm did not identify and test any controls over the accuracy and completeness of certain information including the measurement information which the issuer used in the performance of these two controls. (AS 2201.68)

The issuer recognized one type of revenue and the associated deferred revenue using certain customer rates and service dates recorded in the revenue system. The issuer recognized a second type of revenue and determined the asset retirement obligations (“ARO”) and asset retirement costs (“ARC”) using certain measurement information that was recorded in the revenue system. The firm identified various control deficiencies related to controls over both types of revenue and the deferred revenue and identified and tested four compensating controls that it believed mitigated these deficiencies. The following deficiencies were identified: · The other two compensating controls involved the issuer's comparisons of the terms used to calculate revenue for a selection of transactions to supporting documentation. The firm did not evaluate whether these two controls sufficiently mitigated the identified control deficiencies given that these controls addressed only small portions of both types of revenue and the deferred revenue. (AS 2201.68)

For the other two locations the firm selected for testing three access controls that consisted of reviews of whether access to the general ledger system was appropriately restricted based on the system profiles. The firm did not evaluate whether the access provided through these profiles was appropriate based on users' functional needs. (AS 2201.42 and .44)

The issuer recognized one type of revenue and the associated deferred revenue using certain customer rates and service dates recorded in the revenue system. The issuer recognized a second type of revenue and determined the asset retirement obligations (“ARO”) and asset retirement costs (“ARC”) using certain measurement information that was recorded in the revenue system. The firm identified various control deficiencies related to controls over both types of revenue and the deferred revenue and identified and tested four compensating controls that it believed mitigated these deficiencies. The following deficiencies were identified: · The issuer identified errors in certain of the selected items it tested through the operation of one of the two compensating controls discussed directly above but the firm did not evaluate the implications of these errors on its opinion on the issuer's financial statements. (AS 2810.03)

With respect to the firm's testing of various controls over the second type of revenue the ARO and the ARC the firm did not identify and test any controls over the accuracy and completeness of certain information that was used in the operation of these controls. (AS 2201.39)

With respect to the firm's substantive testing of the second type of revenue the ARO and the ARC the firm used certain measurement information in its testing but did not perform any procedures to test the accuracy of this information. (AS 1105.10)

The firm did not identify and test any controls over the existence of one type of movable equipment. (AS 2201.39)

The firm did not perform sufficient substantive procedures related to the existence of two types of movable equipment because the firm's procedures were limited to (1) tracing an issuer-prepared roll-forward schedule for this equipment to the general ledger and (2) vouching a sample of equipment additions during the year to supporting documentation. (AS 2301.08)

The issuer estimated the general reserve component of the ALL using the following significant assumptions: (1) loan segmentation (2) probability of default (“PD”) (3) loss given default (“LGD”) and (4) loan risk ratings (“LRR”). The issuer used a model to derive the PD and LGD assumptions using current and historical loan data (“loan data”) contained in two data warehouses. The following deficiencies were identified: · The firm did not identify and test any controls that addressed the reasonableness of the loan segmentation PD and LGD assumptions. (AS 2201.39)