Explorer

During the year the issuer acquired a business and determined the fair value of certain acquired intangible assets using cash-flow forecasts. The following deficiency was identified: · The firm's approach for substantively testing the valuation of these acquired intangible assets was to test the issuer's process. The firm did not sufficiently evaluate the reasonableness of certain significant assumptions used in these cash-flow forecasts because its procedures were limited to inquiring of management and for one of these assumptions comparing the current-year forecasted results to actual results. (AS 2501.16)

The issuer used an IT system to retain certain data related to revenue and deferred revenue. The firm did not identify and test any controls that addressed the risk that inappropriate changes could be made to the data in this IT system. (AS 2201.39)

During the year the issuer entered into and disclosed transactions with related parties. The issuer conducted surveys of directors and officers of the company in determining its related parties and relationships and transactions with related parties. The following deficiency was identified: · The firm selected for testing controls that included the issuer's reviews of these surveys and its related party listing. The firm did not evaluate the specific review procedures that the control owner performed to assess (1) whether related parties were properly identified and evaluated and (2) the completeness of certain information used in the operation of these controls. (AS 2201.42 and .44)

During the year the issuer entered into and disclosed transactions with related parties. The issuer conducted surveys of directors and officers of the company in determining its related parties and relationships and transactions with related parties. The following deficiency was identified: · The firm selected for testing controls that included the issuer's reviews of these surveys and its related party listing. In testing the operating effectiveness of these controls the firm did not evaluate whether the control owner identified and addressed certain differences between the issuer's survey results and its related party listing. (AS 2201.44)

During the year the issuer entered into and disclosed transactions with related parties. The issuer conducted surveys of directors and officers of the company in determining its related parties and relationships and transactions with related parties. The following deficiency was identified: · The firm did not sufficiently evaluate whether the issuer had properly identified and evaluated its related parties and relationships and transactions with related parties because the firm did not take into account whether the issuer had evaluated certain information including differences between its survey results and related party listing. (AS 2410.14)

During the audit the firm did not identify and evaluate that the issuer's accounting for certain transactions as revenue was not in conformity with FASB ASC Topic 840 Leases. (AS 2810.30) Unrelated to our review the issuer reevaluated its accounting for these transactions and concluded that a material misstatement existed that had not been previously identified. The issuer subsequently corrected this misstatement in a restatement of its financial statements and the firm revised and reissued its report on the financial statements.

The issuer recognized one type of revenue from arrangements with related parties that provided for the reimbursement of certain costs that the issuer incurred. The firm identified a fraud risk related to the issuer's allocation of costs to these arrangements. For these costs the firm did not perform a test of details to address this fraud risk. (AS 2301.13)

During the year the issuer entered into an amendment to an existing lease agreement. The firm did not identify and evaluate that the issuer's accounting for this lease amendment was not in conformity with FASB ASC Topic 842 Leases. (AS 2810.30)

The issuer recognized certain revenue from contracts based on labor hours recorded in the issuer's time system. The firm used these labor hours in its substantive testing of this revenue but did not test or test any controls over the accuracy and completeness of these labor hours. (AS 1105.10)

The issuer used an IT system to retain certain data related to revenue and deferred revenue. The firm selected for testing a control that included the issuer's review of the configuration of the tool the issuer used to transfer data into this IT system. The firm did not evaluate the specific review procedures that the control owners performed to assess the configuration of this tool. (AS 2201.42 and .44)

The issuer used an IT system to retain certain data related to revenue and deferred revenue. The firm selected for testing a control that included the issuer's review of the configuration of the tool the issuer used to transfer data into this IT system. In evaluating the design of this control the firm did not assess whether the issuer's review occurred with sufficient frequency to address the risks of material misstatement. (AS 2201.42)

For certain revenue and deferred revenue the firm did not perform procedures to test or sufficiently test controls over the accuracy and/or completeness of certain system-generated data or reports the firm used in its substantive testing including substantive analytical procedures. (AS 1105.10; AS 2305.16)

Certain of the issuer's revenue arrangements included multiple performance obligations. The issuer allocated the total transaction price for each of these arrangements to the separate performance obligations based on the issuer's estimate of the relative standalone selling prices. The firm performed substantive procedures to test the accuracy of certain issuer-produced data the firm used in its testing of the relative standalone selling prices. The sample sizes the firm used in these substantive procedures were smaller than the ones the firm determined necessary to provide sufficient appropriate audit evidence. (AS 1105.10)

The issuer recognized certain of this revenue based on the date when electronic delivery occurred. The firm did not identify and test any controls over the accuracy of these delivery dates. (AS 2201.39)

With respect to three of the issuer's business units the following deficiency was identified: The firm's testing of certain automated controls over revenue and accounts receivable was not sufficient because the firm did not test the configuration or programming of these controls or perform other procedures that would have provided sufficient appropriate audit evidence that these controls were designed and operating effectively. (AS 2201.46)

For two of these business units the firm selected for testing a control that included the issuer's reviews of adjustments to the contract prices that were used to recognize revenue. The following deficiency was identified: · For the first business unit when evaluating the design of the control the firm did not evaluate (1) the criteria the control owners used to identify items for follow-up and (2) the number of items the control owner reviewed to assess whether it was sufficient to address the risk of material misstatement. (AS 2201.42)

For two of these business units the firm selected for testing a control that included the issuer's reviews of adjustments to the contract prices that were used to recognize revenue. The following deficiency was identified: · For the second business unit the firm did not identify and test any controls over the completeness of the report the control owners used in the operation of this control. (AS 2201.39)

The issuer used multiple information-technology (IT) systems to initiate process and/or record transactions related to revenue and the related accounts receivable investment securities and cash. With respect to change management: · For certain IT systems the firm selected for testing controls that included the issuer's review of changes to these IT systems. For certain of these IT systems the firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. Further the firm did not determine whether the control owners possessed the necessary competence to perform these controls. (AS 2201.42 and .44)

For two of these business units the firm selected for testing controls over contract pricing but did not perform any substantive procedures to test or test any controls over the completeness of the population of items from which it selected its samples for testing. (AS 1105.10)

The sample size the firm used in certain of its substantive procedures to test accounts receivable was too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The firm's approach for substantively testing revenue consisted primarily of performing a software-assisted analysis to test the relationships among revenue accounts receivable and cash receipts. The firm's approach to addressing the reliability of the audit evidence obtained from this type of analysis was dependent upon the firm's tests of details of certain data underlying the analysis. The sample sizes the firm used in certain of these tests of details were smaller than the ones the firm determined necessary for these procedures. (AS 1105.10)

The issuer used multiple IT systems to initiate process and record transactions related to this inventory. In its testing of controls over this account the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. The firm did not identify and test any controls that addressed the risk that unauthorized changes were made to the databases that supported certain of these systems. (AS 2201.39)

The issuer used multiple IT systems to initiate process and record transactions related to this inventory. In its testing of controls over this account the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. The firm did not identify and test any controls that addressed the risk that unauthorized changes were made to the databases that supported certain of these systems. As a result of this deficiency in the firm's testing of ITGCs the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

The firm selected for testing controls over the transfers of data between certain of the issuer's inventory systems and the general ledger. The firm did not identify and test any controls over the accuracy and completeness of certain reports used in the operation of these controls. (AS 2201.39)

The firm selected for testing certain automated controls over this inventory. The firm's testing of only one instance of these automated controls was not sufficient because the firm did not test the programming of these controls or perform other procedures that would have provided sufficient appropriate audit evidence that these controls were designed and operating effectively. (AS 2201.46)

As a result of the firm's control testing deficiencies the firm did not perform sufficient substantive procedures over this inventory as follows: · The firm's substantive procedures to test this inventory included substantive analytical procedures. The firm established its thresholds for investigating differences based on a level of control reliance that was not supported. As a result the thresholds that the firm used did not provide the desired level of assurance that misstatements that could have been material would be identified. (AS 2301.16 .18 and .37; AS 2305.20)

As a result of the firm's control testing deficiencies the firm did not perform sufficient substantive procedures over this inventory as follows: · The firm did not perform sufficient procedures to test or sufficiently test controls over the accuracy and completeness of certain system-generated data or reports the firm used in its substantive testing including substantive analytical procedures. (AS 1105.10; AS 2305.16)

The issuer used cash-flow forecasts to evaluate whether any impairment indicators existed for certain long-lived assets. The firm selected for testing two controls that consisted of the issuer's reviews of (1) the methodology it used to prepare these cash-flow forecasts and (2) certain of these cash-flow forecasts. The firm did not evaluate the specific review procedures that the control owners performed to assess the reasonableness of certain assumptions the issuer used in these cash-flow forecasts. (AS 2201.42 and .44)

The issuer used multiple information-technology (IT) systems to initiate process and/or record transactions related to revenue and the related accounts receivable investment securities and cash. With respect to change management: · For another IT system the firm selected for testing controls over change management but did not perform procedures to test or test any controls over the completeness of the population of items from which it selected its samples for testing. (AS 1105.10)

The issuer used cash-flow forecasts to evaluate whether any impairment indicators existed for certain long-lived assets. The firm selected for testing two controls that consisted of the issuer's reviews of (1) the methodology it used to prepare these cash-flow forecasts and (2) certain of these cash-flow forecasts. When evaluating the design of the second control the firm did not evaluate the number of items the control owner reviewed to assess whether it was sufficient to address the risks of material misstatement. (AS 2201.42)

With respect to one type of revenue and the related deferred revenue the following deficiency was identified: · The issuer recognized certain of this revenue using contractual rates input into the system the issuer used to recognize revenue. The firm did not identify and test any controls over the accuracy of these contractual rates. (AS 2201.39)

With respect to one type of revenue and the related deferred revenue the following deficiency was identified: · The firm selected for testing a control over the automated calculation of certain of this revenue. The firm did not test whether this control operated as designed for each relevant processing alternative. (AS 2201.44)

With respect to one type of revenue and the related deferred revenue the following deficiency was identified: · The firm selected for testing controls related to the issuer's allocation of certain transactions between this revenue and the related deferred revenue. For two of these controls the firm did not evaluate the specific review procedures that the control owners performed to assess the appropriateness of this allocation. (AS 2201.42 and .44)

With respect to one type of revenue and the related deferred revenue the following deficiency was identified: · The firm selected for testing controls related to the issuer's allocation of certain transactions between this revenue and the related deferred revenue. For a third control the firm did not identify and test any controls over the accuracy and completeness of certain data that the control owner used in the operation of the control. (AS 2201.39)

With respect to one type of revenue and the related deferred revenue the following deficiency was identified: · The firm's approach for substantively testing this revenue consisted primarily of performing a software-assisted analysis to test the relationships among revenue accounts receivable and cash receipts. The firm's approach to addressing the reliability of the audit evidence obtained from this type of analysis was dependent upon the firm's testing of certain data underlying the analysis. The firm did not sufficiently test this underlying data because for certain cash selections the firm did not evaluate whether the cash receipts related to this revenue. (AS 1105.10)

With respect to a second type of revenue and the related deferred revenue the following deficiency was identified: · The firm selected for testing controls that consisted of the issuer's reviews of this revenue and the related deferred revenue. The firm did not identify and test any controls over the accuracy of certain data and reports that the control owners used in the operation of these controls. (AS 2201.39)

With respect to a second type of revenue and the related deferred revenue the following deficiency was identified: · The sample size that the firm used in certain of its substantive procedures to test this deferred revenue was too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiency in the firm's control testing discussed above (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

For these two types of deferred revenue the firm used certain reports in its substantive testing but did not perform any procedures to test or test any controls over the accuracy of these reports. (AS 1105.10)

With respect to a third type of revenue the firm's substantive procedures included performing substantive analytical procedures. The threshold that the firm established to investigate differences was too high to identify misstatements that could be material either individually or in the aggregate. (AS 2305.20)

The issuer used multiple information-technology (IT) systems to initiate process and/or record transactions related to revenue and the related accounts receivable investment securities and cash. With respect to user access: · The issuer used tools to manage user access to certain IT systems. The firm selected for testing controls over user access for these IT systems but did not test whether user access to certain of these IT systems was appropriately granted based on the permissions defined in these tools. (AS 2201.44)

With respect to a third type of revenue the firm's substantive procedures included performing substantive analytical procedures. The firm identified certain differences in excess of the firm's established threshold but did not obtain any evidential matter to corroborate the differences. (AS 2305.21)

The issuer used multiple IT systems to initiate process and record transactions related to certain revenue and the related accounts receivable. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. As a result of the deficiencies in the firm's testing of ITGCs the firm's testing of these automated and IT-dependent controls was not sufficient. (AS 2201.46)

The issuer used multiple IT systems to initiate process and record transactions related to certain revenue and the related accounts receivable. · The firm selected for testing controls that consisted of the issuer's reviews of new user access and changes made to its production environment for these IT systems. The number of items the firm selected for testing did not provide sufficient appropriate audit evidence given the frequency with which the control operated. (AS 2201.46)

The issuer used multiple IT systems to initiate process and record transactions related to certain revenue and the related accounts receivable. · The firm selected for testing a control over the periodic review of user access for each of these IT systems. The firm did not identify and test any controls over the accuracy and completeness of certain information included in manually prepared spreadsheets that the control owners used in the operation of this control. (AS 2201.39)

The firm's testing of certain automated controls over this revenue and accounts receivable was not sufficient because the firm did not test the configuration or programming of these controls or perform other procedures that would have provided sufficient appropriate audit evidence that these controls were designed and operating effectively. (AS 2201.46)

For certain revenue which was affected by the audit deficiencies discussed above the following additional deficiencies related to the firm's testing of controls were identified: · The firm selected for testing controls over certain of this revenue that consisted of the issuer's reviews of financial results. The firm did not evaluate whether the design of these controls was sufficiently precise to detect material misstatements. (AS 2201.42)

For certain revenue which was affected by the audit deficiencies discussed above the following additional deficiencies related to the firm's testing of controls were identified: · The firm selected for testing three IT-dependent manual controls over the processing of certain customer orders and invoices. For two of these controls the firm did not identify and test any controls over the accuracy and completeness of certain data used in the operation of these controls. (AS 2201.39)

For certain revenue which was affected by the audit deficiencies discussed above the following additional deficiencies related to the firm's testing of controls were identified: · The firm selected for testing three IT-dependent manual controls over the processing of certain customer orders and invoices. For the third control the firm's testing of controls over the accuracy and completeness of a report used in the operation of this control using a sample of only one instance was not sufficient because the firm did not test whether changes to configurations within these controls were subject to effective ITGCs over these IT systems. (AS 2201.46)

For certain revenue which was affected by the audit deficiencies discussed above the following additional deficiencies related to the firm's testing of controls were identified: · The firm did not test or test any controls over the completeness of the system-generated reports that it used to make selections for testing certain controls over this revenue. (AS 1105.10)

The sample size the firm used in certain of its substantive procedures to test accounts receivable was too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)