Explorer

As a result of the firm's control testing deficiencies discussed above the firm did not perform sufficient substantive procedures over revenue deferred revenue and accounts receivable as follows: · The firm did not perform procedures to test or sufficiently test controls over the completeness of certain reports the firm used in its substantive testing. (AS 1105.10)

As a result of the firm's control testing deficiencies discussed above the firm did not perform sufficient substantive procedures over revenue deferred revenue and accounts receivable as follows: · The sample sizes the firm used in certain of its substantive procedures were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

With respect to revenue and deferred revenue at certain other business units that the firm subjected to less extensive audit procedures the following deficiencies were identified: · The firm selected for testing a control that consisted of the issuer's reconciliation of the business unit-level financial data to its consolidated general ledger. The firm did not identify and test any controls over the accuracy and completeness of the business unit-level data that the control owners used in the operation of this control. (AS 2201.39)

With respect to revenue and deferred revenue at certain other business units that the firm subjected to less extensive audit procedures the following deficiencies were identified: · The firm did not perform any substantive procedures to test revenue and deferred revenue for these business units. (AS 2301.08)

The issuer recognized revenue from contracts with customers that included either standard or nonstandard terms. Certain contracts included an estimate of variable consideration in the transaction price. The following deficiencies were identified: · The firm selected for testing controls that included the issuer's identification and evaluation of contracts with nonstandard terms. The firm did not identify and test any controls over the completeness of certain information that the control owners used in the operation of these controls. (AS 2201.39) In connection with our review the issuer reevaluated its accounting for this revenue and concluded that a material misstatement existed that had not been previously identified. The issuer subsequently corrected this misstatement in a restatement of its financial statements and the firm revised and reissued its report on the financial statements. The issuer also reevaluated its controls over revenue and concluded that a material weakness existed that had not been previously identified. The issuer subsequently reflected this material weakness in a revision to its report on ICFR and the firm revised and reissued its report on the effectiveness of the issuer's ICFR to include this additional material weakness.

The issuer recognized revenue from contracts with customers that included either standard or nonstandard terms. Certain contracts included an estimate of variable consideration in the transaction price. The following deficiencies were identified: · The firm did not identify and test any controls over the issuer's accounting for variable consideration included in contracts with standard terms. (AS 2201.39) In connection with our review the issuer reevaluated its accounting for this revenue and concluded that a material misstatement existed that had not been previously identified. The issuer subsequently corrected this misstatement in a restatement of its financial statements and the firm revised and reissued its report on the financial statements. The issuer also reevaluated its controls over revenue and concluded that a material weakness existed that had not been previously identified. The issuer subsequently reflected this material weakness in a revision to its report on ICFR and the firm revised and reissued its report on the effectiveness of the issuer's ICFR to include this additional material weakness.

During the year the issuer received a one-time payment in connection with a contract modification that it recognized as revenue. The firm did not identify and evaluate that the issuer's accounting for this revenue was not in conformity with FASB ASC Topic 606 Revenue from Contracts with Customers. (AS 2810.30) In connection with our review the issuer reevaluated its accounting for this revenue and concluded that a material misstatement existed that had not been previously identified. The issuer subsequently corrected this misstatement in a restatement of its financial statements and the firm revised and reissued its report on the financial statements. The issuer also reevaluated its controls over revenue and concluded that a material weakness existed that had not been previously identified. The issuer subsequently reflected this material weakness in a revision to its report on ICFR and the firm revised and reissued its report on the effectiveness of the issuer's ICFR to include this additional material weakness.

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to revenue and the related deferred revenue. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. ·The firm selected for testing a control over the segregation of duties related to the ability to develop and implement changes to certain of these IT systems. The firm did not test whether users with the ability to implement code changes also had the ability to develop those changes. Further the firm did not test whether the ability to implement configuration changes was appropriately restricted to authorized users. (AS 2201.42 and .44) In connection with our review the issuer reevaluated its controls over revenue including IT controls and concluded that material weaknesses existed that had not been previously identified. The issuer subsequently reflected these material weaknesses in a revision to its report on ICFR and the firm revised and reissued its report on the effectiveness of the issuer's ICFR to include these additional material weaknesses.

The issuer used company-employed specialists to perform actuarial valuations of its insurance-related assets and liabilities including insurance reserves. With respect to the insurance-related liabilities recorded for certain insurance products the following deficiencies were identified: · The firm selected for testing certain IT-dependent manual controls over the data used to develop and record these insurance-related liabilities. The firm did not test the configuration or programming of certain queries that the issuer used to generate data used in the operation of these controls or perform other procedures to test these controls that would have provided sufficient appropriate audit evidence that these controls were designed and operating effectively. (AS 2201.42 and .44)

The issuer used company-employed specialists to perform actuarial valuations of its insurance-related assets and liabilities including insurance reserves. With respect to the insurance-related liabilities recorded for certain insurance products the following deficiencies were identified: · The firm selected for testing controls that consisted of the issuer's (1) reviews of the actuarial valuation methodologies assumptions and models and (2) recalculations of the insurance reserves for these products and review of these recalculations. The firm did not identify and test any controls over the accuracy and completeness of certain data that the control owners used in the operation of these controls. (AS 2201.39)

The issuer used company-employed specialists to perform actuarial valuations of its insurance-related assets and liabilities including insurance reserves. With respect to the insurance-related liabilities recorded for certain insurance products the following deficiencies were identified: · The firm selected for testing controls that consisted of the issuer's (1) reviews of the actuarial valuation methodologies assumptions and models and (2) recalculations of the insurance reserves for these products and review of these recalculations. The firm did not evaluate the specific review procedures that the control owners performed to assess the reasonableness of certain of these reserve recalculations. (AS 2201.42 and .44)

The issuer used company-employed specialists to perform actuarial valuations of its insurance-related assets and liabilities including insurance reserves. With respect to the insurance-related liabilities recorded for certain insurance products the following deficiencies were identified: · The firm did not test or sufficiently test controls over the accuracy and completeness of certain issuer-produced data that the company's specialists used to determine these actuarial valuations. (AS 1105.A8a)

The issuer used company-employed specialists to perform actuarial valuations of its insurance-related assets and liabilities including insurance reserves. With respect to the insurance-related liabilities recorded for certain insurance products the following deficiencies were identified: · The firm selected for testing controls that consisted of the issuer's comparisons and reviews of the current-period insurance reserves and related trends to the prior-period amounts. In evaluating the design of these controls the firm did not evaluate whether the thresholds that the control owners used to identify items for investigation were sufficiently precise to detect material misstatements. (AS 2201.42)

With respect to the insurance-related assets and liabilities recorded for certain other insurance products the following deficiencies were identified: · The firm selected for testing a control that included the issuer's reconciliations of loss experience data to its actuarial valuations which included the issuer's use of tools to transfer data and perform calculations. The firm did not sufficiently test the control attributes designed to address the accuracy of data transferred into these tools because the firm did not test whether these control attributes were designed to address and/or operated as designed for each relevant processing alternative. (AS 2201.42 and .44)

With respect to the insurance-related assets and liabilities recorded for certain other insurance products the following deficiencies were identified: · The firm selected for testing a control that included the issuer's reconciliations of loss experience data to its actuarial valuations which included the issuer's use of tools to transfer data and perform calculations. The firm did not identify and test any controls over the accuracy of the computations performed within these tools. (AS 2201.39)

With respect to the insurance-related assets and liabilities recorded for certain other insurance products the following deficiencies were identified: · The firm selected for testing a control that consisted of the issuer's review of the actuarial valuation methodologies and assumptions. The firm did not identify and test any controls over the accuracy and completeness of certain data that the control owners used in the operation of this control. (AS 2201.39)

With respect to the insurance-related assets and liabilities recorded for certain other insurance products the following deficiencies were identified: · The firm did not test or test any controls over the accuracy and/or completeness of certain issuer-produced data that the company's specialists used to determine these actuarial valuations. (AS 1105.A8a)

With respect to the insurance-related assets and liabilities recorded for certain other insurance products the following deficiencies were identified: · The firm selected for testing controls that consisted of the issuer's (1) recalculations of the insurance reserves for these products and review of these recalculations and (2) comparisons and reviews of the current-period insurance reserves and related trends to the prior-period amounts. The firm did not evaluate the specific review procedures that the control owners performed to investigate identified variances and determine whether items identified for follow up had been appropriately resolved. (AS 2201.42 and .44)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to revenue and the related deferred revenue. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. ·The firm selected for testing controls that consisted of the issuer's testing and approval of system changes prior to implementation into the production environment. In its testing of the operating effectiveness of certain of these controls the firm excluded certain types of changes from its testing population. (AS 2201.44) In connection with our review the issuer reevaluated its controls over revenue including IT controls and concluded that material weaknesses existed that had not been previously identified. The issuer subsequently reflected these material weaknesses in a revision to its report on ICFR and the firm revised and reissued its report on the effectiveness of the issuer's ICFR to include these additional material weaknesses.

With respect to the insurance-related assets and liabilities recorded for certain other insurance products the following deficiencies were identified: · The firm did not perform substantive procedures to test whether the issuer had appropriately calculated the gross amounts of these insurance-related assets and liabilities that were presented in the issuer's financial statements. (AS 2301.08)

The issuer used a service organization to perform recordkeeping and processing of transactions for certain investment securities. The firm sent positive confirmation requests to the custodians for these investment securities but did not evaluate the nature of exceptions between the securities amounts included in the confirmation replies and the securities amounts that the issuer recorded. (AS 2310.33)

The issuer performed its annual goodwill impairment assessment as of an interim date. The following deficiencies were identified: · The firm selected for testing controls that included the issuer's assessment of triggering events between its annual assessment date and year end. The firm did not evaluate whether the controls were designed to address whether certain adverse market conditions and deteriorating financial results that arose before year end would have required an impairment test as of year end. (AS 2201.42)

The issuer performed its annual goodwill impairment assessment as of an interim date. The following deficiencies were identified: · The firm did not sufficiently evaluate the issuer's determination that it did not need to test goodwill for impairment between its annual assessment and year end because it did not identify that the issuer's evaluation did not consider these adverse market conditions and deteriorating financial results that arose before year end. (AS 2301.08)

The firm's testing of certain automated controls over revenue at these business units was not sufficient because the firm did not test the configuration or programming of these controls or perform other procedures to test these controls that would have provided sufficient appropriate audit evidence that these controls were designed and operating effectively. (AS 2201.42 and .44)

For the first business unit the firm identified control deficiencies related to the issuer's review of sales prices that were applied to certain customer orders and used to recognize revenue. The firm identified and tested various compensating controls that it believed would mitigate these deficiencies. The firm did not identify that these compensating controls did not address the risk of material misstatement related to the accuracy of these sales prices. (AS 2201.68)

For the second business unit the firm selected for testing a control that consisted of the issuer's comparison of sales prices invoiced to the customer order. For electronically received customer orders the firm did not identify and test any controls over the accuracy of the data included in the customer orders that were used in the operation of the control. (AS 2201.39)

For the second business unit the firm selected for testing a control that consisted of the issuer's comparison of sales prices invoiced to the customer order. For manually received customer orders the firm did not assess the effect of the same individual both entering and reviewing the sales prices in evaluating the design of the control. (AS 2201.42)

The issuer performed cycle counts of inventory held at one of its locations. The issuer used a service organization to host and maintain an IT system that was used in its cycle-count procedures. The firm did not obtain an understanding of and test any relevant controls at this service organization. (AS 2201.39 and .B19)

Due to the deficiency discussed above the firm did not obtain sufficient appropriate audit evidence that the cycle-count procedures that the issuer used for this inventory were sufficiently reliable to produce results substantially the same as those that would have been obtained by a count of all items each year. (AS 2510.11)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to revenue and the related deferred revenue. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. ·The firm selected for testing controls that consisted of the issuer's testing and approval of system changes prior to implementation into the production environment. For certain other of these controls the firm did not test or test any controls over the completeness of the population of items from which it selected its sample for testing. (AS 1105.10) In connection with our review the issuer reevaluated its controls over revenue including IT controls and concluded that material weaknesses existed that had not been previously identified. The issuer subsequently reflected these material weaknesses in a revision to its report on ICFR and the firm revised and reissued its report on the effectiveness of the issuer's ICFR to include these additional material weaknesses.

For one of the issuer's business units the firm selected for testing a control that consisted of the control owner's review of a selection of journal entries for appropriateness. When evaluating the design of this control the firm did not evaluate the number of items the control owner reviewed to assess whether it was sufficient to address the risks of material misstatement. (AS 2201.42)

The issuer recorded revenue net of customer rebates and chargebacks. The issuer estimated its accrued rebates and chargebacks using significant assumptions that were based in part on forecasts of expected future sales rebates and chargebacks. The following deficiencies were identified: · The firm selected for testing various controls that included the issuer's reviews of the significant assumptions used to develop these accruals. The firm did not evaluate the specific review procedures that the control owners performed to assess the reasonableness of the underlying forecasts. (AS 2201.42 and .44)

The issuer recorded revenue net of customer rebates and chargebacks. The issuer estimated its accrued rebates and chargebacks using significant assumptions that were based in part on forecasts of expected future sales rebates and chargebacks. The following deficiencies were identified: · The firm selected for testing various controls that included the issuer's reviews of the significant assumptions used to develop these accruals. The firm did not identify and test any controls over the accuracy and completeness of certain issuer-produced data and reports used in the operation of two of these controls. (AS 2201.39)

The issuer recorded revenue net of customer rebates and chargebacks. The issuer estimated its accrued rebates and chargebacks using significant assumptions that were based in part on forecasts of expected future sales rebates and chargebacks. The following deficiencies were identified: · The firm's approach for substantively testing accrued rebates and chargebacks was to test the issuer's process. The firm did not perform sufficient procedures to evaluate the reasonableness of the significant assumptions used to develop these accruals because the firm did not evaluate the reasonableness of the underlying forecasts. (AS 2501.16)

The issuer recorded revenue net of customer rebates and chargebacks. The issuer estimated its accrued rebates and chargebacks using significant assumptions that were based in part on forecasts of expected future sales rebates and chargebacks. The following deficiencies were identified: · The firm used certain issuer-produced data and reports in its testing of accrued rebates and chargebacks but did not test or test any controls over the accuracy and completeness of these data and reports. (AS 1105.10)

The issuer used an IT system to initiate process and record transactions related to revenue and related accounts including accrued sales rebates and chargebacks. The firm selected for testing a control that included the issuer's reviews of changes made to this IT system through administrative user access. The firm did not evaluate the specific review procedures that the control owners performed to assess whether users performed appropriate actions when granted this access. (AS 2201.42 and .44)

In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by this IT system. As a result of the above deficiency in the firm's testing of ITGCs the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

The sample size that the firm used in certain of its substantive procedures to test accrued rebates was too small to provide sufficient appropriate evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's ITGC testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The issuer developed the quantitative reserve component of the ACL using a model that was maintained by a service organization. The following deficiencies were identified: · The firm obtained a service auditor's report but did not evaluate whether this auditor's report provided sufficient appropriate audit evidence because the firm did not assess certain controls that the service auditor tested and how those controls related to the issuer's controls over the quantitative component of the ACL. (AS 2201.B21)

The issuer developed the quantitative reserve component of the ACL using a model that was maintained by a service organization. The following deficiencies were identified: · The firm did not identify and test any controls over the issuer's ongoing assessment and monitoring of the predictability and effectiveness of this ACL model. (AS 2201.39)

The issuer used multiple information-technology (IT) systems to initiate process and record transactions related to revenue and the related deferred revenue. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by these IT systems. ·The firm selected for testing controls over the issuer's monitoring of system changes. The firm did not identify and test any controls over the accuracy and completeness of certain reports that the issuer used in the operation of these controls. (AS 2201.39) In connection with our review the issuer reevaluated its controls over revenue including IT controls and concluded that material weaknesses existed that had not been previously identified. The issuer subsequently reflected these material weaknesses in a revision to its report on ICFR and the firm revised and reissued its report on the effectiveness of the issuer's ICFR to include these additional material weaknesses.

The firm selected for testing a control that consisted of the control owner's reperformance of certain ACL calculations. The number of instances that the firm selected for testing this control did not provide sufficient appropriate audit evidence given the frequency with which this control operated. (AS 2201.46)

The issuer determined the qualitative reserve component of the ACL using various qualitative factors. The firm's approach for substantively testing the ACL was to test the issuer's process. The firm did not evaluate whether the issuer had a reasonable basis for the significant assumptions that the issuer used to develop certain of these qualitative factors. (AS 2501.16)

During the year the issuer acquired a business. The issuer assigned certain acquired loans a risk rating which was a significant assumption in estimating the fair value of the acquired loans. The following deficiencies were identified: · The firm selected for testing a control that consisted of the issuer's review of the credit quality of these acquired loans including the assigned loan risk ratings. The firm did not evaluate the specific review procedures that the control owners performed to assess the reasonableness of the assigned loan risk ratings. (AS 2201.42 and .44)

During the year the issuer acquired a business. The issuer assigned certain acquired loans a risk rating which was a significant assumption in estimating the fair value of the acquired loans. The following deficiencies were identified: · The firm's approach for substantively testing the valuation of these acquired loans was to test the issuer's process. The firm selected a sample of acquired loans for testing. The firm did not evaluate whether the issuer had a reasonable basis for the assigned loan risk ratings for these acquired loans. (AS 2501.16)

The issuer used an IT system to initiate process and record transactions related to certain revenue and accounts receivable. The firm selected for testing controls that included the issuer's reviews of changes made to this IT system through administrative user access. When testing the design and operating effectiveness of these controls the firm did not evaluate (1) certain criteria that the control owners used to determine which types of changes would be subject to the issuer's reviews and (2) whether the control owners' review of only certain types of system changes and permissions was sufficient to address the risk that unauthorized changes were made. (AS 2201.42 and .44)

In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data or reports generated or maintained by this IT system. As a result of the above deficiency in the firm's testing of ITGCs the firm's testing of these automated and IT-dependent controls was not sufficient. (AS 2201.46)

The sample sizes that the firm used in certain of its substantive procedures to test this revenue and accounts receivable were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to (1) the deficiencies in the firm's control testing discussed above and/or (2) the firm not taking into account that the controls it relied upon were not designed and operating effectively during the entire period of reliance. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The firm selected for testing a control at one of the issuer's locations that consisted of the issuer's review of source documentation prior to processing customer invoices and credit memos. The firm did not test or test any controls over the completeness of the population of items from which it selected its samples for testing this control. (AS 1105.10)

The firm selected for testing a control at one of the issuer's locations that consisted of the issuer's review of source documentation prior to processing customer invoices and credit memos. The number of credit memos that the firm selected for testing did not provide sufficient appropriate evidence given the frequency with which the control operated. (AS 2201.46)