Explorer

The issuer used multiple IT systems to initiate process and/or record transactions related to certain revenue deferred revenue and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. As a result of the following deficiency in the firm's testing of ITGCs the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46)

With respect to change management: The firm selected for testing a change management control over certain IT systems that consisted of the documentation review testing and approval of changes prior to their migration into production. The firm did not perform procedures to test or test any controls over the completeness of the population of changes from which it made its selections for testing. (AS 1105.10)

As a result of the firm's ITGC testing deficiency discussed above the firm did not perform sufficient substantive procedures as follows: · The firm used certain system-generated data to substantively test deferred revenue long-lived assets and certain revenue but did not test or (as discussed above) sufficiently test controls over the accuracy and completeness of this data. (AS 1105.10)

With respect to change management: The firm selected for testing a change management control over certain IT systems that consisted of the documentation review testing and approval of changes prior to their migration into production. The firm did not perform procedures to test or test any controls over the completeness of the population of changes from which it made its selections for testing. (AS 1105.10)

As a result of the firm's ITGC testing deficiency discussed above the firm did not perform sufficient substantive procedures as follows: · The firm performed substantive analytical procedures as part of its testing of certain revenue and depreciation expense. The firm used certain system-generated data to develop its expectations but did not test or (as discussed above) sufficiently test controls over the accuracy and completeness of this data. (AS 2305.16)

As a result of the firm's ITGC testing deficiency discussed above the firm did not perform sufficient substantive procedures as follows: · The sample size the firm used in certain of its substantive procedures to test revenue and long-lived assets was too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiency in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The principal auditor instructed the firm to perform specific substantive procedures to address the identified risks of material misstatement related to revenue. The firm did not perform sufficient substantive procedures to test revenue because the firm did not perform certain procedures for each transaction selected for testing and did not perform certain other procedures that it was instructed to perform. (AS 2301.08)

As instructed by the principal auditor the firm selected for testing controls that consisted of the performance of physical inventory counts a reconciliation of those counts to the inventory records and the adjustment of those records as appropriate. The firm did not perform sufficient procedures to test the operating effectiveness of these controls because the firm did not test the aspect of the control involving the performance of the physical inventory counts performed during the operation of these controls. (AS 2201.44)

The issuer derives revenue through consolidated variable interest entities (VIEs) and relies on contractual arrangements with the VIEs and their shareholders to control the business operations of the consolidated VIEs. The issuer engaged an external specialist to provide a legal opinion regarding the issuer's consolidated VIEs including the validity and enforceability of contractual arrangements with the VIEs and their shareholders. The firm did not identify and test any controls over the identification and monitoring of events requiring a reassessment of VIEs as a reconsideration event under FASB ASC Topic 810 Consolidation. (AS 2201.39)

The issuer derives revenue through consolidated VIEs and relies on contractual arrangements with the VIEs and their shareholders to control the business operations of the consolidated VIEs. The issuer engaged an external specialist to provide a legal opinion regarding the issuer's consolidated VIEs including the validity and enforceability of contractual arrangements with the VIEs and their shareholders. The firm did not perform substantive procedures to evaluate whether reconsideration events under FASB ASC Topic 810 had occurred requiring a reassessment of the VIEs beyond obtaining and reading the legal opinion prepared by the company's specialist. Further the firm did not perform any procedures to use the work of the company's specialist as audit evidence. (AS 1105.A1 - .A10; AS 2301.08)

With respect to user access: The firm selected for testing user access controls over certain IT systems that consisted of (1) restricting access to implement program and/or configuration changes to authorized IT personnel with no development responsibilities (2) the approval of privileged system access for all layers based on the user's position and duties and (3) the removal of system access in a timely manner. The following deficiencies were identified: · The firm did not perform procedures to test or test any controls over the accuracy and completeness of the data from which it made its selections to test controls one and two. (AS 1105.10)

With respect to user access: The firm selected for testing user access controls over certain IT systems that consisted of (1) restricting access to implement program and/or configuration changes to authorized IT personnel with no development responsibilities (2) the approval of privileged system access for all layers based on the user's position and duties and (3) the removal of system access in a timely manner. The following deficiencies were identified: · The firm also did not perform sufficient procedures to test the operating effectiveness of control two because its procedures were limited to testing one instance of the control's operation for each layer. (AS 2201.46)

With respect to user access: The firm selected for testing user access controls over certain IT systems that consisted of (1) restricting access to implement program and/or configuration changes to authorized IT personnel with no development responsibilities (2) the approval of privileged system access for all layers based on the user's position and duties and (3) the removal of system access in a timely manner. The following deficiencies were identified: · The firm did not perform sufficient procedures to test control three because the firm did not perform procedures to understand the specific timing in which access was to be removed and test whether access was removed within this timeframe. (AS 2201.42 and .44)

The firm identified deficiencies in the design and operating effectiveness of other user access controls for certain of the issuer's IT systems. The firm identified and tested controls that it believed would mitigate the deficiencies. The firm did not identify that these controls did not address the risks that (1) user access or privileged access may be granted to unauthorized users and (2) inappropriate access may be granted to users. Further the firm did not test the design and operating effectiveness of one compensating control for certain of these IT systems. (AS 2201.68)

As a result of the firm's ITGC testing deficiencies discussed above the firm did not perform sufficient substantive procedures as follows: · The firm used certain system-generated data to substantively test certain liabilities unearned revenue and long-lived assets but did not test or (as discussed above) sufficiently test controls over the accuracy and completeness of this data. (AS 1105.10)

As a result of the firm's ITGC testing deficiencies discussed above the firm did not perform sufficient substantive procedures as follows: · The firm performed substantive analytical procedures as part of its testing of certain revenue. The firm used certain system-generated data to develop its expectations but did not test or (as discussed above) sufficiently test controls over the accuracy and completeness of this data. (AS 2305.16)

With respect to Revenue which was affected by the audit deficiencies related to change management and user access the following additional deficiencies were identified: · For certain revenue the firm selected for testing controls that consisted of the (1) reconciliation and review of certain data used to recognize revenue and (2) reconciliation and review of billed amounts prior to the recording of revenue. For the items selected for testing the firm did not test the management review aspects of these controls involving the review of (1) data used to recognize revenue and (2) billed amounts prior to the recording of revenue. (AS 2201.44)

The firm selected for testing a control that consisted of the issuer's review of depreciation expense. The firm did not evaluate the specific review procedures the control owner performed to assess the appropriateness of the methods the issuer used to calculate depreciation. (AS 2201.42 and .44)

The firm selected for testing a control that consisted of the issuer's review of depreciation expense. The firm did not identify and test any controls over the accuracy and completeness of certain data used in the operation of this control. (AS 2201.39)

The firm selected for testing another control that consisted of the issuer's review of fixed assets not being depreciated per the issuer's fixed asset register to identify any assets that should be depreciated. The firm did not identify and test any controls over the accuracy and completeness of the data included within the fixed asset register used in the operation of this control. (AS 2201.39)

The firm used the issuer's fixed asset register in its substantive testing of depreciation expense and accumulated depreciation. The firm did not test or (as discussed above) test controls over the accuracy and completeness of the information included in the fixed asset register. (AS 1105.10)

The firm selected for testing a control that consisted of the issuer's review and approval of an authorization for expenditure form for the acquisition of long-lived assets. The firm did not identify and test any controls that addressed whether long-lived assets were appropriately capitalized. (AS 2201.39)

The firm selected for testing another control that consisted of the issuer's review of manual recalculations of depreciation expense and a comparison of those amounts to the depreciation expense calculated by the issuer's fixed asset register. The firm did not identify and test any controls over the accuracy and completeness of certain data used in the operation of this control. (AS 2201.39)

The issuer closed its books and records prior to its calendar year end and did not record certain transactions that occurred between the closing date and year end. The firm did not identify and appropriately address that the issuer's accounting treatment for these transactions was not in conformity with the International Accounting Standards Board's Conceptual Framework for Financial Reporting. (AS 2810.30) Unrelated to our review the issuer reevaluated its accounting for transactions recorded between its closing date and calendar year end and concluded that a misstatement existed that had not been previously identified. The issuer subsequently corrected this misstatement in a restatement of its financial statements and the firm revised and reissued its report on the financial statements. The issuer also reevaluated its controls over financial reporting and concluded that a material weakness existed that had not been previously identified. The issuer subsequently reflected this material weakness in a revision to its report on ICFR.

The issuer engaged external engineering consultants (“company's specialists”) to review and evaluate the mineral reserves and resources estimates prepared by management which were then used in the development of a life-of-mine (LOM) plan for each site. The company's specialists evaluated the estimated mineral reserves and resources using various methods which included the use of financial and non-financial information data and assumptions that were provided by or obtained from the issuer other specialists and/or external sources. The firm's approach for substantively testing the valuation of long-lived assets was to test the issuer's process. With respect to the evaluation of the LOM plans and reserves estimates by the company's specialists which were then used in the issuer's depreciation expense calculations the following deficiencies were identified: · The firm did not identify and test any controls over the (1) accuracy and completeness of the non-financial data prepared by the issuer (2) relevance and reliability of the non-financial information obtained by the company's specialists (3) reasonableness of the non-financial assumptions and (4) appropriateness of the methods used by the company's specialists. (AS 2201.39)

The issuer engaged external engineering consultants (“company's specialists”) to review and evaluate the mineral reserves and resources estimates prepared by management which were then used in the development of a life-of-mine (LOM) plan for each site. The company's specialists evaluated the estimated mineral reserves and resources using various methods which included the use of financial and non-financial information data and assumptions that were provided by or obtained from the issuer other specialists and/or external sources. The firm's approach for substantively testing the valuation of long-lived assets was to test the issuer's process. With respect to the evaluation of the LOM plans and reserves estimates by the company's specialists which were then used in the issuer's depreciation expense calculations the following deficiencies were identified: · The firm did not perform any procedures to test the accuracy and completeness of the non-financial data prepared by the Issuer and evaluate the relevance and reliability of the non-financial information obtained and used by the company's specialists. (AS 1105.A8a)

The issuer engaged external engineering consultants (“company's specialists”) to review and evaluate the mineral reserves and resources estimates prepared by management which were then used in the development of a life-of-mine (LOM) plan for each site. The company's specialists evaluated the estimated mineral reserves and resources using various methods which included the use of financial and non-financial information data and assumptions that were provided by or obtained from the issuer other specialists and/or external sources. The firm's approach for substantively testing the valuation of long-lived assets was to test the issuer's process. With respect to the evaluation of the LOM plans and reserves estimates by the company's specialists which were then used in the issuer's depreciation expense calculations the following deficiencies were identified: · The firm did not perform any procedures to evaluate the reasonableness of significant assumptions used by the company's specialists. (AS 2501.16; AS 1105.A8b)

The issuer engaged external engineering consultants (“company's specialists”) to review and evaluate the mineral reserves and resources estimates prepared by management which were then used in the development of a life-of-mine (LOM) plan for each site. The company's specialists evaluated the estimated mineral reserves and resources using various methods which included the use of financial and non-financial information data and assumptions that were provided by or obtained from the issuer other specialists and/or external sources. The firm's approach for substantively testing the valuation of long-lived assets was to test the issuer's process. With respect to the evaluation of the LOM plans and reserves estimates by the company's specialists which were then used in the issuer's depreciation expense calculations the following deficiencies were identified: · The firm did not perform any procedures to evaluate whether the methods used by the company's specialists were appropriate under the circumstances. (AS 1105.A8c)

For certain consumer loans the firm selected for testing a control that consisted of the issuer's quarterly review of its ALL assumptions and adjustments to the ALL including a review of any exceptions to the issuer's ALL methodology and whether quarterly changes to the ALL were reasonable. The firm did not evaluate certain criteria the control owners used to identify items for follow up related to the review of quarterly changes to the ALL. Further the firm did not evaluate the review procedures the control owners performed to determine whether certain items identified by the control owners for follow up were appropriately resolved. (AS 2201.42 and .44)

The transaction data for certain retail deposit accounts were transmitted from various source systems to the issuer's retail deposit system to record transactions in the general ledger. The firm did not identify and test any controls over the accuracy and completeness of the data maintained in one of these source systems. (AS 2201.39)

The firm sent positive confirmation requests to the issuer's customers for a sample of these retail deposit liabilities. For certain of the items in its sample for which the requested confirmations were not returned the firm did not perform alternative procedures that provided sufficient evidence that the recorded amounts of the deposit liabilities were accurate as of the confirmation date. (AS 2310.31)

The sample size the firm used in certain of its substantive procedures to test these deposit liabilities was too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiency in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The issuer used various models in the valuation of certain derivatives. The firm selected for testing controls over these models that consisted of (1) the validation of the design and construction of models that met certain criteria and (2) the annual review of the models that were not subject to the first control. The firm did not evaluate the review procedures the control owners performed including the criteria the control owners used to identify items for follow up and whether those items were appropriately resolved. (AS 2201.42 and .44)

The firm selected for testing a control that consisted of the review of the categorization of certain derivatives within the fair value hierarchy as set forth in FASB ASC Topic 820 Fair Value Measurement. The firm did not evaluate the specific procedures the control owner performed to assess the reasonableness of the categorization within the fair value hierarchy. (AS 2201.42 and .44)

The firm did not perform any substantive procedures to evaluate the reasonableness of the issuer's categorization of these derivatives within the fair value hierarchy. (AS 2502.43)

The issuer entered into revenue arrangements with multiple elements and allocated the total consideration from these arrangements between the sale of products and services using its best estimate of selling price (“BESP”) under the relative-selling-price method. The issuer determined BESP based on contractual prices or factors of list prices. The firm selected for testing a control that consisted of reviews of the issuer's annual analysis of BESP. The firm did not determine whether the control owners' reviews of this analysis considered whether contractual prices or factors of list prices were the most appropriate selection for BESP. (AS 2201.42 and .44)

The firm did not perform any substantive procedures to test the issuer's assertion that contractual prices or factors of list prices were the most appropriate selection for BESP. (AS 2810.30)

The firm selected for testing a control that consisted of the review of all of the issuer's sales transactions including multiple-element arrangements for appropriate revenue recognition. The firm did not evaluate whether the control owners assessed whether prices for extended warranty services that were separately stated on customer invoices represented evidence that customers had the option to purchase these services for an expressly stated amount separate from the price of the product which may have affected the revenue allocation. (AS 2201.42 and .44)

The firm did not perform any substantive procedures to evaluate whether prices for extended warranty services that were separately stated on customer invoices represented evidence that customers had the option to purchase these services for an expressly stated amount separate from the price of the products. (AS 2810.30)

The issuer used loan charge-offs as inputs to the determination of the general reserve component of the ALL. The firm did not identify and test any controls over loan charge-offs for one type of these consumer loans. (AS 2201.39)

The firm selected for testing an automated control and certain information technology (“IT”) dependent manual controls over inventory that used data or reports that were derived from the issuer's inventory system for which the firm had identified a significant deficiency that was not remediated until the fourth quarter. The firm did not test any instances of the automated control and the controls over the accuracy and completeness of these data and reports subsequent to the remediation of the significant deficiency. (AS 2201.55 and .56)

The firm selected for testing a control over program changes that consisted of the approval testing and monitoring of changes made during the year to the issuer's inventory system. The firm did not identify and test any controls over the completeness of the report that was generated by the inventory system affected by the significant deficiency discussed above and that the firm used to select program changes for testing. (AS 2201.39)

For certain revenue the firm did not identify and test any controls over the issuer's determination of whether the GAAP requirements that (1) persuasive evidence of an arrangement existed and (2) collectability was reasonably assured were met for transactions recorded as revenue. (AS 2201.39)

The firm selected for testing various controls that consisted of monthly comparisons of this revenue by customer product geographic region and/or business unit to revenue recorded in the prior month. The firm did not evaluate the review procedures that the control owners performed including whether items identified for follow up were appropriately resolved. (AS 2201.42 and .44)

For certain of this revenue the firm selected for testing controls that consisted of a monthly comparison of a sample of invoices to the related prior-month invoice and the investigation of differences. In testing these controls the firm did not inspect the invoices the control owners used in this comparison to determine whether all differences were identified for investigation. (AS 2201.44)

The sample sizes the firm used in certain of its substantive procedures to test revenue and accounts receivable were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A)

The firm tested various controls over certain unbilled accounts receivable advanced billings and deferred revenue that used data from the issuer's billing systems but did not identify and test any controls over the accuracy and completeness of these data. (AS 2201.39)

The firm's substantive procedures to test these accounts consisted of analytical procedures. The firm used data from the issuer's billing systems to develop its expectations but did not test or in the alternative identify and test controls over the accuracy and completeness of these data as discussed above. Further the firm established its thresholds for investigating differences based on a level of control reliance that was not supported due to the deficiency in the firm's testing of controls. As a result the thresholds that the firm used did not provide the desired level of assurance that misstatements that could have been material would be identified. (AS 2301.16 .18 and .37; AS 2305.16 and .20)

During the year the issuer acquired a business and determined the fair value of an acquired intangible asset using customer attrition-rate assumptions. The following deficiencies were identified: · The firm did not identify and test any controls over the accuracy and completeness of historical revenue data that the issuer used to determine the attrition rates. (AS 2201.39)

During the year the issuer acquired a business and determined the fair value of an acquired intangible asset using customer attrition-rate assumptions. The following deficiencies were identified: · The firm's approach for testing the attrition rates was to review and test management's process. The firm did not perform any substantive procedures to test or in the alternative identify and test any controls over the accuracy and completeness of historical revenue data that the issuer used to determine the attrition rates as discussed above. (AS 2502.39)