- Inspection year
- 2018
- Report date
- 05-Aug-2020
- PCAOB release
- 104-2020-016a
- Audits reviewed
- 10
- Audits w/ Part I.A deficiencies
- 3
- Part I.A deficiency rate
- 30%
- Part I.A deficiencies
- 15
- Part I.B deficiencies
- —
- Report
- View PDF ↗
Deficiencies (15)
Grouped by issuer and in the same order as the PCAOB report, so each item ties back directly to the source.
Issuer A9 deficiencies
| # | Area | Deficiency | Standard | Flags |
|---|---|---|---|---|
| 1 | Accounts Receivable | The firm did not perform sufficient procedures to obtain the necessary understanding of the flow of transactions within the revenue and accounts receivable transaction cycles including the effect of the issuer's information technology (“IT”) systems to identify the likely sources of potential misstatements. (AS 2201.34 and .36) ICFR audit only | AS 2201.34; AS 2201.36 | |
| 2 | Accounts Receivable | The firm selected for testing multiple controls over user access to various applications. The firm did not evaluate the procedures that the control owners performed including the criteria that the control owners used to create edit and maintain the security roles within these applications. (AS 2201.42 and .44) ICFR audit only | AS 2201.42; AS 2201.44 | |
| 3 | Accounts Receivable | The firm selected for testing a number of automated application controls related to processing revenue transactions and performing database reconciliations. For certain of these controls the firm did not sufficiently test the design effectiveness of the controls because it did not determine whether items that met the issuer's established criteria would be properly investigated and resolved. (AS 2201.42) ICFR audit only | AS 2201.42 | |
| 4 | Accounts Receivable | For the other controls the firm did not perform any procedures to test the design effectiveness of the controls. (AS 2201.42) ICFR audit only | AS 2201.42 | |
| 5 | Accounts Receivable | The firm selected for testing controls that consisted of the issuer's review of revenue transactions and accounts receivable and the related reserve. The firm did not evaluate the review procedures that the control owners performed including the criteria that the control owners used to identify items for follow up and whether those items were appropriately resolved. (AS 2201.42 and .44) ICFR audit only | AS 2201.42; AS 2201.44 | |
| 6 | Accounts Receivable | The firm identified a control deficiency for a control related to the approval of new customers. The firm did not sufficiently evaluate the severity of the control deficiency because it did not identify that the compensating controls it selected for testing did not address the risk of material misstatement related to customers who were not approved. (AS 2201.68) ICFR audit only | AS 2201.68 | |
| 7 | Business Combinations | During the year the issuer acquired multiple businesses and used an external specialist to determine the fair values of the assets acquired and the liabilities assumed. The firm selected for testing a control that consisted of the issuer's review of the external specialist's valuation report. The firm did not evaluate the review procedures that the control owner performed including the criteria that the control owner used to identify items for follow up and whether those items were appropriately resolved. (AS 2201.42 and .44) ICFR audit only | AS 2201.42; AS 2201.44 | |
| 8 | Investments | The issuer used two service organizations to initiate and process investment transactions. The firm did not identify and test any of the complementary user controls over the existence of investments. (AS 2201.B22) ICFR audit only | AS 2201.B22 | |
| 9 | Investments | In addition the firm did not identify and test any controls over the valuation of investments. (AS 2201.39) ICFR audit only | AS 2201.39 |
Issuer B4 deficiencies
| # | Area | Deficiency | Standard | Flags |
|---|---|---|---|---|
| 1 | Revenue | The firm selected for testing a control over the timing of revenue recognition. The firm however did not directly test the control because its procedures which consisted of determining that revenue was not recorded before goods were shipped for a sample of transactions were substantive in nature. (AS 2201.B9) ICFR audit only | AS 2201.B9 | |
| 2 | Revenue | In addition the firm selected for testing a control that consisted of management's review of revenue including deferred revenue and the related journal entries. The firm did not evaluate the review procedures that the control owner performed including the criteria that the control owner used to identify items for follow up and whether those items were appropriately resolved. (AS 2201.42 and .44) ICFR audit only | AS 2201.42; AS 2201.44 | |
| 3 | Income Taxes | The firm selected for testing controls that consisted of management's review of income tax provisions and tax returns. The firm did not evaluate the review procedures that the control owners performed including the criteria that the control owners used to identify items for follow up and whether those items were appropriately resolved. (AS 2201.42 and .44) ICFR audit only | AS 2201.42; AS 2201.44 | |
| 4 | Income Taxes | In addition the firm did not identify and test any controls over the accuracy and completeness of the information used in the performance of these controls. (AS 2201.39) ICFR audit only | AS 2201.39 |
Issuer C2 deficiencies
| # | Area | Deficiency | Standard | Flags |
|---|---|---|---|---|
| 1 | Revenue | The issuer recorded revenue when a user action in an electronic environment occurred and the revenue recognition criteria had been met. The issuer used an IT application to track user actions define and capture valid billable user actions and generate user activity reports. The firm tested IT general controls (“ITGCs”) and identified control deficiencies related to this IT application and the general ledger. The firm concluded either that the deficiencies were mitigated by other controls or that the deficiencies did not directly affect the firm's reliance on the issuer's controls over the accuracy and completeness of the data derived from the IT application. To test the accuracy and completeness of the reports the firm used in its substantive testing of revenue the firm (1) relied on its testing of ITGCs and application controls over revenue and (2) confirmed user activity with customers. The firm's reliance on these ITGCs and application controls was not supported because the firm did not sufficiently test the application controls used by the issuer to (1) track user actions (2) capture billable user actions and (3) generate the user activity reports used to calculate revenue because the firm did not consider the criteria necessary for valid user actions to occur how user actions were counted and accumulated and whether revenue recognition requirements were met. The firm also did not test compensating controls that mitigated the identified ITGC deficiencies and did not perform an evaluation to support its conclusion that those deficiencies did not affect its reliance on controls in the IT application. (AS 1105.10) Financial statement audit only | AS 1105.10 | |
| 2 | Revenue | The issuer recorded revenue when a user action in an electronic environment occurred and the revenue recognition criteria had been met. The issuer used an IT application to track user actions define and capture valid billable user actions and generate user activity reports. The firm tested IT general controls (“ITGCs”) and identified control deficiencies related to this IT application and the general ledger. The firm concluded either that the deficiencies were mitigated by other controls or that the deficiencies did not directly affect the firm's reliance on the issuer's controls over the accuracy and completeness of the data derived from the IT application. To test the accuracy and completeness of the reports the firm used in its substantive testing of revenue the firm (1) relied on its testing of ITGCs and application controls over revenue and (2) confirmed user activity with customers. In addition the firm's confirmation procedures were not sufficient because the firm did not consider whether the issuer's customers would have the information necessary to confirm the user activity. (AS 2310.26) Financial statement audit only | AS 2310.26 |