- Inspection year
- 2021
- Report date
- 16-Nov-2022
- PCAOB release
- 104-2023-005
- Audits reviewed
- 17
- Audits w/ Part I.A deficiencies
- 4
- Part I.A deficiency rate
- 24%
- Part I.A deficiencies
- 31
- Part I.B deficiencies
- 4
- Report
- View PDF ↗
Deficiencies (31)
Grouped by issuer and in the same order as the PCAOB report, so each item ties back directly to the source.
Issuer A17 deficiencies
| # | Area | Deficiency | Standard | Flags |
|---|---|---|---|---|
| 1 | Accounts Receivable | The issuer used an information technology (IT) system to process and record transactions related to revenue accounts receivable and inventory. In its testing of controls over these accounts the firm tested certain IT-dependent manual controls that used data and reports generated or maintained by this IT system. As a result of the deficiencies in the firm's testing of IT general controls (ITGCs) discussed below the firm's testing of these IT-dependent manual controls was not sufficient. (AS 2201.46) Both financial statement and ICFR audits | AS 2201.46 | |
| 2 | Accounts Receivable | The issuer used an information technology (IT) system to process and record transactions related to revenue accounts receivable and inventory. In its testing of controls over these accounts the firm tested certain IT-dependent manual controls that used data and reports generated or maintained by this IT system. The following ITGC deficiencies were identified: · The firm selected for testing a control over the issuer's review of user access to this IT system but did not evaluate the specific review procedures that the control owner performed to determine whether to approve user access that had been requested or whether user access that had been previously approved continued to be appropriate. (AS 2201.42 and .44) Both financial statement and ICFR audits | AS 2201.42; AS 2201.44 | |
| 3 | Accounts Receivable | The issuer used an information technology (IT) system to process and record transactions related to revenue accounts receivable and inventory. In its testing of controls over these accounts the firm tested certain IT-dependent manual controls that used data and reports generated or maintained by this IT system. The following ITGC deficiencies were identified: · The firm selected for testing a control over change management but did not perform any procedures to test or in the alternative test any controls over the completeness of the population of changes from which it made its selections for testing. (AS 1105.10) Both financial statement and ICFR audits | AS 1105.10 | |
| 4 | Accounts Receivable | The issuer used an information technology (IT) system to process and record transactions related to revenue accounts receivable and inventory. In its testing of controls over these accounts the firm tested certain IT-dependent manual controls that used data and reports generated or maintained by this IT system. The following deficiencies related to the firm's testing of controls were identified: · The firm used the work of the issuer's internal audit as evidence of the effectiveness of automated application controls over the accuracy and completeness of reports that the issuer used in the operation of certain other IT-dependent manual controls that the firm tested. Internal audit relied on the testing of these controls that was performed in prior years. The firm did not sufficiently evaluate whether internal audit's strategy to rely on testing that was performed in prior years was appropriate because the firm did not evaluate whether ITGCs were effective in those prior years. (AS 2201.B29; AS 2605.24) Both financial statement and ICFR audits | AS 2201.B29; AS 2605.24 | |
| 5 | Accounts Receivable | The issuer used an information technology (IT) system to process and record transactions related to revenue accounts receivable and inventory. In its testing of controls over these accounts the firm tested certain IT-dependent manual controls that used data and reports generated or maintained by this IT system. The following deficiencies related to the firm's testing of controls were identified: · For certain automated controls the firm tested a sample of one transaction for each of these controls in the issuer's IT testing environment rather than in its production environment. The firm's testing was not sufficient because the firm did not perform procedures to determine whether the testing environment was consistent with the production environment. (AS 2201.44) Both financial statement and ICFR audits | AS 2201.44 | |
| 6 | Accounts Receivable | The sample sizes the firm used in certain of its substantive procedures to test revenue accounts receivable and inventory were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A) Both financial statement and ICFR audits | AS 2301.16; AS 2301.18; AS 2301.37; AS 2315.19; AS 2315.23; AS 2315.23A | |
| 7 | Revenue | For certain business units the firm selected for testing an automated control over the timing of revenue recognition. The firm did not test the configuration of this automated control or perform other procedures that would have provided sufficient appropriate audit evidence that the control was designed and operating effectively. (AS 2201.42 and .44) Both financial statement and ICFR audits | AS 2201.42; AS 2201.44 | |
| 8 | Revenue | For another business unit the firm selected for testing a control that consisted of the issuer's monthly review of revenue and gross margins. The firm did not evaluate the specific review procedures that the control owner performed to assess whether revenue was appropriately recognized. (AS 2201.42 and .44) Both financial statement and ICFR audits | AS 2201.42; AS 2201.44 | |
| 9 | Pension Assets and Liabilities | The issuer used a service organization for custodial and other administrative services related to pension assets. The firm obtained the service auditor's report on the operating effectiveness of the service organization's controls but did not identify that the service auditor's report did not address the valuation of pension assets. (AS 2201.39 and .B21) Both financial statement and ICFR audits | AS 2201.39; AS 2201.B21 | |
| 10 | Pension Assets and Liabilities | The issuer determined the fair value of a portion of its pension assets based on a valuation model that used the financial results of the investees. The firm obtained the audited financial statements of the investees but did not perform any procedures to test the investees' financial results for the six months between the period covered by the audited financial statements and the issuer's year end. Further for two of these investees the firm did not sufficiently evaluate whether the audited financial statements provided sufficient appropriate audit evidence about the investees' financial results for the period covered because the financial statements did not contain the necessary information for the firm to assess the inputs that the issuer used in its valuation model. (AS 2503.28) Both financial statement and ICFR audits | AS 2503.28 | |
| 11 | Pension Assets and Liabilities | The issuer engaged an external specialist to estimate its pension liabilities using participant data provided by the issuer and assumptions developed by the specialist. The firm selected for testing a control that consisted of the issuer's review of the assumptions used by the specialist. The firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44) Both financial statement and ICFR audits | AS 2201.42; AS 2201.44 | |
| 12 | Pension Assets and Liabilities | The issuer engaged an external specialist to estimate its pension liabilities using participant data provided by the issuer and assumptions developed by the specialist. The firm selected for testing a control that consisted of the issuer's review of the assumptions used by the specialist. The firm did not identify and test any controls that addressed whether the participant data provided to the specialist were accurate and complete. (AS 2201.39) Both financial statement and ICFR audits | AS 2201.39 | |
| 13 | Payroll Expenses | The issuer used a service organization to initiate process and record transactions related to payroll expenses for certain business units and this service organization used a sub-service organization for certain functions that were not covered in the service auditor's report. In its testing of controls over this account the firm tested certain IT-dependent manual controls that used data and reports from the service organization. As a result of the deficiencies in the firm's testing of controls discussed below the firm's testing of these controls was not sufficient. (AS 2201.46) Both financial statement and ICFR audits | AS 2201.46 | |
| 14 | Payroll Expenses | The issuer used a service organization to initiate process and record transactions related to payroll expenses for certain business units and this service organization used a sub-service organization for certain functions that were not covered in the service auditor's report. In its testing of controls over this account the firm tested certain IT-dependent manual controls that used data and reports from the service organization. The following deficiencies were identified: · The firm did not identify and test any controls over the issuer's evaluation of the service auditor's report with respect to the effectiveness of the controls at the service organization. (AS 2201.39) Both financial statement and ICFR audits | AS 2201.39 | |
| 15 | Payroll Expenses | The issuer used a service organization to initiate process and record transactions related to payroll expenses for certain business units and this service organization used a sub-service organization for certain functions that were not covered in the service auditor's report. In its testing of controls over this account the firm tested certain IT-dependent manual controls that used data and reports from the service organization. The following deficiencies were identified: · The firm identified complementary user controls implemented by the issuer that the service auditor's report described as necessary but did not test the operating effectiveness of certain of these controls. (AS 2201.44 and .B22) Both financial statement and ICFR audits | AS 2201.44; AS 2201.B22 | |
| 16 | Payroll Expenses | The issuer used a service organization to initiate process and record transactions related to payroll expenses for certain business units and this service organization used a sub-service organization for certain functions that were not covered in the service auditor's report. In its testing of controls over this account the firm tested certain IT-dependent manual controls that used data and reports from the service organization. The following deficiencies were identified: · The firm did not obtain an understanding of and test any controls at the sub-service organization that were relevant to the issuer. (AS 2201.39 and .B19) Both financial statement and ICFR audits | AS 2201.39; AS 2201.B19 | |
| 17 | Payroll Expenses | The sample size the firm used in certain of its substantive procedures to test payroll expenses was too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A) Both financial statement and ICFR audits | AS 2301.16; AS 2301.18; AS 2301.37; AS 2315.19; AS 2315.23; AS 2315.23A |
Issuer B4 deficiencies
| # | Area | Deficiency | Standard | Flags |
|---|---|---|---|---|
| 1 | Allowance for Credit/Loan Losses | The issuer used various internally and externally developed models to estimate the quantitative component of the ACL for loans collectively evaluated for impairment. These models used various data and assumptions. The following deficiencies were identified: · The firm did not identify and test any controls over the issuer's validation of certain of these models. (AS 2201.39) Both financial statement and ICFR audits | AS 2201.39 | |
| 2 | Allowance for Credit/Loan Losses | The issuer used various internally and externally developed models to estimate the quantitative component of the ACL for loans collectively evaluated for impairment. These models used various data and assumptions. The following deficiencies were identified: · The firm selected for testing controls that consisted of the issuer's reviews of the operation of these models and the underlying inputs and assumptions. The firm did not evaluate the review procedures that the control owners performed including the procedures to identify items for follow up and the procedures to determine whether those items were appropriately resolved. (AS 2201.42 and .44) Both financial statement and ICFR audits | AS 2201.42; AS 2201.44 | |
| 3 | Allowance for Credit/Loan Losses | The issuer used various internally and externally developed models to estimate the quantitative component of the ACL for loans collectively evaluated for impairment. These models used various data and assumptions. The following deficiencies were identified: · The firm selected for testing controls that consisted of the issuer's reviews of the operation of these models and the underlying inputs and assumptions. The firm did not identify and test any controls over the accuracy and completeness of the data that the control owners used in the operation of these controls. (AS 2201.39) Both financial statement and ICFR audits | AS 2201.39 | |
| 4 | Allowance for Credit/Loan Losses | The issuer used various internally and externally developed models to estimate the quantitative component of the ACL for loans collectively evaluated for impairment. These models used various data and assumptions. The following deficiencies were identified: · The firm's approach for substantively testing the quantitative component of the ACL for loans collectively evaluated for impairment was to test the issuer's process and the firm used an auditor-employed specialist to evaluate certain significant assumptions the issuer used including the underlying models and assumptions. The firm did not sufficiently evaluate the reasonableness of these significant assumptions because it did not identify that the specialist's procedures were limited to inquiring of management and reading issuer-prepared reports and analyses. (AS 1201.C6 and .C7; AS 2501.16) Both financial statement and ICFR audits | AS 1201.C6; AS 1201.C7; AS 2501.16 |
Issuer C5 deficiencies
| # | Area | Deficiency | Standard | Flags |
|---|---|---|---|---|
| 1 | Revenue | The issuer used two IT systems to process and record transactions related to revenue. In its testing of controls over this account the firm tested certain IT-dependent manual controls that used data and reports generated or maintained by these IT systems. As a result of the deficiencies in the firm's testing of ITGCs discussed below the firm's testing of these IT-dependent manual controls was not sufficient. (AS 2201.46) Both financial statement and ICFR audits | AS 2201.46 | |
| 2 | Revenue | The issuer used two IT systems to process and record transactions related to revenue. In its testing of controls over this account the firm tested certain IT-dependent manual controls that used data and reports generated or maintained by these IT systems. The following ITGC deficiencies were identified: · The firm selected for testing controls over the issuer's review of user access to these IT systems but did not evaluate the specific review procedures that the control owners performed to determine whether to approve user access that had been requested or whether user access that had been previously approved continued to be appropriate. (AS 2201.42 and .44) Both financial statement and ICFR audits | AS 2201.42; AS 2201.44 | |
| 3 | Revenue | The issuer used two IT systems to process and record transactions related to revenue. In its testing of controls over this account the firm tested certain IT-dependent manual controls that used data and reports generated or maintained by these IT systems. The following ITGC deficiencies were identified: · The firm selected for testing a control over change management but did not perform any procedures to test or in the alternative test any controls over the completeness of the population of changes from which it made its selections for testing. (AS 1105.10) Both financial statement and ICFR audits | AS 1105.10 | |
| 4 | Revenue | The firm used the work of the issuer's internal audit as evidence of the effectiveness of automated application controls over the accuracy and completeness of reports that the issuer used in the operation of certain other IT-dependent manual controls over revenue that the firm tested. Internal audit relied on the testing of these controls that was performed in prior years. The firm did not sufficiently evaluate whether internal audit's strategy to rely on testing that was performed in prior years was appropriate because the firm did not evaluate (1) whether ITGCs were effective in those prior years and (2) the effect of certain changes to IT systems that the issuer implemented in the current year. (AS 2201.B29 and .B31; AS 2605.24) Both financial statement and ICFR audits | AS 2201.B29; AS 2201.B31; AS 2605.24 | |
| 5 | Revenue | The sample sizes the firm used in certain of its substantive procedures to test revenue were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A) Both financial statement and ICFR audits | AS 2301.16; AS 2301.18; AS 2301.37; AS 2315.19; AS 2315.23; AS 2315.23A |
Issuer D5 deficiencies
| # | Area | Deficiency | Standard | Flags |
|---|---|---|---|---|
| 1 | Allowance for Credit/Loan Losses | The issuer used two IT systems to process and record transactions related to the ALL. In its testing of controls over this account the firm tested certain IT-dependent manual controls that used data and reports generated or maintained by these IT systems. As a result of the deficiencies in the firm's testing of ITGCs discussed below the firm's testing of these IT-dependent manual controls was not sufficient. (AS 2201.46) Both financial statement and ICFR audits | AS 2201.46 | |
| 2 | Allowance for Credit/Loan Losses | The issuer used two IT systems to process and record transactions related to the ALL. In its testing of controls over this account the firm tested certain IT-dependent manual controls that used data and reports generated or maintained by these IT systems. The following ITGC deficiencies were identified: · The firm selected for testing controls over the issuer's review of user access to these IT systems but did not evaluate the specific review procedures that the control owners performed to determine whether to approve user access that had been requested or whether user access that had been previously approved continued to be appropriate. (AS 2201.42 and .44) Both financial statement and ICFR audits | AS 2201.42; AS 2201.44 | |
| 3 | Allowance for Credit/Loan Losses | The issuer used two IT systems to process and record transactions related to the ALL. In its testing of controls over this account the firm tested certain IT-dependent manual controls that used data and reports generated or maintained by these IT systems. The following ITGC deficiencies were identified: · The firm selected for testing a control over change management but did not perform any procedures to test or in the alternative test any controls over the completeness of the population of changes from which it made its selections for testing. (AS 1105.10) Both financial statement and ICFR audits | AS 1105.10 | |
| 4 | Allowance for Credit/Loan Losses | As a result of the firm's ITGC testing deficiencies the firm did not perform sufficient substantive procedures as follows: · The firm did not perform any substantive procedures to test or sufficiently test controls over the accuracy and completeness of certain system-generated data and reports the firm used in its substantive testing. (AS 1105.10) Both financial statement and ICFR audits | AS 1105.10 | |
| 5 | Allowance for Credit/Loan Losses | As a result of the firm's ITGC testing deficiencies the firm did not perform sufficient substantive procedures as follows: · The sample size the firm used in certain of its substantive procedures to test the ALL was too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A) Both financial statement and ICFR audits | AS 2301.16; AS 2301.18; AS 2301.37; AS 2315.19; AS 2315.23; AS 2315.23A |