- Inspection year
- 2022
- Report date
- 28-Mar-2023
- PCAOB release
- 104-2023-049
- Audits reviewed
- 4
- Audits w/ Part I.A deficiencies
- 4
- Part I.A deficiency rate
- 100%
- Part I.A deficiencies
- 25
- Part I.B deficiencies
- 5
- Report
- View PDF ↗
Deficiencies (25)
Grouped by issuer and in the same order as the PCAOB report, so each item ties back directly to the source.
Issuer A16 deficiencies
| # | Area | Deficiency | Standard | Flags |
|---|---|---|---|---|
| 1 | Certain Liabilities | The issuer used multiple information-technology (IT) systems to initiate process and/or record transactions related to (1) certain revenue and unearned revenue (2) certain liabilities and (3) long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. As a result of the following deficiencies in the firm's testing of IT general controls (ITGCs) the firm's testing of these automated and IT-dependent controls was not sufficient. (AS 2201.46) Both financial statement and ICFR audits | AS 2201.46 | |
| 2 | Certain Liabilities | With respect to change management: The firm selected for testing a change management control over certain IT systems that consisted of the documentation review testing and approval of changes prior to their migration into production. The firm did not perform procedures to test or test any controls over the completeness of the population of changes from which it made its selections for testing. (AS 1105.10) Both financial statement and ICFR audits | AS 1105.10 | |
| 3 | Certain Liabilities | With respect to user access: The firm selected for testing user access controls over certain IT systems that consisted of (1) restricting access to implement program and/or configuration changes to authorized IT personnel with no development responsibilities (2) the approval of privileged system access for all layers based on the user's position and duties and (3) the removal of system access in a timely manner. The following deficiencies were identified: · The firm did not perform procedures to test or test any controls over the accuracy and completeness of the data from which it made its selections to test controls one and two. (AS 1105.10) Both financial statement and ICFR audits | AS 1105.10 | |
| 4 | Certain Liabilities | With respect to user access: The firm selected for testing user access controls over certain IT systems that consisted of (1) restricting access to implement program and/or configuration changes to authorized IT personnel with no development responsibilities (2) the approval of privileged system access for all layers based on the user's position and duties and (3) the removal of system access in a timely manner. The following deficiencies were identified: · The firm also did not perform sufficient procedures to test the operating effectiveness of control two because its procedures were limited to testing one instance of the control's operation for each layer. (AS 2201.46) Both financial statement and ICFR audits | AS 2201.46 | |
| 5 | Certain Liabilities | With respect to user access: The firm selected for testing user access controls over certain IT systems that consisted of (1) restricting access to implement program and/or configuration changes to authorized IT personnel with no development responsibilities (2) the approval of privileged system access for all layers based on the user's position and duties and (3) the removal of system access in a timely manner. The following deficiencies were identified: · The firm did not perform sufficient procedures to test control three because the firm did not perform procedures to understand the specific timing in which access was to be removed and test whether access was removed within this timeframe. (AS 2201.42 and .44) Both financial statement and ICFR audits | AS 2201.42; AS 2201.44 | |
| 6 | Certain Liabilities | The firm identified deficiencies in the design and operating effectiveness of other user access controls for certain of the issuer's IT systems. The firm identified and tested controls that it believed would mitigate the deficiencies. The firm did not identify that these controls did not address the risks that (1) user access or privileged access may be granted to unauthorized users and (2) inappropriate access may be granted to users. Further the firm did not test the design and operating effectiveness of one compensating control for certain of these IT systems. (AS 2201.68) Both financial statement and ICFR audits | AS 2201.68 | |
| 7 | Certain Liabilities | As a result of the firm's ITGC testing deficiencies discussed above the firm did not perform sufficient substantive procedures as follows: · The firm used certain system-generated data to substantively test certain liabilities unearned revenue and long-lived assets but did not test or (as discussed above) sufficiently test controls over the accuracy and completeness of this data. (AS 1105.10) Both financial statement and ICFR audits | AS 1105.10 | |
| 8 | Certain Liabilities | As a result of the firm's ITGC testing deficiencies discussed above the firm did not perform sufficient substantive procedures as follows: · The firm performed substantive analytical procedures as part of its testing of certain revenue. The firm used certain system-generated data to develop its expectations but did not test or (as discussed above) sufficiently test controls over the accuracy and completeness of this data. (AS 2305.16) Both financial statement and ICFR audits | AS 2305.16 | |
| 9 | Revenue | With respect to Revenue which was affected by the audit deficiencies related to change management and user access the following additional deficiencies were identified: · For certain revenue the firm selected for testing controls that consisted of the (1) reconciliation and review of certain data used to recognize revenue and (2) reconciliation and review of billed amounts prior to the recording of revenue. For the items selected for testing the firm did not test the management review aspects of these controls involving the review of (1) data used to recognize revenue and (2) billed amounts prior to the recording of revenue. (AS 2201.44) Both financial statement and ICFR audits | AS 2201.44 | |
| 10 | Revenue | With respect to Revenue which was affected by the audit deficiencies related to change management and user access the following additional deficiencies were identified: · The firm selected for testing other controls over certain revenue. The firm tested these controls through an interim date but did not perform any procedures to update the results of its testing from that interim date to year end. (AS 2201.55) Both financial statement and ICFR audits | AS 2201.55 | |
| 11 | Revenue | With respect to Revenue which was affected by the audit deficiencies related to change management and user access the following additional deficiencies were identified: · The performed other substantive analytical procedures as part of its testing of certain revenue. The firm used data derived from the recorded amounts of revenue to develop its expectations but did not evaluate whether this data was sufficiently reliable for purposes of achieving its audit objectives. (AS 2305.16) Both financial statement and ICFR audits | AS 2305.16 | |
| 12 | Long-Lived Assets | With respect to Long-Lived Assets which was affected by the audit deficiencies related to change management and user access the following additional deficiencies were identified: · The firm selected for testing a control that consisted of the issuer's review of an assessment of long-lived assets for potential impairment including the underlying cash-flow forecasts. The firm did not evaluate the specific review procedures that the control owner performed to assess the reasonableness of the significant assumptions underlying these cash-flow forecasts. (AS 2201.42 and .44) Both financial statement and ICFR audits | AS 2201.42; AS 2201.44 | Significant risk |
| 13 | Long-Lived Assets | With respect to Long-Lived Assets which was affected by the audit deficiencies related to change management and user access the following additional deficiencies were identified: · The firm selected for testing certain other IT-dependent manual controls over long-lived assets. The firm tested these controls through an interim date but did not perform any procedures to update the results of its testing from that interim date to year end. (AS 2201.55) Both financial statement and ICFR audits | AS 2201.55 | Significant risk |
| 14 | Long-Lived Assets | With respect to Long-Lived Assets which was affected by the audit deficiencies related to change management and user access the following additional deficiencies were identified: · The firm's approach for substantively testing the impairment of certain long-lived assets was to test the issuer's process. The firm did not sufficiently evaluate whether the method the issuer used to perform its impairment analyses was in conformity with the applicable financial reporting framework including the requirements of International Accounting Standard 36 Impairment of Assets because the firm did not evaluate evidence that indicated whether the recoverable amount of the individual assets was estimable and available. (AS 2501.10; AS 2810.03) Both financial statement and ICFR audits | AS 2501.10; AS 2810.3 | Significant risk |
| 15 | Long-Lived Assets | With respect to Long-Lived Assets which was affected by the audit deficiencies related to change management and user access the following additional deficiencies were identified: · The issuer engaged a specialist to perform a quantitative assessment of certain long-lived assets for the purpose of determining whether the carrying amounts of those assets were recoverable as of the end of the prior year. The firm did not perform procedures to test the recoverable amounts of these long-lived assets as of the end of the current year beyond obtaining the issuer's impairment schedule and the valuation report prepared by the company's specialist in the prior year. Further the firm did not perform any procedures to use the work of the company's specialist as audit evidence. (AS 1105.A1 - .A10; AS 2501.07) Both financial statement and ICFR audits | AS 1105.A1; AS 1105.A10; AS 1105.A2; AS 1105.A3; AS 1105.A4; AS 1105.A5; AS 1105.A6; AS 1105.A7; AS 1105.A8; AS 1105.A9; AS 2501.7 | Significant risk |
| 16 | Journal Entries | The firm identified fraud criteria for journal entries and obtained a listing of all journal entries that met the criteria. The firm did not perform sufficient substantive procedures to test those journal entries because it limited its procedures to certain journal entries from the listing of entries that met the fraud criteria without having an appropriate rationale for limiting its testing to those journal entries. (AS 2401.61) Both financial statement and ICFR audits | AS 2401.61 |
Issuer B5 deficiencies
| # | Area | Deficiency | Standard | Flags |
|---|---|---|---|---|
| 1 | Deferred Revenue | The issuer used multiple IT systems to initiate process and/or record transactions related to certain revenue deferred revenue and long-lived assets. In its testing of controls over these accounts the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by certain of these IT systems. As a result of the following deficiency in the firm's testing of ITGCs the firm's testing of these automated and IT-dependent manual controls was not sufficient. (AS 2201.46) Both financial statement and ICFR audits | AS 2201.46 | Significant risk |
| 2 | Deferred Revenue | With respect to change management: The firm selected for testing a change management control over certain IT systems that consisted of the documentation review testing and approval of changes prior to their migration into production. The firm did not perform procedures to test or test any controls over the completeness of the population of changes from which it made its selections for testing. (AS 1105.10) Both financial statement and ICFR audits | AS 1105.10 | Significant risk |
| 3 | Deferred Revenue | As a result of the firm's ITGC testing deficiency discussed above the firm did not perform sufficient substantive procedures as follows: · The firm used certain system-generated data to substantively test deferred revenue long-lived assets and certain revenue but did not test or (as discussed above) sufficiently test controls over the accuracy and completeness of this data. (AS 1105.10) Both financial statement and ICFR audits | AS 1105.10 | Significant risk |
| 4 | Deferred Revenue | As a result of the firm's ITGC testing deficiency discussed above the firm did not perform sufficient substantive procedures as follows: · The firm performed substantive analytical procedures as part of its testing of certain revenue and depreciation expense. The firm used certain system-generated data to develop its expectations but did not test or (as discussed above) sufficiently test controls over the accuracy and completeness of this data. (AS 2305.16) Both financial statement and ICFR audits | AS 2305.16 | Significant risk |
| 5 | Deferred Revenue | As a result of the firm's ITGC testing deficiency discussed above the firm did not perform sufficient substantive procedures as follows: · The sample size the firm used in certain of its substantive procedures to test revenue and long-lived assets was too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiency in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A) Both financial statement and ICFR audits | AS 2301.16; AS 2301.18; AS 2301.37; AS 2315.19; AS 2315.23; AS 2315.23A | Significant risk |
Issuer C2 deficiencies
| # | Area | Deficiency | Standard | Flags |
|---|---|---|---|---|
| 1 | Revenue | The principal auditor instructed the firm to perform specific substantive procedures to address the identified risks of material misstatement related to revenue. The firm did not perform sufficient substantive procedures to test revenue because the firm did not perform certain procedures for each transaction selected for testing and did not perform certain other procedures that it was instructed to perform. (AS 2301.08) Both financial statement and ICFR audits | AS 2301.8 | |
| 2 | Inventory | As instructed by the principal auditor the firm selected for testing controls that consisted of the performance of physical inventory counts a reconciliation of those counts to the inventory records and the adjustment of those records as appropriate. The firm did not perform sufficient procedures to test the operating effectiveness of these controls because the firm did not test the aspect of the control involving the performance of the physical inventory counts performed during the operation of these controls. (AS 2201.44) Both financial statement and ICFR audits | AS 2201.44 |
Issuer D2 deficiencies
| # | Area | Deficiency | Standard | Flags |
|---|---|---|---|---|
| 1 | Variable Interest Entities | The issuer derives revenue through consolidated variable interest entities (VIEs) and relies on contractual arrangements with the VIEs and their shareholders to control the business operations of the consolidated VIEs. The issuer engaged an external specialist to provide a legal opinion regarding the issuer's consolidated VIEs including the validity and enforceability of contractual arrangements with the VIEs and their shareholders. The firm did not identify and test any controls over the identification and monitoring of events requiring a reassessment of VIEs as a reconsideration event under FASB ASC Topic 810 Consolidation. (AS 2201.39) Both financial statement and ICFR audits | AS 2201.39 | |
| 2 | Variable Interest Entities | The issuer derives revenue through consolidated VIEs and relies on contractual arrangements with the VIEs and their shareholders to control the business operations of the consolidated VIEs. The issuer engaged an external specialist to provide a legal opinion regarding the issuer's consolidated VIEs including the validity and enforceability of contractual arrangements with the VIEs and their shareholders. The firm did not perform substantive procedures to evaluate whether reconsideration events under FASB ASC Topic 810 had occurred requiring a reassessment of the VIEs beyond obtaining and reading the legal opinion prepared by the company's specialist. Further the firm did not perform any procedures to use the work of the company's specialist as audit evidence. (AS 1105.A1 - .A10; AS 2301.08) Both financial statement and ICFR audits | AS 1105.A1; AS 1105.A10; AS 1105.A2; AS 1105.A3; AS 1105.A4; AS 1105.A5; AS 1105.A6; AS 1105.A7; AS 1105.A8; AS 1105.A9; AS 2301.8 |