- Inspection year
- 2023
- Report date
- 25-Jul-2024
- PCAOB release
- 104-2024-120
- Audits reviewed
- 3
- Audits w/ Part I.A deficiencies
- 1
- Part I.A deficiency rate
- 33%
- Part I.A deficiencies
- 5
- Part I.B deficiencies
- —
- Report
- View PDF ↗
Deficiencies (5)
Grouped by issuer and in the same order as the PCAOB report, so each item ties back directly to the source.
Issuer A5 deficiencies
| # | Area | Deficiency | Standard | Flags |
|---|---|---|---|---|
| 1 | Insurance Reserves | The issuer used multiple information technology (IT) systems to initiate process and/or record transactions related to insurance reserves. In its testing of controls over insurance reserves the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by IT systems it identified as in-scope with respect to insurance reserves. The firm then tested certain controls over insurance reserves that relied on the effectiveness of these IT controls. The firm selected for testing change management controls over these IT systems that consisted of the documentation review testing and approval of changes in a ticketing system prior to their migration into production. The following deficiency was identified: · The firm did not perform procedures beyond inquiry to test whether there was a common set of change management controls across all in-scope IT systems such that all changes related to these IT systems would be recorded tracked and approved through the issuer's ticketing system. (AS 2201.42 and 44) Both financial statement and ICFR audits | AS 2201.42; AS 2201.44 | |
| 2 | Insurance Reserves | The issuer used multiple information technology (IT) systems to initiate process and/or record transactions related to insurance reserves. In its testing of controls over insurance reserves the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by IT systems it identified as in-scope with respect to insurance reserves. The firm then tested certain controls over insurance reserves that relied on the effectiveness of these IT controls. The firm selected for testing change management controls over these IT systems that consisted of the documentation review testing and approval of changes in a ticketing system prior to their migration into production. The following deficiency was identified: · The firm did not perform procedures to test or test controls over the completeness of the population of changes used in the change management controls from which it selected its samples for testing. (AS 1105.10) Both financial statement and ICFR audits | AS 1105.10 | |
| 3 | Insurance Reserves | The issuer used multiple information technology (IT) systems to initiate process and/or record transactions related to insurance reserves. In its testing of controls over insurance reserves the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by IT systems it identified as in-scope with respect to insurance reserves. The firm then tested certain controls over insurance reserves that relied on the effectiveness of these IT controls. For certain controls over privileged user and application access the firm did not identify and test any controls over the accuracy and completeness of the listing of users that was used in the operation of the controls (AS 2201.39). Both financial statement and ICFR audits | AS 2201.39 | |
| 4 | Insurance Reserves | The issuer used multiple information technology (IT) systems to initiate process and/or record transactions related to insurance reserves. In its testing of controls over insurance reserves the firm tested various automated and IT-dependent manual controls that used data and reports generated or maintained by IT systems it identified as in-scope with respect to insurance reserves. The firm then tested certain controls over insurance reserves that relied on the effectiveness of these IT controls. For certain controls over privileged user and application access the firm did not evaluate the control owner's review procedures to determine that the permissions assigned were appropriate. (AS 2201.42 and .44) Both financial statement and ICFR audits | AS 2201.42; AS 2201.44 | |
| 5 | Insurance Reserves | With respect to the firm's substantive testing of insurance reserves the firm used its own actuarial specialists to develop an independent estimate of a range of reserves. Historical claims and premiums data provided by the issuer was used by the firm's actuarial specialists to develop the independent estimate. As discussed above the firm did not sufficiently test controls over the accuracy and completeness of the system-generated data used by the firm to substantively test insurance reserves. The firm substantively tested this data by vouching a sample of data points from each source of information produced by the company to the relevant system. However the sample sizes the firm used were too small to provide sufficient appropriate audit evidence because these procedures were designed based on a level of control reliance that was not supported due to the deficiencies in the firm's control testing discussed above. (AS 2301.16 .18 and .37; AS 2315.19 .23 and .23A) Both financial statement and ICFR audits | AS 2301.16; AS 2301.18; AS 2301.37; AS 2315.19; AS 2315.23; AS 2315.23A |