The Revenue Annual Statement report is not Site secure in Service Pack 14
We're currently evaluating this issue for a fix in a future patch or service pack.
Steps to Duplicate
1) Assign a Site to a Constituent (Organization type) on the Security tab. This Constituent must have given Revenue 2) Log into CRM as a non-admin assigned to a different Site, with System Roles 3) Navigate to the Revenue Annual Statement report. 4) Set it to a specific date range, and view the revenue from the Constituent from the other site. 5) The revenue appears in the report, although you are logged in as a user who should not be seeing revenue from the other site.