Authors
Deloitte
Abstract
The primary advantages of spreadsheet - namely their ostensible simplicity and the ability to share and freely modify the files - also pose the greatest risks. Spreadsheets are standalone files and therefore practically devoid of system-wide controls. Almost any employee can create, access, manipulate, and distribute spreadsheet data. As a result, almost any employee can make a critical error while manually entering data or configuring formulas.
There is, however, a Risk Intelligent approach to the management of spreadsheets that can substantially mitigate systemic and application flaws, both human and electronic. Installation of effective, auditable controls surrounding critical spreadsheets and their use can have a direct impact on financial reporting and compliance. A carefully structured approach to managing spreadsheets can help protect critical spreadsheets. Implementing a controlled environment can be achieved, albeit with challenges, which can be more clearly identified in addressing the following questions:
- How many version of a given spreadsheet are out there? Who else is modifying this spreadsheet? Which is the correct or most-recent version?
- Who can see or modify data in the spreadsheet? Should they have this level of access?
- Are the formulas and calculations in the spreadsheet accurate?
- Is there documentation of the way this spreadsheet processes data?
- How does one ensure that unauthorized users cannot manually override spreadsheet functionality?
- What built-it audit function tracks changes and restricts authority to make changes to this spreadsheet?
- How is the current version of this spreadsheet backed up?
Responses to these challenges are not theoretical exercises. Among "real-life" spreadsheet horror stories, a utility company found, at the last minute, that in a lengthy spreadsheet formula, parentheses were out of place - projected gains fell from \$200 million to \$25 million. In another instance, executives of a healthcare service provider admitted to preparing a false spreadsheet for auditors that inflated assets, thus falsifying a company's worth - earnings were overstated by at least \$3.5 billion.
Sample
Less than half of the surveyed organizations factor spreadsheet risk into their overall risk reporting and decision-making process.
Publication
2009, White paper
Full article
Not available
