Authors
Steven C. Peacock
Abstract
Since its introduction in the 1980's, spreadsheet software has provided analysts and planners with a complex and valuable tool permitting the timely modeling of financial systems and organizational problems.
Through the use of macros, linking, and complex formulas, a spreadsheet user is capable of collecting, organizing and analyzing data without involving anyone with a background in data organization and storage, and can do this work outside of the rigidly controlled environment in which formal software is developed. While this capability allows an organization to be nimble and quickly respond to new trends and data collection, there is an awakening to the risk inherent in the current business dependency on spreadsheets.
With the passage of the Sarbanes-Oxley Act in 2002, attention was drawn to spreadsheets because of the requirements of Section 404. This section requires management and external auditors to report on the adequacy of a company's internal control over financial reporting.
Because of the power and flexibility of the modern spreadsheet, many organizations use spreadsheets to determine financial transaction amounts or balances which are then populated into the general ledger and/or financial statements. This type of spreadsheet use, as opposed to performing analysis or monitoring operational activities, is what converts the spreadsheet into a form of financial reporting, and in turn invokes the need to have internal controls for spreadsheets per the Sarbanes-Oxley requirements.
As more attention is focused on the use of spreadsheets to drive financial reporting, the question must be asked, "How accurate are the spreadsheets?". Professionally developed software performing financial functions validates the inputted data, is tested with a variety of scenarios, and uses verified algorithms. Spreadsheets, on the other hand, are often developed to meet an immediate need, have little or no validation of data inputs, rarely undergo formal testing and, as a general rule, are continually evolving over time.
Unfortunately, these negatives associated with spreadsheets are also what makes them attractive to organizations: developing a spreadsheet does not require involvement of information technology or data processing professionals; a spreadsheet can be developed quickly and efficiently to meet an immediate need; a spreadsheet can be easily modified, or copied and modified to quickly respond to the needs of management.
Sample
To reduce spreadsheet risk, take steps such as:
- Implement change control procedures for all spreadsheets.
- Create design procedures and processes which validate the problem the spreadsheets are created to solve.
- Develop standards for cell naming, and formula creation that improve the validation of spreadsheet models by visual inspection.
- Implement a peer to peer review process by which new spreadsheet models are reviewed and validated before being used for financial reporting.
Publication
2010, White paper
Full article
Not available
