Authors
Ray Butler
Abstract
Errors in spreadsheet applications and models are alarmingly common (some authorities, with justification cite spreadsheets containing errors as the norm rather than the exception). Faced with this body of evidence, the auditor can be faced with a huge task - the temptation may be to launch code inspections for every spreadsheet in an organisation. This can be very expensive and time-consuming.
This paper describes risk assessment based on the "SpACE" audit methodology used by H M Customs & Excise's tax inspectors. This allows the auditor to target resources on the spreadsheets posing the highest risk of error, and justify the deployment of those resources to managers and clients.
Since the opposite of audit risk is audit assurance the paper also offers an overview of some elements of good practice in the use of spreadsheets in business.
Sample
The risk assessment methodology is a multi-stage process, which allows the auditor to make a "stop / go" decision at each stage.
The first two stages consider the environment within which the model or application is developed. The subsequent steps move on to consider the development itself.
Publication
2000, EuSpRIG
