How can technology mitigate spreadsheet risk?
Few users, auditors, board directors, or regulators would dispute these points.
The challenge for companies is how best to implement a spreadsheet risk management framework that supports these types of reviews. Given the way spreadsheets are used – typically without review and the management controls generally found in corporate IT applications – this is very challenging without the right tools sets in place.
Some of these points require a user to sanity check a spreadsheet they receive for the first time. Other issues require technology capabilities that assure a business-critical spreadsheets’ accuracy, quality, and integrity.
Technology capabilities allow users and managers to systematically check spreadsheets for issues like proper documentation, missing data, calculation errors, or flawed formulas. At organizations where spreadsheets are widely used in various applications, checking these spreadsheets at scale is essential if the best practice expected by managers and regulators is to be applied.
How do you create this technology architecture?
The first step is creating a spreadsheet inventory. This provides a foundation for centralizing the management, review, and visibility of the critical spreadsheet estate used in the business. It also provides a repository for the documentation essential for defining and controlling the core spreadsheets used in a company.
The next phase – discovery – is where companies find the mission-critical spreadsheets they need to manage in the business.
The key here is to find the most significant spreadsheet used, defined by a range of parameters, including who uses a file, how often it is changed, what other applications and data sources it is linked to, and other relevant criteria. Clearly, user input can be included here too.
The last phase is the proactive monitoring of the critical spreadsheets so that issues related to missing data, flawed calculations and formulas or stale data can be captured and addressed.
This capability provides a solid technical foundation for managing spreadsheet risk and will complement the qualitative aspects of managing spreadsheets, as illustrated by the ICAEW best practice guidelines.