That’s not a headline designed just to capture your attention. It’s a very real possibility.
Spreadsheets can be powerful. They’re full of functionality yet easy to use. Everyone can create and use a spreadsheet without much in the way of training.
But all those benefits are also the dangers. Spreadsheets weren’t designed to carry the burden of vast computations or huge numbers of contributing editors. If a business is over-reliant on spreadsheets – and there are often much better applications for the job – then it is up to the business to ensure that what’s being calculated is correct.
The consequences of one wrong answer can be catastrophic. We offer our Top 6 questions to ask about the critical spreadsheets in your business to protect you from failure.
1. What’s a critical spreadsheet?
Because spreadsheets are so often created by the user population rather than the IT function the way they are developed, updated and shared is rarely regulated. This doesn’t really matter for personal use. But it becomes a serious problem where the business depends on a spreadsheet to determine budgets, pricing, billing, reporting or any other core financial data.
“There have been high-profile cases of organisations mis-reporting their finances because of errors in spreadsheets in recent years,” reports Gary Fenn, trainer at Best Software Training London (Best STL). “Not only does this hurt the company’s credibility but ever-tightening compliance regulations could mean huge penalty fines as well.”
2 Where are our critical spreadsheets?
Depending on the size of the business there could be tens of thousands of spreadsheets sitting on hard drives or in the cloud. Many will be of little risk to the business, but the challenge is to find those that could do serious damage.
“A thorough audit will start to give you those answers” says Gary Fenn. The way you do that could be anything from simply asking people to report what they’ve got through to using automated tools to scan network resources.”
If you have to comply with regulations such as Sarbanes Oxley, then flowcharting business processes with associated spreadsheets could greatly help the auditing process.
3. Can we identify the risky spreadsheets?
The next step is to determine which of those spreadsheets are putting your business in jeopardy. The best way is to formalise a process for ranking spreadsheets according their risk. How significant would an error in that spreadsheet be to the business? How many people can update the data and the formulas in spreadsheet? How complex is the spreadsheet and how much data is it manipulating?
“It’s not enough to know where the critical spreadsheets are,” adds Fenn. “You need to create an inventory of what they are, why they were created and who can update them. And keep that inventory itself updated.”
4. How can we protect those spreadsheets?
An obvious route is to fully utilise the security features available in spreadsheets such as access privileges and protected areas to ensure only the right people can make changes.
That’s a start, says Gary Fenn but “it’s more important is set up processes and policies which everyone can understand and that ensure spreadsheets are doing what they are intended to do without interference.”
This could include an agreed method for versioning spreadsheets across the organisation, approval processes for spreadsheet changes, and a procedure for verifying data that is input to the spreadsheet.
5. Are we doing enough to satisfy compliance demands?
Financial regulations around the world, such as Sarbanes Oxley, have become much tighter since the global crisis. Yet there are few regulations specifically around spreadsheets. Despite that business leaders are expected to understand the risk and demonstrate how they are managing it.
“It’s all about responsibilities,” says Gary Fenn. “Make sure that both IT and individuals understand their roles in risk management, and that there is a process for reporting risk to the board. If you have a role already dealing with financial risk management, assign spreadsheets to be another aspect of their portfolio.”
6. What about future spreadsheets?
Gary Fenn has advice for anyone about to embark on a new spreadsheet. “You should take time to design a spreadsheet before it’s used in a real business situation. Think about the final outcome – the question the spreadsheet is answering – and work backwards from there. If the spreadsheet has a business-critical role, conduct a financial risk and benefit assessment. This will help you decide the correct proportion of resources to allocate to the creation and management of the process.”
