Are Spreadsheets Going Away?
For decades, spreadsheets have been the paper and pencil of finance. Spreadsheets have captured and displayed every type of information and have enabled complex analytics to be prepared, manipulated, and shared. Above all, their ease-of-use has enabled accounting staff at all levels to link data from multiple sources, and then use that data in flexible ways.
Spreadsheets have served as the backbone of corporate analytics. They are relied upon to manage virtually every process. Many of these processes are business critical. Regulators have stated that spreadsheets are integral to the function and operation of the global financial system.
Spreadsheets present multiple challenges to businesses that rely upon them exclusively to manage critical finance functions. These challenges have driven some companies to try (and fail) to replace them. Their flexibility has helped them to withstand these efforts. They can be used to plug gaps in financial processes very quickly and can bridge systems in an adaptable way. Technically, spreadsheets are a rapid application development (RAD) technology enabling the creation of valuable IT systems at relatively low initial cost. For these and many other reasons, spreadsheets will be with us for a long time yet.
But businesses need to implement the right tools to monitor, control and verify spreadsheets. Complementary, template-rich processes utilising consistent analysis are required to mitigate risk and streamline decision-making processes. A concrete understanding of the strengths and weaknesses of the spreadsheet can help businesses more effectively determine how and when to rely upon them – and when to leverage other technologies for increased operational efficiencies and compliance.
Businesses can rely upon spreadsheets so heavily that they lose sight of the original time savings they were intended to provide. Hoping for organised, coherent systems, many companies develop complicated, multi-level spreadsheet systems to track projects. But they can quickly find themselves drilling down into thousands of separate spreadsheets and investing an inordinate amount of human resources to maintain the system. Falling behind can be disastrous. The Jamaican banking system collapsed in its entirety in the early 1990s in large part because of a failure to archive critical spreadsheets that had been used in deal capture.
Spreadsheet systems can become very complex and large. The enormity of maintaining and storing spreadsheets presents a data storage challenge. It is common for offices of finance to maintain drives, files and sometimes storage rooms filled with binders full of spreadsheet hardcopies.
When spreadsheets are viewed as a primary means for making a decision, issues with interpretation can present challenges. Some organisations rush to build spreadsheets to assist in decision-making, but different people using the same data to influence a decision may come to different conclusions based on their individual interpretations of risk and style of analysis
Spreadsheets can be full of errors – both clerical and arithmetic. Because spreadsheets are often very complex and have complicated algorithms or macros buried within them that are not transparent to the reviewer, an error in a critical spreadsheet can result in grave mistakes and embarrassment. Dr. Raymond R. Panko, of the University of Hawaii, found that in an initial field audit of 367 real organisational spreadsheets, 24% of the spreadsheets audited contained errors. In a follow-up field audit, using better methodologies, errors were discovered in 86% of the spreadsheets audited.
In addition to data entry errors, the majority of spreadsheets used in financial reporting are untested – and therefore subject to bug rates normally experienced in traditional software engineering. Studies have shown that over 90% of spreadsheets randomly sampled from corporations are materially incorrect.
Add to that, intentional errors – or fraud – and it’s clear that unchecked spreadsheets open an organisation up to untold problems. Spreadsheets have no mechanism to prevent or detect fraud. Due to the mixture of code – e.g., spreadsheet formulas – and data, spreadsheets create an ideal environment for committing fraud. The detection of fraud is at least as difficult as the difficulty of detecting material errors.
If spreadsheets are used exclusively for reading data from regular pre-formatted reports, then the risks are reduced; however, if those same spreadsheets are used to manipulate reported data and subsequently feed the resultant information back into another IT system, then there are serious challenges to data integrity.
The reality is that spreadsheet error and abuse is ever-present. This suggests that the practical realities of signing off a set of accounts are such that auditors have to turn a blind eye to the existence of material weakness in financial processes that are excessively spreadsheet dependent. Sarbanes Oxley has highlighted the need to manage and control spreadsheets as it has become clear in compliance efforts that spreadsheets often play a key role in critical financial controls.
The good news is that auditors are aware of the existence and value of spreadsheet control solutions, and they are starting to require corporations to bring critical spreadsheets under control. Initial warnings arrive in the form of audit follow-up letters. In time, companies that fail to react will find their accounts qualified due to material weaknesses in their financial processes.
Where auditors can set standards, there is good control of spreadsheets and they lead by example. Spreadsheets that underpin major financial transactions are prone to error. In these cases, auditors use a formal validation process to ensure the integrity of these high stakes spreadsheets to the client organisation. This is especially critical as it relates to compliance risk. Unless spreadsheets have been tested, corrected, and controlled, using a similar validation process, there is no possibility of basic fiduciary compliance, let alone the possibility of compliance with higher statutes such as Sarbanes Oxley, Basel II, or in some cases health and safety regulations.
Spreadsheets are not going away. The risks they introduce into a business, however, require that supplemental technologies be leveraged to support and validate their critical function in the office of finance.
Bringing spreadsheets under control begins internally with discovery, risk assessment, remediation and control. Businesses should then evaluate which spreadsheet applications should be replaced, which should remain, and which should be put under formal control.
The difficulty in implementing best practices in spreadsheet management is that testing – traditionally omitted from spreadsheet development – will have to be done. There is little value to an organisation in putting untested, error prone spreadsheets under control. Basic software development principles dictate that an equal amount of time should be devoted to spreadsheet testing as is devoted to the creation of the spreadsheet itself.
Though there are costs associated with the ongoing management of controlled spreadsheets, recent studies are suggesting that the most significant problem with manual spreadsheets is the oceans of time spent looking after them. Correction and control of spreadsheets should produce a net improvement in organisational efficiency and productivity.
The are two paths for corporates to manage spreadsheets. First, there is an opportunity to move away from spreadsheets to a template-rich and controlled approach, featuring consistent review and analysis processes. Second, there are tools that help to help monitor, control, and verify the critical spreadsheets an organisation uses for those processes where spreadsheets are most suitable, e.g., for systems interfacing and complex, non-standard analysis.
In today’s climate of increased scrutiny from both regulators and the public, finance officers need to address the challenges and risks associated with the continued use of uncontrolled and untested spreadsheets for financial reporting.
There is a better way. Every organisation should go through a spreadsheet discovery, risk assessment, remediation, and control process to ensure that the financial data they rely upon to make key business decisions is accurate. The business can continue to use spreadsheets for certain critical functions. The remaining critical functions, for which spreadsheets are no longer suitable, can then be migrated into a managed and controlled environment that provides the same functionality with substantially lower risk.