Spreadsheet Management

Field Interviews with Senior Managers by Caulkins et. al. (2007) report that Spreadsheet errors are common and have been observed in instances in which errors directly led to losses or bad decisions Most organizations only have informal spreadsheet quality control procedures Many feel that more formal quality controls would be beneficial but don’t know how to efficiently achieve this IT research can identify efficient and effective procedures for managing spreadsheet risk by analyzing how companies manage their financial reporting spreadsheets for SOX compliance

Sarbanes-Oxley Act (SOX, 2002) Requires “an effective system of internal control” for financial reporting in publicly- held companies Effective management of spreadsheet risk is required to satisfy the regulation requirements Similar requirements have been made by other regulating agencies (AICPA, NACUBO, FDA)

10-K Deficiency Filings Ks reported SOX material weaknesses for inadequate internal control of spreadsheets between 2004 and mid weaknesses associated with inadequate review processes 41 weaknesses with inadequate access controls 27 weaknesses with inadequate change management controls 22 weaknesses with lack of data integrity controls 9 weaknesses with inadequate spreadsheet testing Ks cited general lack of effective controls

Sources of Misstatements Errors vs. Fraud Taxonomy of spreadsheet errors (Rajalingham, 2001) Quantitative vs. Qualitative Accidental errors Distinguished by level of intent Developer vs. User committed errors

Accountability for Spreadsheet Deficiencies Who is accountable? Senior management A spreadsheet risk management policy that defines effective processes and enacts appropriate monitoring is needed An operating model that defines further accountability, roles & responsibilities, processes, controls and control standards

Spreadsheet Risk Management PricewaterhouseCoopers and the IT Governance Institute have suggested a 5 stage process: Create an inventory of spreadsheets Perform a risk assessment of financial misstatement (materiality and likelihood) Determine the necessary level of controls Evaluate existing controls Develop action plans for remediating control deficiencies

Life Cycle Stages Where Controls Are Needed Panko, 2005 Examples Preventive ControlsDetective ControlsCorrective Controls Formal software engineering approaches such as SDLC- based methods Auditing protocols Change controls Version controls Panko (2006) proposed a control framework to help organizations produce accurate financial reports

Examples of Controls that can be Considered for Different Processes

Examples of Spreadsheet Controls Change Control Maintain a process for requesting changes to a spreadsheet, making changes, testing and obtaining formal sign-off from an independent individual that the change is functioning appropriately Version Control Ensure only current and approved versions of spreadsheets are being used by creating naming conventions, directory structures and access control Input Control Ensure that data is input completely and accurately and that it is current and secure Documentation Ensure that it is up-to-date and communicates the business objective and specific functions of the spreadsheet

Organizational Parties in the Operating Model Spreadsheet owners Developers End-users Information Technology division Business users Internal Auditors Spreadsheet review groups

Oveview of Spreadsheet Management Research Controls for Different Roles Preventive (Formal Development Approaches)Detective (Auditing)Correct- ive Designer End-user (self- designed) Developer (single/ multiple) End-user training; Best practices; Expert-novice differences; Surveys of spreadsheet issues and corporate policies; Effect of teaching design principles on prevention; Graphical approach for reducing errors; Algorithm to capture logic; Web service to manage models; Testing Spreadsheet Accuracy Theory; Risk and control; Applying SDLC to design; Quality control; Training specific design approaches; Testing vs. code review; Discovering spreadsheet structure, Tips for using Excel controls; Organizational quality control procedures; Design strategies to improve usability Framework of risks; Survey of Literature; Testing Spreadsheet Accuracy Theory Testing vs. code review User Organization End-user Heuristics for automatic identification of irregularitiesProposed visualization and auditing tools; Expert-novice differences; Impact of prominence of errors and electronic environment ; Quantifying risk; Factors influenc- ing error detection IT Error prevention techniques; Spreadsheet development life cycle; Review of commercial spreadsheet products; Business intelligence tools to share spreadsheets; Web service to manage models; Survey of spreadsheet issues and corporate policies Keeping track of changes in a spreadsheet Spreadsheet Review Group/Intern al Auditor Error prevention techniques; Spreadsheet development life cycle; Specific tips for Internal Auditors on using Excel controls; Detailed examples of controls and procedures; Broad recommendations for procedures and controls; Spreadsheet testing and Fraud Prevention Controls for Fraud; Auditing protocol; Specific tips for Internal Auditors on using Excel controls; Comprehensive survey of literature; Broad recommendations for procedures and controls; Keeping track of changes; Visualization tools; Visualization techniques for non-modular designs Keeping track of changes; Detailed controls

Examples of Preventive Controls to Minimize Errors: Developers: Training on design principles Preplanning requirements Testing protocol Users: Ensure correct data inputs Excel’s Data Validation menu option ActiveX controls Standardize documentation for organization Train to test for reasonableness

Testing for Reasonableness Use cross-footing techniques (different sum logics that should come to same total) Apply your domain knowledge of the problem (e.g. if portfolio risk increases, the return of an efficient portfolio should not decrease) Enter test cases with known outcomes to verify accuracy (e.g. copy the homework solution for the decision variables into your model to see if you get the same results)