Spreadsheet Woes – Limited Features For Easy Adoption of a Control Framework

Like it or not, regulations are here to stay and for a company to comply with them, its IT and financial systems will have to be equipped with a suitable control framework. One common stumbling block to such an implementation is a company?s over-reliance on spreadsheets.

Why is it so difficult to adopt controls for a system that’s reliant on spreadsheets? To understand this, let’s pinpoint some of the strongest, most powerful attributes of these User Developed Applications (UDA).

By nature, spreadsheets are the epitome of simplicity: easy to develop, easily accessible and easily altered. All computers in your workplace will most likely have them and everyone in your organization may be sharing them, making their own versions, and storing them in personal folders.

Sad to say though, these strengths are also control weaknesses and constitute the very reasons why spreadsheets require effective risk management.

Easy to develop. Being easy to develop, most spreadsheet systems are created by non-IT users who have limited knowledge on best control practices. Being constantly under time pressure, these ?developers? may also relegate documentation, security, and data verification to the back burner in favour of coming up with a timely report.

Easy to access. Information in a spreadsheet can be opened by practically anyone within the organization?s network. Who accessed what? And when? If anything goes wrong, it would be difficult to identify the culprit, and the failure to pinpoint responsibility for erroneous data could lead to bigger, more costly mistakes.

Easy to alter. Lastly, if the information is easy to access, then it can also be easily altered, consequently making reports more prone to both accidental errors and fraudulent modifications.

The rise of multimillion dollar scandals due to accidental and intentional spreadsheet errors have prompted regulatory bodies to publish guidelines for mitigating spreadsheet-associated risks. These controls include:

Change control
Version control
Access control
Input
Security and data integrity
Documentation
Development life cycle
Backup and archiving
Logic inspection/Testing
Segregation of duties/roles, and procedures
Analytics

In theory, these controls should be able to bring down risks considerably. However, because of the inherent nature of spreadsheets, such controls are rarely implemented effectively in the real world.

Take for example Security and Data Integrity. One of the most common causes of spreadsheet error is due to ?hardwiring?. This happens when values are inadvertently entered into a formula cell, naturally changing the logic of the spreadsheet.

As a way of control, cell locking can be applied on the formula cells to prevent users without the proper authority from making any changes. However, when reporting deadlines approach drawing spreadsheets to the forefront of data processing, more people are given access rights to the locked cells. Ironically, it is during these crunch times, when errors are most likely to happen.

Because the built-in features of a spreadsheet support none of the controls mentioned above, some companies are tempted to purchase control-enabling programs for spreadsheets just to continue using them for financial reporting. But although these programs can integrate the required controls, you?d still be interacting with the same complex and outdated interface: the spreadsheets.

Thus, these band-aid solutions may not suffice because the root cause of these problems are the spreadsheets themselves.

Learn more about our server application solutions and discover a better way to implement controls.

More Spreadsheet Blogs

Spreadsheet Risks in Banks

Top 10 Disadvantages of Spreadsheets

Disadvantages of Spreadsheets – obstacles to compliance in the Healthcare Industry

How Internal Auditors can win the War against Spreadsheet Fraud

Spreadsheet Reporting – No Room in your company in an age of Business Intelligence

Still looking for a Way to Consolidate Excel Spreadsheets?

Disadvantages of Spreadsheets

Spreadsheet woes – ill equipped for an Agile Business Environment

Spreadsheet Fraud

Spreadsheet Woes – Limited features for easy adoption of a control framework

Spreadsheet woes – Burden in SOX Compliance and other Regulations

Spreadsheet Risk Issues

Server Application Solutions – Don’t let Spreadsheets hold your Business back

Why Spreadsheets can send the pillars of Solvency II crashing down

amazon.co.uk

amazon.com

Check our similar posts

How Volvo Dublin achieved Zero Landfill Status

The sprawling New River Valley Volvo plant in Dublin, Virginia slashed its electricity bill by 25% in a single year when it set its mind to this in 2009. It went on to become the first carbon-neutral factory in 2012 after replacing fossil energy with renewable power. Further efforts rewarded it with zero-landfill status in 2013. ecoVaro decided to investigate how it achieved this latest success.

Volvo Dublin?s anti-landfill project began when it identified, measured and evaluated all liquid and solid waste sources within the plant (i.e. before these left the works). This quantified data provided its environmental project team with a base from which to explore options for reusing, recycling and composting the discards.

Several decisions followed immediately. Volvo instructed its component suppliers to stop using cardboard boxes and foam rubber / Styrofoam as packaging, in favour of reusable shipping containers. This represented a collaborative saving that benefited both parties although this was just a forerunner of what followed.

Next, Volvo?s New River Valley truck assembly plant turned its attention to the paint shop. It developed methods to trap, reconstitute and reuse solvents that flushed paint lines, and recycle paint sludge to fire a cement kiln. The plant cafeteria did not escape attention either. The environment team made sure that all utensils, cups, containers and food waste generated were compostable at a facility on site.

The results of these simple, and in hindsight obvious decisions were remarkable. Every year since then Volvo has generated energy savings equivalent to 9,348 oil barrels or if you prefer 14,509 megawatts of electricity. Just imagine the benefits if every manufacturing facility did something similar everywhere around the world.

By 2012, the New River Valley Volvo Plant became the first U.S. facility to receive ISO 50001 energy-management status under a government-administered process. Further technology enhancements followed. These included solar hot water boilers and infrared heating throughout the 1.6 million square foot (148,644 square meter) plant, building automation systems that kept energy costs down, and listening to employees who were brim-full with good ideas.

The Volvo experience is by no means unique although it may have been ahead of the curve. General Motors has more than 106 landfill-free installations and Ford plans to reduce waste per vehicle by 40% between 2010 and 2016. These projects all began by measuring energy footprints throughout the process. ecoVaro provides a facility for you to do this too.

Contact Us

(+353)(0)1-443-3807 – IRL
(+44)(0)20-7193-9751 – UK

A Business Case for Sharing

We blogged about sharing services in a decentralised business context recently, and explained why we think why these should be IT-Based for speedy delivery. This is not to say that all shared services projects worldwide have been resounding successes. This is often down to the lack of a solid business case up front. We decided to lay out the logic behind this process.

Management Overview ? The overview includes a clear definition of why the current situation is unacceptable, the anticipated benefits of sharing, and an implementation plan were it to go ahead. The project should not proceed until the stakeholders have considered and agreed on this.

Alternatives Considered ? The next stage is to get closer to the other options in order to determine whether an alternative might perhaps be preferable. Substitutes for shared services are often doing nothing, improving the current method, and outsourcing the service to a third party.

The Bottom Line in Business ? Sharing services comes at an initial cost of infrastructure changes, and the impact on human capital (the latter deserves its own blog). The following need careful consideration from the financial angle:

Numbers to Work Through

Manpower to design and roll the project out in parallel with the existing organisation.

Capital for creating facilities at the central point including civil works, furniture and equipment and IT infrastructure.

The costs of travel, feeding and accommodation. These can be significant depending on the time that implementation takes.

The opportunity loss of diverting key staff – and the cost of temporary replacements – if appointing line staff to the project team.

Crystal-clear project metrics including (a) the direct, realisable savings (b) the medium and long-term effects on profit and (c) where to deploy the savings

Risk Management

Shared services projects don’t go equally smoothly, although planning should reduce the risk to manageable levels. Nonetheless it is important to imagine potential snags, decide how to mitigate them and what the cost might be.

We believe in implementing shared services on a pilot basis in the business unit that eventually provides them. We recommend building these out to other branches only when new processes are working smoothly.

Moving On From a Decision

We recommend you revisit your management overview, the logic behind it, the assumptions you made, and the costs and benefits you envisage before deciding to go ahead

The final step in proving a business case is doable should be fleshing out your roadmap into a detailed operations plan with dependencies on a spreadsheet.

User-Friendly RASCI Accountability Matrices

Right now, you’re probably thinking that’s a statement of opposites. Something dreamed up by a consultant to impress, or just to fill a blog page. But wait. What if I taught you to create order in procedural chaos in five minutes flat? ?Would you be interested then?

The first step is to create a story line ?

Let’s imagine five friends decide to row a boat across a river to an island. Mary is in charge and responsible for steering in the right direction. John on the other hand is going to do the rowing, while Sue who once watched a rowing competition will be on hand to give advice. James will sit up front so he can tell Mary when they have arrived. Finally Kevin is going to have a snooze but wants James to wake him up just before they reach the island.

That’s kind of hard to follow, isn’t it ?

Let’s see if we can make some sense of it with a basic RASCI diagram ?

Responsibility Matrix: Rowing to the Island
Activity	Responsible	Accountable	Supportive	Consulted	Informed
Person	John	Mary	Sue	James	Kevin
Role	Oarsman	Captain	Consultant	Navigator	Sleeper

Now let’s add a simple timeline ?

Responsibility Matrix: Rowing to the Island
?	Sue	John	Mary	James	Kevin
Gives Direction	?	?	A	?	?
Rows the Boat	?	R	?	?	?
Provides Advice	S	?	?	?	?
Announces Arrival	?	?	A	C	?
Surfaces From Sleep	?	?	?	C	I
Ties Boat to Tree	?	?	A	?	?

Things are more complicated in reality ?

Quite correct. Although if I had jumped in at the detail end I might have lost you. Here?s a more serious example.

There?s absolutely no necessity for you so examine the diagram in any detail, other to note the method is even more valuable in large, corporate environments. This one is actually a RACI diagram because there are no supportive roles (which is the way the system was originally configured).

Other varieties you may come across include PACSI (perform, accountable, control, suggest, inform), and RACI-VS that adds verifier and signatory to the original mix. There are several more you can look at Wikipedia if you like.