Spreadsheet Risk Issues

It is interesting to note that the riskiness of operational spreadsheets are overlooked even by companies with high standards of risk management. Only when errors amount to actual losses do they realize that these risks have been staring them in the face all along.

Common spreadsheet risk issues

Susceptibility to trivial manual errors

Due to the fundamental structure of spreadsheets, a slight change in the formula or value in any of their inhabited cells may already affect their overall output. An

  • accidental copy-paste,
  • omission of a negative sign,
  • erroneous range selection,
  • incorrect data input or
  • unintentional deletion of a character,cell, range, column, or row

are just some of the simple errors spreadsheet users frequently encounter. Rarely are there any counter-checking controls in place in a spreadsheet-based activity and manual errors therefore easily go undetected.

Possibility of the user working on the wrong version

How do you store spreadsheet files?

Since the most common reports are usually generated on a monthly basis, users tend to store them using variations of these two configurations:

spreadsheet storage

If you notice, a user can accidentally work on the wrong version with any of these structures.

Prone to inconsistent company-wide reporting

This happens when a summary or ?final? spreadsheet is fed information by different departments coming from their own spreadsheets. Even if most of the data in their spreadsheets come from one source (the company-wide database), erroneous copy-pasting and linking, or even different interpretations of the same data can result to contradicting information in the end.

Often defenceless against unauthorised access

Some spreadsheets contain information needed by various individuals or department units in an organisation. Hence, they are often shared via email or through shared folders in a network. Now, because spreadsheets don’t normally use any access control, any user can easily open a spreadsheet file and view or modify the contents as he wishes.

Highly vulnerable to fraud

A complex spreadsheet system with zero or very minimal controls provides the perfect setting for would-be fraudsters. Hidden cells with malicious formulas and links to bogus information can go unnoticed for a long time especially if the final figures don’t deviate much from expected values.

Spreadsheet risk mitigation solutions may not suffice

Inherent complexity makes testing and logic inspection very time consuming

Deep testing can uncover possible errors hidden in spreadsheet cells and consequently mitigate risks. But spreadsheets used to support financial reporting are normally large, complex, highly-personalised and, without ample supporting documentation, understandably hard to follow.

No clear ownership of risk management responsibilities

There?s always a dilemma when an organisation starts assigning risk management responsibilities for spreadsheets. IT personnel believe users in the business side of the organisation should be responsible since they are the ones who create, edit, store, duplicate, and share the spreadsheet files. On the other hand, users believe IT should be responsible since they have always been in-charge of managing IT infrastructure, applications, and files.

To get rid of spreadsheet risks, you’ll have to get rid of spreadsheets altogether

One remedy is to have a risk management activity that involves both IT personnel and spreadsheet users. But wouldn’t you want to get rid of the complexity of having to distribute the responsibilities between the two parties instead of just one?

Learn more about Denizon’s server application solutions and how you can get rid of spreadsheet risk issues.

More Spreadsheet Blogs


Spreadsheet Risks in Banks


Top 10 Disadvantages of Spreadsheets


Disadvantages of Spreadsheets – obstacles to compliance in the Healthcare Industry


How Internal Auditors can win the War against Spreadsheet Fraud


Spreadsheet Reporting – No Room in your company in an age of Business Intelligence


Still looking for a Way to Consolidate Excel Spreadsheets?


Disadvantages of Spreadsheets


Spreadsheet woes – ill equipped for an Agile Business Environment


Spreadsheet Fraud


Spreadsheet Woes – Limited features for easy adoption of a control framework


Spreadsheet woes – Burden in SOX Compliance and other Regulations


Spreadsheet Risk Issues


Server Application Solutions – Don’t let Spreadsheets hold your Business back


Why Spreadsheets can send the pillars of Solvency II crashing down

?

Advert-Book-UK

amazon.co.uk

?

Advert-Book-USA

amazon.com

Contact Us

  • (+353)(0)1-443-3807 – IRL
  • (+44)(0)20-7193-9751 – UK

Check our similar posts

How To Get Started with your IT Compliance Efforts for SOX

There’s no question about it. For many of you top executives in the corporate world, all roads leading to a brighter future have to go through SOX compliance. And because the business processes that contribute to financial reporting (the crux of the Sarbanes-Oxley Act) are now highly reliant on IT systems, it is important to focus a good part of your attention there.

It is a long and arduous path to IT compliance, so if you don’t want your company to fall by the wayside due to inefficient utilisation of resources, it is important to set out with a plan on hand. What we have here are some vital information that will guide you in putting together a sound plan for SOX compliance of your company?s IT systems.

Why focus on IT systems for SOX compliance?

We’ll get to that. But first, let’s take up the specific portions of the Sarbanes-Oxley Act that affect information technology. These portions can be found in Section 302 and Section 404 of the act.

In simplified form, Section 302 grants the SEC (Securities and Exchange Commission) authority to come up with rules requiring you, CEOs and CFOs, to certify in each annual or quarterly financial report the following:

  • that you have reviewed the report;
  • that based on your knowledge, the report does not contain anything or leave out anything that would render it misleading;
  • that based on your knowledge, all financial information in the report fairly represent the financial conditions of the company;
  • that you are responsible for establishing internal controls over financial reporting; and
  • that you have assessed the effectiveness of the internal controls.

Similarly, Section 404, stated in simplified form, allows the SEC to come up with rules requiring you, CEOs and CFOs, to add an internal control report to each annual financial report stating that you are responsible for establishing internal controls over financial reporting.

You are also required to assess the effectiveness of those controls and to have a public accounting firm to attest to your assessment based upon standards adopted by the Public Company Accounting Oversight Board (PCAOB).

While there is no mention of IT systems, IT systems now play a significant role in financial reporting. Practically all of the data you need for your financial reports are stored, retrieved and processed on IT systems, so you really have to include them in your SOX compliance initiatives and establish controls on them.

Now that that’s settled, your next question could very well be: How do you know what controls to install and whether those controls are already sufficient to achieve compliance?

Finding a suitable guide for IT compliance

The two bodies responsible for setting rules and standards dealing with SOX, SEC and PCAOB, point to a well-established control framework for guidance – COSO. This framework was drafted by the Committee of Sponsoring Organisations of the Treadway Commission (COSO) and is the most widely accepted control framework in the business world.

However, while COSO is a tested and proven framework, it is more suitable for general controls. What we recommend is a widely-used control framework that aligns well with COSO but also caters to the more technical features and issues that come with IT systems.

Taking into consideration those qualifiers, we recommend COBIT. COBIT features a well thought out collection of IT-related control objectives grouped into four domains: Plan and Organise (PO), Acquire and Implement (AI), Deliver and Support (DS), and Monitor and Evaluate (ME). The document also includes maturity models, performance goals and metrics, and activity goals.

A few examples of COBIt’s detailed control objectives are:

DS4.2 – IT Continuity Plans
DS4.9 – Offsite Backup Storage
DS5.4 – User Account Management
DS5.8 – Cryptographic Key Management
DS5.10 – Network Security
DS5.11 – Exchange of Sensitive Data

By those titles alone, you can see that the framework is specifically designed for IT. But the document is quite extensive and, chances are, you won’t need all of the items detailed there. Furthermore, don’t expect COBIT to specify a control solution controls for every control objective. For example, throughout the control objective DS4 (Ensure Continuous Service), you won’t find any mention of virtualisation, which is common in any modern business continuity solution.

Basically, COBIT will tell you what you need to attain in order to achieve effective governance, management and control, but you’ll have to pick the solution best suited to reach that level of attainment.

Articles highly relevant to the one you just read:

Month End Accounting The Way It Should Be Today
Spreadsheet Woes ? Burden in SOX Compliance and Other Regulations
Spreadsheet Woes ? Limited Features For Easy Adoption of a Control Framework
How Internal Auditors Can Win The War Against Spreadsheet Fraud

Fine-tuning your Operations and keeping our staff Happy with FieldElite

They are the engine that drives your operations, but are you really giving you value for your money? How much time is spent by your personnel on lengthy paperwork and record-keeping, as opposed to actually providing the service to your customers? Manual tasks create bottlenecks and slow your operations, which in turn affects service delivery and customer satisfaction. You want to reach more clients and boost your brand image, growing your market share and generating more revenue. Field Service Management (FSM) software comes in optimise the operations of your mobile workforce, cut down resource wastage, and enhance your productivity as a firm, by actually enabling your field staff to get more done, thus achieving their individual goals. In fact, according to a report published by Fortune Business Insights?, the global FSM market- which stood at $2.29 billion as recently as 2018, will have expanded to $7.27 billion by 2026. What does this mean for your employees, and how do they benefit from FieldElite?

  • Skipping the paperwork with end-to-end automation

Filing reports, keeping track of equipment used, working on the Excel sheets for multiple jobs on a daily basis, all through to the routing and billing- it can be a logistical nightmare. It’s not just about the hours spent poring through documents and typing away at calculators. Manual work exposes you to the risks of human error. Missing records, inaccurate assessments of the situation on the ground due to the overwhelming data streaming in, putting the head office staff under strain- it all hampers the productivity of the company. 

Take scheduling for instance. You have different employees, and various jobs that need their attention, at different locations. It can be a plumbing company whose clients have water filters that need to be repaired, gas boilers inspected, leaking pipes fixed, and others who need new installations to be set up. Assigning your personnel to the different situations will need to take into account the type of job, and the amount of time that it will require, aspects such as the location and the crew that is closest to it. At the head office you will want to keep tabs on the jobs that are in progress, pending, complete, those on hold, and even those that have been cancelled. Running all these through traditional manual processes is enough to drive you to the edge. What’s more, tasks that slip through your fingers amidst the confusion will result in negative feedback from your customers- which you don’t want hitting your brand.

With a field service job management software like FieldELite, you get to handle it all from one dashboard. Optimise your service delivery using the accurate scheduler, that allows you to account for the location of your employees, the status of the job- from the urgent ones like emergency tasks, to the normal duties such as routine maintenance, and low-priority tasks. The field service scheduling software comes with a real-time location feature that allows you to determine the employees closest to the client’s premises who will be appropriate for the job, map out the service areas and give you a birds-eye view of all the operations on the ground, while being updated with the progress of each specific task. Less time is spent travelling to- and from the central office, and more on actually tending to your client’s needs. You can even have situations where you can assign end-of-day tasks to employees who will be passing on that route on their way home.

  • Enhanced resource utilisation that promotes personal and professional development

Skill is key across the industries- from electrical services, solar panel installation, landscaping, home remodelling, pest control, plumbing, HVAC system maintenance, to construction and property management. For the job to be done appropriately and make your clients happy, you want to assign the task to an employee who is particularly proficient at it. This tends to be glimpsed over during manual scheduling since the personnel at the head office will be swamped with so many files, and will pick the first one that comes close to fitting the job description, leading to overlapping of roles. Sure, they may get it done, having seen their colleagues do it and even helping them out when they worked together before on similar projects- but will it be up to the required standard? On the other hand, the FSM allows you to ensure that you get the right technician for the task- who will be more motivated, boosting their performance.

What about accidents? Your employees want to feel safe as they go about their mandate. Many of the field service jobs are hazardous- such as electrical repair jobs, window cleaning tasks at high rise buildings, to elevator repair jobs where a slight glitch can lead to severe ramifications. Field service management software also comes in handy here, where the head office can be notified of any emergency the moment it occurs, and arrange for the necessary action to be taken immediately. That way, your employees will not feel neglected while they are out in the field, showing them that their safety is a priority to your business- which in turn increases their morale. 

  • Readily available knowledgebase and feedback system

When the employees have been assigned a specific job, they will require certain information about it. This includes the scope of the task, history of previous repairs or maintenance that was carried out, accompanying images if needed, risk assessment, any hazards or contaminants that they will need to prepare for, to notes left by technicians who had handled it. Having to keep checking their email, or picking up documents at the office for the day’s job and walking around with them all day as they tend to one customer after another, will slow things down, and not to mention frustrate them. However, the FSM system is directly accessible by the employees via app on their phones. The information needed for each specific task will thus be at their fingertips, speeding up the process and ensuring that they will be ready for each project being handled. 

While carrying out the job itself, the employees will use the very same app to update the system on how it is progressing, chat with the staff at the head office, update the inventory and even place orders for extra parts if necessary. Since mobile service management software apps like FieldElite also work in offline mode, the photos, reports and other entries that are made are collected by the app and saved on the device. Once a network connection is established, they are then updated to the central database- thus ensuring that the job can proceed regardless of the location. 

Once the job is completed, the customer input is also taken, registered in the system through their e-signature. A signoff comment included gives the customer the opportunity to indicate their experience with the job, and the feedback that they would like to provide. In case the job has not been completed, then the scheduling software kicks in, putting it in queue for another appointment to take care of the task, or resolve the issue that had caused it not to be completed the first time. The completed tasks head right to invoicing, which is also handled within the field service management platform, making it a seamless task for the head office staff.

How Armstrong World Industries is going Cradle-to-Cradle

The Cradle-to-Cradle concept holds that human effort must be biometric, in other words enrich the environment within which it functions as opposed to breaking it down. This means manufacturing must be holistic in the sense that everything is reusable and nothing is destroyed. Armstrong World Industries was the first global mineral ceiling tile manufacturer to achieve Cradle-to-Cradle certification. We decided to take a closer look at how they achieved this.

Armstrong Worldwide Industries has five plants in the UK alone. These produce an annual turnover of ?2.7 billion. They have been making ceilings for more than 150 years. Fifteen years ago and way ahead of the curve it started recycling, and has maintained a policy of not charging contractors for waste ever since. Along the way, it developed a product that can be re-used indefinitely.

The Challenge

Going green must also be commercially sustainable. In Armstrong?s case, it faced a rise in landfill tax from ?8 per tonne per year to ?80 per tonne per year. This turned the financial cost of waste from a nuisance to a threat. It calculated that recycling one tonne of ceiling materials would:

  • Eliminate 456kg of CO2 equivalents by saving 1,390 kWh of electricity
  • Preserve 11 tons of virgin material and save 1,892 gallons of potable water

They hoped to extend their own recycling project by asking demolition and strip-out contractors to join it, so they could reprocess their scrap as new batches of tiles too.

The Achievement

As things stand today, an Armstrong ceiling tile now contains an average of 82% recycled content. Indeed, if they could find more ceilings to recycle this could reach 100%. In the past two years alone, Armstrong Worldwide Industries UK has saved 130,399m? of greenfield from landfill, being the equivalent of 520 skips that would otherwise have cost contractors over ?88,000 to dispose of.

The Broader Context

Armstrong Worldwide Industries is a global leader in water management, and is bent on minimising its reliance on fossil for energy. It has implemented online measurement systems that feed data to its corporate environmental, health and safety system. This empowers it to produce reports, track corrective actions and measure progress towards its overall goal of being carbon neutral.

Next time you sit beneath an Armstrong Worldwide Industries panelled ceiling, spare a thought for how much ecoVaro consumption analytics could contribute to your bottom line (and how it would feel to be lighter on carbon too).

Contact Us

  • (+353)(0)1-443-3807 – IRL
  • (+44)(0)20-7193-9751 – UK

Ready to work with Denizon?