Spreadsheet Woes – Limited Features For Easy Adoption of a Control Framework

Like it or not, regulations are here to stay and for a company to comply with them, its IT and financial systems will have to be equipped with a suitable control framework. One common stumbling block to such an implementation is a company?s over-reliance on spreadsheets.

Why is it so difficult to adopt controls for a system that’s reliant on spreadsheets? To understand this, let’s pinpoint some of the strongest, most powerful attributes of these User Developed Applications (UDA).

By nature, spreadsheets are the epitome of simplicity: easy to develop, easily accessible and easily altered. All computers in your workplace will most likely have them and everyone in your organization may be sharing them, making their own versions, and storing them in personal folders.

Sad to say though, these strengths are also control weaknesses and constitute the very reasons why spreadsheets require effective risk management.

Easy to develop. Being easy to develop, most spreadsheet systems are created by non-IT users who have limited knowledge on best control practices. Being constantly under time pressure, these ?developers? may also relegate documentation, security, and data verification to the back burner in favour of coming up with a timely report.

Easy to access. Information in a spreadsheet can be opened by practically anyone within the organization?s network. Who accessed what? And when? If anything goes wrong, it would be difficult to identify the culprit, and the failure to pinpoint responsibility for erroneous data could lead to bigger, more costly mistakes.

Easy to alter. Lastly, if the information is easy to access, then it can also be easily altered, consequently making reports more prone to both accidental errors and fraudulent modifications.

The rise of multimillion dollar scandals due to accidental and intentional spreadsheet errors have prompted regulatory bodies to publish guidelines for mitigating spreadsheet-associated risks. These controls include:

Change control
Version control
Access control
Input
Security and data integrity
Documentation
Development life cycle
Backup and archiving
Logic inspection/Testing
Segregation of duties/roles, and procedures
Analytics

In theory, these controls should be able to bring down risks considerably. However, because of the inherent nature of spreadsheets, such controls are rarely implemented effectively in the real world.

Take for example Security and Data Integrity. One of the most common causes of spreadsheet error is due to ?hardwiring?. This happens when values are inadvertently entered into a formula cell, naturally changing the logic of the spreadsheet.

As a way of control, cell locking can be applied on the formula cells to prevent users without the proper authority from making any changes. However, when reporting deadlines approach drawing spreadsheets to the forefront of data processing, more people are given access rights to the locked cells. Ironically, it is during these crunch times, when errors are most likely to happen.

Because the built-in features of a spreadsheet support none of the controls mentioned above, some companies are tempted to purchase control-enabling programs for spreadsheets just to continue using them for financial reporting. But although these programs can integrate the required controls, you?d still be interacting with the same complex and outdated interface: the spreadsheets.

Thus, these band-aid solutions may not suffice because the root cause of these problems are the spreadsheets themselves.

Learn more about our server application solutions and discover a better way to implement controls.

More Spreadsheet Blogs

Spreadsheet Risks in Banks

Top 10 Disadvantages of Spreadsheets

Disadvantages of Spreadsheets – obstacles to compliance in the Healthcare Industry

How Internal Auditors can win the War against Spreadsheet Fraud

Spreadsheet Reporting – No Room in your company in an age of Business Intelligence

Still looking for a Way to Consolidate Excel Spreadsheets?

Disadvantages of Spreadsheets

Spreadsheet woes – ill equipped for an Agile Business Environment

Spreadsheet Fraud

Spreadsheet Woes – Limited features for easy adoption of a control framework

Spreadsheet woes – Burden in SOX Compliance and other Regulations

Spreadsheet Risk Issues

Server Application Solutions – Don’t let Spreadsheets hold your Business back

Why Spreadsheets can send the pillars of Solvency II crashing down

amazon.co.uk

amazon.com

Check our similar posts

What Heijunka is & How it Smooths Call Centre Production

The Japanese word Heijunka, pronounced hi-JUNE-kuh means ?levelling? in the sense of balancing workflows. It helps lean organizations shift priorities in the face of fluctuating customer demand. The goal is to have the entire operation working at the same pace throughout, by continuously adjusting the balance between predictability, flexibility, and stability to level out demand.

Henry Ford turned the American motor manufacturing industry upside down by mass-producing his iconic black motor cars on two separate production lines. In this photograph, body shells manufactured upstairs come down a ramp and drop onto a procession of cars almost ready to roll in 1913.

Smoothing Production in the Call Centre Industry

Call Centres work best in small teams, each with a supervisor to take over complex conversations. In the past, these tended to operate in silos with each group in semi-isolation representing a different set of clients. Calls came through to operators the instant the previous ones concluded. By the law of averages, inevitably one had more workload than the rest at a particular point in time as per this example.

Modern telecoms technology makes it possible to switch incoming lines to different call centre teams, provided these are multi-skilled. A central operator controls this manually by observing imbalanced workflows on a visual system called a Heijunka Box. The following example comes from a different industry, and highlights how eight teams share uneven demand for six products.

This departure from building handmade automobiles allowed Henry to move his workforce around to eliminate bottlenecks. For example, if rolls of seat leather arrived late he could send extra hands upstairs to speed up the work there, while simultaneously slowing chassis production. Ford had the further advantage of a virtual monopoly in the affordable car market. He made his cars at the rate that suited him best, with waiting lists extending for months.

A Modern, More Flexible Approach

Forces of open competition and the Six Sigma drive for as-close-to-zero defects dictates a more flexible approach, as embodied in this image published by the Six Sigma organisation. This represents an ideal state. In reality, one force usually has greater influence, for example decreasing stability enforces a more flexible approach.

Years ago, Japanese car manufacturer Toyota moved away from batching in favour of a more customer-centric approach, whereby buyers could customise orders from options held in stock for different variations of the same basic model. The most effective approach lies somewhere between Henry Ford?s inflexibility and Toyota?s openness, subject to the circumstances at the moment.

A Worked Factory Example

The following diagram suggests a practical Heijunka application in a factory producing three colours of identical hats. There are two machines for each option, one or both of which may be running. In the event of a large order for say blue hats, the company has the option of shifting some blue raw material to the red and green lines so to have the entire operation working at a similar rate.

Predictability, Flexibility, and Stability at Call Centre Service

The rate of incoming calls is a moving average characterised by spikes in demand. Since the caller has no knowledge whether high activity advisories are genuine, it is important to service them as quickly as possible. Lean process engineering provides technology to facilitate flexibility. Depending on individual circumstances, each call centre may have its own definition of what constitutes an acceptably stable situation.

Contact Us

(+353)(0)1-443-3807 – IRL
(+44)(0)20-7193-9751 – UK

2015 ESOS Guidelines Chapter 7, 8 & 9 – Sign-Off, Compliance & Appeals

This is the final chapter in our series of short posts summarising the quite complex ESOS guidelines (click on ?Comply with ESOS? to see the details). This one addresses the legalities to follow to complete your report – and how to appeal if you are not happy with any of the Environment Agency?s decisions.

Director Sign-Off

This is by no means an easy ride. Confirmation of the work at individual or lead assessor level locks the company into the penalty cycle in the event there are significant irregularities. By signing off the assessment, the board level director(s)^# agree that they have

Reviewed the enterprise?s ESOS recommendations
Believe the enterprise is within the scope of the scheme
Believe the enterprise is compliant with the scheme
Believe the information provided is correct

Having an internal assessor requires a second board-level signature.

Compliance

You report compliance on the internet. This is free and you can do it at any time within the deadline. You can dip in and out of the process as many times as you wish, but must use the link in the receipting email. While this is something a board member must do, there is no reason why the lead assessor should not complete the basics. The online compliance notification addresses the following topics:

The ESOS contact person in the enterprise
Any aggregation / dis-aggregation during the period
The names and contact details of the lead assessor
The proportion of energy consumption per compliance route

The Environment Agency will acknowledge receipt. This does not constitute acceptance. You should keep the ESOS evidence pack in a safe place with at least one backup elsewhere.

Compliance & Enforcement Issues

In the event the Environment Agency decides your enterprise has not met ESOS requirements, it may either (a) issue a compliance notice with instructions, or (b) apply one of the following civil penalties:

A fine of up to ?5,000 for failure to maintain records
A fine of up to ?50,000 for failure to undertake an energy audit
A fine of up to ?50,000 for a false or misleading statement

Any enterprise has the right of appeal against government decisions. In the case of ESOS, this is via:

The First-Tier Tribunal if your enterprise is England, Wales or off-shore based
The Scottish Minister if your enterprise is based in Scotland
The Planning Commission if your enterprise is Northern Ireland-based

The notice you appeal against will supply details of the appeal steps to take.

This blog and its companion chapters concerning the ESOS Guidelines as amended 2015 are with compliments of ecoVaro. We are the people who break ESOS data into manageable chunks of information, so that board-level directors have greater confidence in what they sign.

2015 ESOS Guidelines Chapter 2 – Deadlines and Status Changes

The ESOS process is deadline driven and meeting key dates is a non-negotiable. The penalties for not complying / providing false or misleading information are ?50,000 each. Simply not maintaining adequate records could cost you ?5,000. The carrot on the end of the stick is the financial benefits you stand to gain.

Qualifying for inclusion under the ESOS umbrella depends on the status of your company in terms of employee numbers, turnover and balance sheet on 31 December 2014. Regardless of whether you meet the 2014 threshold or not, you must reconsider your situation on 31 December 2018, 2022 and 2026.

Compliance Period	Qualification Date	Compliance Period	Compliance Date
1	31 December 2014	From 17 July 2014* to 5 December 2015	5 December 2015
2	31 December 2018	From 6 December 2015 to 5 December 2019	5 December 2019
3	31 December 2022	From 6 December 2019 to 5 December 2023	5 December 2023
4	31 December 2026	From 6 December 2023 to 5 December 2027	5 December 2027

Notes:

1. The first compliance period begins on the date the regulations became effective

2. Energy audits from 6 December 2011 onward may go towards the first compliance report

Changes in Organisation Status

If your organisation status changes after a qualification date when you met compliance thresholds, you are still bound to complete your ESOS assessment for that compliance period. This is regardless of any change in size or structure. Your qualification status then remains in force until the next qualification date when you must reconsider it.