Stop That Subversive Spreadsheet!

David Chadwick

DOI: https://doi.org/10.48550/arXiv.0712.2594

2007-12-16

General Literature

Abstract:This paper documents the formation of the European Spreadsheet Risks Interest Group (EuSpRIG www.eusprig.org) and outlines some of the research undertaken and reported upon by interested parties in EuSpRIG publications

What problem does this paper attempt to address?

Qtier-Rapor: Managing Spreadsheet Systems & Improving Corporate Performance, Compliance and Governance

Keith Bishop

DOI: https://doi.org/10.48550/arXiv.0803.0011

2008-02-29

Other Computer Science

Abstract:Much of what EuSpRIG discusses is concerned with the integrity of individual spreadsheets. In businesses, interlocking spreadsheets are regularly used to fill functional gaps in core administrative systems. The growth and deployment of such integrated spreadsheet SYSTEMS raises the scale of issues to a whole new level. The correct management of spreadsheet systems is necessary to ensure that the business achieves its goals of improved performance and good corporate governance, within the constraints of legislative compliance - poor management will deliver the opposite. This paper is an anatomy of the real-life issues of the commercial use of spreadsheets in business, and demonstrates how Qtier-Rapor has been used to instil best practice in the use of integrated commercial spreadsheet systems.
Spreadsheet Risk Management in Organisations

Ben G. Rittweger,Eoin Langan

DOI: https://doi.org/10.48550/arXiv.1009.2775

2010-09-15

Abstract:The paper examines in the context of financial reporting, the controls that organisations have in place to manage spreadsheet risk and errors. There has been widespread research conducted in this area, both in Ireland and internationally. This paper describes a study involving 19 participants (2 case studies and 17 by survey) from Ireland. Three areas are examined; firstly, the extent of spreadsheet usage, secondly, the level of complexity employed in spreadsheets, and finally, the controls in place regarding spreadsheets. The findings support previous findings of Panko (1998), that errors occur frequently in spreadsheets and that there is little or unenforced controls employed, however this research finds that attitudes are changing with regard to spreadsheet risk and that one organisation is implementing a comprehensive project regarding policies on the development and control of spreadsheets. Further research could be undertaken in the future to examine the development of a "best practice model" both for the reduction in errors and to minimise the risk in spreadsheet usage.

Software Engineering
Spreadsheet Risk - A New Direction for HMRC?

D. Price

DOI: https://doi.org/10.48550/arXiv.0711.4613

2007-11-28

Computers and Society

Abstract:Her Majestys Revenue & Customs (HMRC) was born out of the need to create a UK tax authority by merging both the Inland Revenue and HM Customs & Excise into one department. HMRC encounters spreadsheets in tax-payers systems on a very regular basis as well as being a heavy user of spreadsheets internally. The approach to spreadsheet risk assessment and spreadsheet audit is by the use of trained computer auditors and data handlers. This, by definition, limits the use of our specialist spreadsheet audit tool to such trained staff. In order to tackle the growing use of spreadsheets, a new way of approaching the problem has been piloted. The aim is to issue all staff who come across spreadsheets with a simple to use analysis and risk assessment tool, based on the departmental software SpACE (Spreadsheet Audit & Compliance Examination).
A Pilot Study Exploring Spreadsheet Risk in Scientific Research

Ghada AlTarawneh,Simon Thorne

DOI: https://doi.org/10.48550/arXiv.1703.09785

2017-03-23

Computers and Society

Abstract:This paper discusses the risks and potential impacts of spreadsheet errors in scientific research data in a Neuroscience research centre in the UK. Spreadsheets usage in neuroscience, or indeed any medical discipline, is a largely unreported area of spreadsheet research. This paper presents a case study exploring the possible risks and impacts of spreadsheet errors in the neuroscience research centre at the University of Newcastle. Data was collected using an online questionnaire with 17 participants and two detailed semi-structured interviews. The analysis highlights that errors in research data may lead to severe impacts such as misleading science and damaged personal and organisational reputations. In addition, many risks factors arise from using spreadsheets such as inadequate design and a lack of training. Spreadsheets are used widely in business and the impacts and risks in these fields have been studied and highlighted in detail. However, scientific research and spreadsheets have also a significant relationship that has not been clarified. The paper also draws out the similarities in spreadsheet practice between the scientific and business communities.
A Practical Approach to Managing Spreadsheet Risk in a Global Business

Thomas Lemon,Ewen Ferguson

DOI: https://doi.org/10.48550/arXiv.1009.1404

2010-09-08

Abstract:Spreadsheets are used extensively within today's organisations. Although spreadsheets have many benefits, they can also present a significant risk exposure, requiring appropriate management. Protiviti has worked with a number of organisations, ranging in size up to huge multi-nationals, to help them build appropriate spreadsheet governance frameworks, including the design and implementation of policies, minimum design standards, control processes, training and awareness programmes and the consideration and implementation of spreadsheet management tools. This paper presents a case-study explaining the practical and pragmatic approach that was recently taken to control spreadsheet risk at one of Protiviti's clients - a global energy firm.

Software Engineering,Computers and Society
Teaching Spreadsheets: Curriculum Design Principles

Francoise Tort

DOI: https://doi.org/10.48550/arXiv.1009.2787

2010-09-15

Abstract:EuSpRIG concerns direct researchers to revisit spreadsheet education, taking into account error auditing tools, checklists, and good practices. This paper aims at elaborating principles to design a spreadsheet curriculum. It mainly focuses on two important issues. Firstly, it is necessary to establish the spreadsheet invariants to be taught, especially those concerning errors and good practices. Secondly, it is important to take into account the learners' ICT experience, and to encourage them to attitudes that foster self-learning. We suggest key principles for spreadsheet teaching, and we illustrate them with teaching guidelines.

Software Engineering
Establishing A Minimum Generic Skill Set For Risk Management Teaching In A Spreadsheet Training Course

David Chadwick

DOI: https://doi.org/10.48550/arXiv.0802.3481

IF: 6.4588

2008-02-24

Human-Computer Interaction

Abstract:Past research shows that spreadsheet models are prone to such a high frequency of errors and data security implications that the risk management of spreadsheet development and spreadsheet use is of great importance to both industry and academia. The underlying rationale for this paper is that spreadsheet training courses should specifically address risk management in the development process both from a generic and a domain-specific viewpoint. This research specifically focuses on one of these namely those generic issues of risk management that should be present in a training course that attempts to meet good-practice within industry. A pilot questionnaire was constructed showing a possible minimum set of risk management issues and sent to academics and industry practitioners for feedback. The findings from this pilot survey will be used to refine the questionnaire for sending to a larger body of possible respondents. It is expected these findings will form the basis of a risk management teaching approach to be trialled in a number of selected ongoing spreadsheet training courses.
In Pursuit of Spreadsheet Excellence

Grenville J. Croll

DOI: https://doi.org/10.48550/arXiv.0806.3536

2008-06-22

Abstract:The first fully-documented study into the quantitative impact of errors in operational spreadsheets identified an interesting anomaly. One of the five participating organisations involved in the study contributed a set of five spreadsheets of such quality that they set the organisation apart in a statistical sense. This virtuoso performance gave rise to a simple sampling test - The Clean Sheet Test - which can be used to objectively evaluate if an organisation is in control of the spreadsheets it is using in important processes such as financial reporting.

Software Engineering,Human-Computer Interaction
Comparison of Spreadsheets with other Development Tools (limitations, solutions, workarounds and alternatives)

Simon Murphy

DOI: https://doi.org/10.48550/arXiv.0801.3853

2008-01-25

Abstract:The spreadsheet paradigm has some unique risks and challenges that are not present in more traditional development technologies. Many of the recent advances in other branches of software development have bypassed spreadsheets and spreadsheet developers. This paper compares spreadsheets and spreadsheet development to more traditional platforms such as databases and procedural languages. It also considers the fundamental danger introduced in the transition from paper spreadsheets to electronic. Suggestions are made to manage the risks and work around the limitations.

Software Engineering,Computers and Society
Spreadsheets and the Financial Collapse

Grenville J. Croll

DOI: https://doi.org/10.48550/arXiv.0908.4420

2009-08-31

Abstract:We briefly review the well-known risks, weaknesses and limitations of spreadsheets and then introduce some more. We review and slightly extend our previous work on the importance and criticality of spreadsheets in the City of London, introducing the notions of ubiquity, centrality, legality and contagion. We identify the sector of the financial market that we believed in 2005 to be highly dependant on the use of spreadsheets and relate this to its recent catastrophic financial performance. We outline the role of spreadsheets in the collapse of the Jamaican banking system in the late 1990's and then review the UK financial regulator's knowledge of the risks of spreadsheets in the contemporary financial system. We summarise the available evidence and suggest that there is a link between the use of spreadsheets and the recent collapse of the global financial system. We provide governments and regulating authorities with some simple recommendations to reduce the risks of continued overdependence on unreliable spreadsheets. We conclude with three fundamental lessons from a century of human error research.

Computers and Society,Human-Computer Interaction
TellTable Spreadsheet Audit: from Technical Possibility to Operating Prototype

John Nash,Andy Adler,Neil Smith

DOI: https://doi.org/10.48550/arXiv.0803.1751

2008-03-12

Software Engineering

Abstract:At the 2003 EuSpRIG meeting, we presented a framework and software infrastructure to generate and analyse an audit trail for a spreadsheet file. This report describes the results of a pilot implementation of this software (now called TellTable; see www.telltable.com), along with developments in the server infrastructure and availability, extensions to other "Office Suite" files, integration of the audit tool into the server interface, and related developments, licensing and reports. We continue to seek collaborators and partners in what is primarily an open-source project with some shared-source components.
Automating Spreadsheet Discovery & Risk Assessment

Eric Perry

DOI: https://doi.org/10.48550/arXiv.0809.3016

2008-09-17

Software Engineering

Abstract:There have been many articles and mishaps published about the risks of uncontrolled spreadsheets in today's business environment, including non-compliance, operational risk, errors, and fraud all leading to significant loss events. Spreadsheets fall into the realm of end user developed applications and are often absent the proper safeguards and controls an IT organization would enforce for enterprise applications. There is also an overall lack of software programming discipline enforced in how spreadsheets are developed. However, before an organization can apply proper controls and discipline to critical spreadsheets, an accurate and living inventory of spreadsheets across the enterprise must be created, and all critical spreadsheets must be identified. As such, this paper proposes an automated approach to the initial stages of the spreadsheet management lifecycle - discovery, inventory and risk assessment. Without the use of technology, these phases are often treated as a one-off project. By leveraging technology, they become a sustainable business process.
Development and Experimentation of a Software Tool for Identifying High Risk Spreadsheets for Auditing

Mahmood H. Shubbak,Simon Thorne

DOI: https://doi.org/10.48550/arXiv.1602.05231

2016-02-17

Abstract:Heavy use of spreadsheets by organisations bears many potential risks such as errors, ambiguity, data loss, duplication, and fraud. In this paper these risks are briefly outlined along with their available mitigation methods such as: documentation, centralisation, auditing and user training. However, because of the large quantities of spreadsheets used in organisations, applying these methods on all spreadsheets is impossible. This fact is considered as a deficiency in these methods, a gap which is addressed in this paper. In this paper a new software tool for managing spreadsheets and identifying the risk levels they include is proposed, developed and tested. As an add-in for Microsoft Excel application, "Risk Calculator" can automatically collect and record spreadsheet properties in an inventory database and assign risk scores based on their importance, use and complexity. Consequently, auditing processes can be targeted to high risk spreadsheets. Such a method saves time, effort, and money.

Software Engineering
Spreadsheets in Financial Departments: An Automated Analysis of 65,000 Spreadsheets using the Luminous Technology

Kevin McDaid,Ronan MacRuairi,Neil Clynch,Kevin Logue,Cian Clancy,Shane Hayes

DOI: https://doi.org/10.48550/arXiv.1111.6866

2011-11-29

Software Engineering

Abstract:Spreadsheet technology is a cornerstone of IT systems in most organisations. It is often the glue that binds more structured transaction-based systems together. Financial operations are a case in point where spreadsheets fill the gaps left by dedicated accounting systems, particularly covering reporting and business process operations. However, little is understood as to the nature of spreadsheet usage in organisations and the contents and structure of these spreadsheets as they relate to key business functions with few, if any, comprehensive analyses of spreadsheet repositories in real organisations. As such this paper represents an important attempt at profiling real and substantial spreadsheet repositories. Using the Luminous technology an analysis of 65,000 spreadsheets for the financial departments of both a government and a private commercial organisation was conducted. This provides an important insight into the nature and structure of these spreadsheets, the links between them, the existence and nature of macros and the level of repetitive processes performed through the spreadsheets. Furthermore it highlights the organisational dependence on spreadsheets and the range and number of spreadsheets dealt with by individuals on a daily basis. In so doing, this paper prompts important questions that can frame future research in the domain.
A Computational Framework for the Near Elimination of Spreadsheet Risk

Yusuf Jafry,Fredrika Sidoroff,Roger Chi

DOI: https://doi.org/10.48550/arXiv.0803.1748

2008-03-12

Software Engineering

Abstract:We present Risk Integrated's Enterprise Spreadsheet Platform (ESP), a technical approach to the near-elimination of spreadsheet risk in the enterprise computing environment, whilst maintaining the full flexibility of spreadsheets for modelling complex financial structures and processes. In its Basic Mode of use, the system comprises a secure and robust centralised spreadsheet management framework. In Advanced Mode, the system can be viewed as a robust computational framework whereby users can "submit jobs" to the spreadsheet, and retrieve the results from the computations, but with no direct access to the underlying spreadsheet. An example application, Monte Carlo simulation, is presented to highlight the benefits of this approach with regard to mitigating spreadsheet risk in complex, mission-critical, financial calculations.
Risk Management for Complex Calculations: EuSpRIG Best Practices in Hybrid Applications

Deborah Cernauskas,Andrew Kumiega,Ben VanVliet

DOI: https://doi.org/10.48550/arXiv.0803.1866

IF: 6.4588

2008-03-12

Human-Computer Interaction

Abstract:As the need for advanced, interactive mathematical models has increased, user/programmers are increasingly choosing the MatLab scripting language over spreadsheets. However, applications developed in these tools have high error risk, and no best practices exist. We recommend that advanced, highly mathematical applications incorporate these tools with spreadsheets into hybrid applications, where developers can apply EuSpRIG best practices. Development of hybrid applications can reduce the potential for errors, shorten development time, and enable higher level operations. We believe that hybrid applications are the future and over the course of this paper, we apply and extend spreadsheet best practices to reduce or prevent risks in hybrid Excel/MatLab applications.
Transforming Critical Spreadsheets into Web Applications at Zurich Financial

Sebastian Dewhurst

DOI: https://doi.org/10.48550/arXiv.1009.1407

2010-09-08

Abstract:In the insurance industry, spreadsheets have emerged as an invaluable tool to for product pricing, because it is relatively straightforward to create and maintain complex pricing models using Excel. In fact, Excel is often preferred to "hard-code" whenever there are frequent changes to the calculations and business logic which under-pin the pricing of an insurance product. However, problems arise as soon as spreadsheets are deployed to end-users: version control, security of intellectual property, and ensuring correct usage are obvious issues; frequently, integration with other systems is also a requirement. Zurich Financial Services Group is a leading financial services provider; several possible solutions to these problems have been evaluated, and EASA has been selected as the preferred technology. Other spreadsheet collaboration approaches which were considered include Excel Services, and/or custom-built software; however, EASA has provided clear benefits over these strategies.

Software Engineering,Computers and Society
Protecting Spreadsheets Against Fraud

Roland T. Mittermeir,Markus Clermont,Karin Hodnigg

DOI: https://doi.org/10.48550/arXiv.0801.4268

2008-01-28

Abstract:Previous research on spreadsheet risks has predominantly focussed on errors inadvertently introduced by spreadsheet writers i.e. it focussed on the end-user aspects of spreadsheet development. When analyzing a faulty spreadsheet, one might not be able to determine whether a particular error (fault) has been made by mistake or with fraudulent intentions. However, the fences protecting against fraudulent errors have to be different from those shielding against inadvertent mistakes. Faults resulting from errors committed inadvertently can be prevented ab initio by tools that notify the spreadsheet writer about potential problems whereas faults that are introduced on purpose have to be discovered by auditors without the cooperation of their originators. Even worse, some spreadsheet writers will do their best to conceal fraudulent parts of their spreadsheets from auditors. In this paper we survey the available means for fraud protection by contrasting approaches suitable for spreadsheets with those known from fraud protection for conventional software.

Computers and Society,Cryptography and Security
Managing Critical Spreadsheets in a Compliant Environment

Soheil Saadat

DOI: https://doi.org/10.48550/arXiv.0805.4211

2008-05-28

Abstract:The use of uncontrolled financial spreadsheets can expose organizations to unacceptable business and compliance risks, including errors in the financial reporting process, spreadsheet misuse and fraud, or even significant operational errors. These risks have been well documented and thoroughly researched. With the advent of regulatory mandates such as SOX 404 and FDICIA in the U.S., and MiFID, Basel II and Combined Code in the UK and Europe, leading tax and audit firms are now recommending that organizations automate their internal controls over critical spreadsheets and other end-user computing applications, including Microsoft Access databases. At a minimum, auditors mandate version control, change control and access control for operational spreadsheets, with more advanced controls for critical financial spreadsheets. This paper summarises the key issues regarding the establishment and maintenance of control of Business Critical spreadsheets.

Software Engineering,Human-Computer Interaction
Investigating the use of Software Agents to Reduce The Risk of Undetected Errors in Strategic Spreadsheet Applications

Pat Cleary,Dr David Ball,Mukul Madahar,Simon Thorne,Christopher Gosling,Karen Fernandez

DOI: https://doi.org/10.48550/arXiv.0806.0189

IF: 6.4588

2008-06-01

Human-Computer Interaction

Abstract:There is an overlooked iceberg of problems in end user computing. Spreadsheets are developed by people who are very skilled in their main job function, be it finance, procurement, or production planning, but often have had no formal training in spreadsheet use. IT auditors focus on mainstream information systems but regard spreadsheets as user problems, outside their concerns. Internal auditors review processes, but not the tools that support decision making in these processes. This paper highlights the gaps between risk management and end user awareness in spreadsheet research. In addition the potential benefits of software agent technologies to the management of risk in spreadsheets are explored. This paper discusses the current research into end user computing and spreadsheet use awareness.

Stop That Subversive Spreadsheet!

Qtier-Rapor: Managing Spreadsheet Systems & Improving Corporate Performance, Compliance and Governance

Spreadsheet Risk Management in Organisations

Spreadsheet Risk - A New Direction for HMRC?

A Pilot Study Exploring Spreadsheet Risk in Scientific Research

A Practical Approach to Managing Spreadsheet Risk in a Global Business

Teaching Spreadsheets: Curriculum Design Principles

Establishing A Minimum Generic Skill Set For Risk Management Teaching In A Spreadsheet Training Course

In Pursuit of Spreadsheet Excellence

Comparison of Spreadsheets with other Development Tools (limitations, solutions, workarounds and alternatives)

Spreadsheets and the Financial Collapse

TellTable Spreadsheet Audit: from Technical Possibility to Operating Prototype

Automating Spreadsheet Discovery & Risk Assessment

Development and Experimentation of a Software Tool for Identifying High Risk Spreadsheets for Auditing

Spreadsheets in Financial Departments: An Automated Analysis of 65,000 Spreadsheets using the Luminous Technology

A Computational Framework for the Near Elimination of Spreadsheet Risk

Risk Management for Complex Calculations: EuSpRIG Best Practices in Hybrid Applications

Transforming Critical Spreadsheets into Web Applications at Zurich Financial

Protecting Spreadsheets Against Fraud

Managing Critical Spreadsheets in a Compliant Environment

Investigating the use of Software Agents to Reduce The Risk of Undetected Errors in Strategic Spreadsheet Applications