Spreadsheet risks (a comedy of errors)

Here is a pretty good read by Forrester called “Controls to Mitigate Spreadsheet Risk” about the risks inherent in using spreadsheets; it includes a list of common spreadsheet risks including these:

• Lack of audit trail
• Poor security and access controls
• History of errors and fraud

Many of these are root causes of downstream outcomes like financial loss, legal issues, loss of reputation, loss of stock price, fines and penalties and of course, job losses. To the auditors in the room, there is a list recommended controls to mitigate the risk which might tickle your fancy.

But are spreadsheets only to blame? How about the people?

My favourite spreadsheet experience is when someone in an operations or financial control area inherits a spreadsheet from a predecessor without really understanding what it does. Often, as part of their training, they get step-by-step task list which reads like this:

• Save file A.xls to C:/Documents/Barry
• Open file Sales_Report.xls, to Sheet 1
• Change the date in cell A1
• Push the macro button called “Import”
• Go to worksheet called “data” and copy everything
• Paste to cell A2 in worksheet called “Report”.
• Then go to Sheet 2 and copy the value in cell F6 called “Total Sales”.

(I hope some of you know exactly what I mean and get a laugh from this. Sad but funny.)

What I love about this is that the value cell F6, is a summation (Σ) calculation being performed against the first 200 lines of data in the worksheet “data”, even though there are over 500 lines of data imported there on this day. But the spreadsheet’s creator was short-sighted – never figuring there would be more than 200 lines of data – and the current user doen’t know better. So without knowing it, the sales data is wrong every day. (Trust me, this happens.)

Truth is, spreadsheets or technologies are not always the only risk and nor are they the solution. At least 50% of the risk has to be assigned to the people.

Finally, I am hesitant to include a link to this one because although I found it in the public domain and this document is available to Forrester clients, I also see that they are charging $500 for it. To read it, I recommend doing a Google search against these terms << “Controls To Mitigate Spreadsheet Risk” pdf  >>to find it.