Spreadsheet Risk Triggers £5 Million Fine for UK Bank

While fixing the short-term problem, the prized power and flexibility of spreadsheets pose a significant operational risk.

Firstly, spreadsheets lack the controls found in corporate IT applications, so auditability and transparency are lacking. It can be unclear who made changes to a spreadsheet and who reviewed and approved it. It is also difficult to enforce any workflows needed to review and approve changes to spreadsheets.

There is little visibility of missing data or errors in spreadsheets that can lead to operational issues. Users can also easily fall into the bad habit of hard-coding information into cells, again with no transparency, leading to data quality issues and errors. Finding and updating these hard coded cells is time-consuming and error-prone.

In an ideal world, banks would replace these spreadsheets with corporate IT applications, but as we’ve seen, this is impractical. Instead, institutions need to accept that spreadsheets, and the risks involved, will feature in many core business processes, in one way or another, for the foreseeable future.

So, what can banks do to bring the management of key spreadsheets in line with corporate IT applications, reduce the risks involved, and address regulators’ concerns?

How to mitigate spreadsheet risk

The first step is creating a spreadsheet inventory.

This provides a foundation for centralizing the management, review, and visibility of the critical spreadsheet estate used in the business. It also provides a repository for the documentation essential for defining and controlling the core spreadsheets used in a company.

The next phase is the proactive monitoring of the critical spreadsheets.

This is done to ensure that changes are transparent to all and minimizes issues related to missing data, flawed calculations and formulas, or stale data.

The last phase – Discovery – is where companies find mission-critical spreadsheets they need to manage that are not included in the inventory.

The key here is to find the most significant spreadsheets used, defined by a range of parameters, including who uses a file, how often it is changed, what other applications and data sources it is linked to, and other relevant criteria. User input can be included here to refine the search criteria.