The letter highlighted that regulatory reporting was highly fragmented, those involved were often too junior, and that there was often insufficient management supervision. There were also issues in how spreadsheets were used in ways that made transparency and auditability challenging to achieve. This situation can lead to potential scope for misreporting in the regulatory process.

One area that the PRA highlighted as a source of concern was the reporting reconciliation process.

Reconciliation and the perils of EUCs

The reporting reconciliation process is at the core of regulatory reporting. It covers the way that the various elements that make up regulatory reports – results, model reports, supporting documentation, and much else – are consolidated and checked. Clearly, these results need to be anchored on the data drawn from core systems, but equally, there needs to be scope to allow managers to apply expert judgment to the results before submission. Managers need to be able to present – and defend –regulatory submissions that have been reviewed, to give a coherent picture that aligns with other reports available to shareholders and counterparties.

While valuable to the business, this power and flexibility comes at the expense of management controls, which reduce the transparency and the auditability the PRA expects. A key point raised by the PRA was the need to anchor the reconciliation process in the general ledger data.

The expectation of the PRA is for ‘the reconciliation process to be a formal and comprehensive process reconciling regulatory flows to appropriate records, for every submission cycle.’

How do you reconcile this expectation while using EUCs that are central to many regulatory reconciliation processes?

A solution to the EUC issue

Here’s a three-step solution to this situation:

Step 1 is to create an inventory of all the spreadsheet-based EUCs used in your final mile reporting. A centralized inventory provides the foundation for the management controls that allow users to utilize spreadsheets while providing evidence of who amended critical spreadsheets, when, and who approved the change. It provides document management capabilities that enable end-users and risk and audit teams to understand the purpose, design, and ownership of a spreadsheet used in the reconciliation process. It also helps institutions apply and enforce their spreadsheet management policy efficiently and effectively, helping reduce the scope for errors when using mission-critical EUCs.

Step 2 is to go through a discovery and assessment process to understand better these essential files used in the reconciliation process. The expectations of best practice by the PRA mean that firms should be aware of how these spreadsheets are connected to other applications, spreadsheets, and data sources. This process ensures firms are aware of the provenance of the data flowing into these regulatory reports.

Step 3 involves proactively monitoring the key EUCs engaged in the reconciliation process. This process allows for changes to crucial spreadsheets and errors, missing data, and broken data links to be identified and flagged for resolution if necessary. It provides the basis for the effective risk management of the reconciliation process and helps deliver the transparency and auditability the PRA expects.

Putting technology to work in managing spreadsheets

For many firms, particularly after the pivot to remote workforces, the size of their EUC estate has become even more dispersed, making manual oversight nearly impossible. It’s why more of them are electing to deploy technology platforms that can fulfill this crucial discovering and monitoring role.