Mitigating against spreadsheet risk

By Robert Half 20th August 2019

Ever feel like you're drowning in spreadsheets? Modern business has become so reliant on them it's hard to imagine how we could survive without all our spreadsheets and databases. But as businesses invest in technology to improve processes, and data grows, and formulas get more complex, it's important that businesses don't take the accuracy of those spreadsheets for granted. According to studies by Protiviti, errors are found in 94 percent of spreadsheets. 

We are all guilty of placing a high reliance on spreadsheets. Management information permeates every area of business. We rely on them for key risk and deriving strategic business decisions, as well as operational, financial and regulatory reporting, so businesses must investigate and check the integrity of those spreadsheets and the formulas they are running. With links to other internal data feeds, complicated analysis and sophisticated algorithms, even small errors can easily result in significant financial and reputational consequences if left unchecked.

Identifying and mitigating against spreadsheet risk

Increased scrutiny and reporting requirements from regulators is causing businesses to be more alert when it comes to spreadsheet management. There are a number of key principles businesses and professionals can follow to ensure that spreadsheet risks are properly identified and mitigated. As a starting point, minimum control standards for spreadsheets should be set out in a Spreadsheet Risk Management Policy. This document should set out the organisation's rules around spreadsheets, including: 

1. Identifying roles and responsibilities

Who is responsible for the accuracy of spreadsheets? Who manages them and who is making sure the results of those spreadsheets are valid? Who is communicating the findings to the business?

While the IT department usually takes responsibility for the software that runs the spreadsheets, it is typically the owners and users of the thousands of individual spreadsheets across the company who must ensure the spreadsheets they are using and working on are accurate and the data is translatable into meaningful results that can help drive businesses to make strategic decisions. 

2. Identifying the right users

Having too many users of a spreadsheet can easily lead to version control issues and data input validation errors. The policy should set out minimum standards that include restricted access; backup requirements; data input validation and version control standards.

3. Operational risk reporting

Spreadsheet risk must be incorporated into the overall risk framework of an organisation and expressly included on risk reports to executives. As part of this process, all spreadsheets need an overall risk rating (this may require an inventory and review of existing spreadsheets).

It is helpful if all spreadsheets are given a low, medium or high-risk rating, which will determine how closely that spreadsheet should be scrutinised by the business and when professionals come to analysing them. That rating depends on the potential business impact from an error in the spreadsheet and takes into account the complexity of the spreadsheet (e.g. the likelihood that an error might occur increases the larger the spreadsheet, the greater the number of users and the complexity of formulas).

4. Performing periodic checks

The policy document should prescribe minimum requirements for periodic sense checks of spreadsheets. If errors are found when testing individual spreadsheets, the policy controls themselves should be reviewed.

Is automation the solution for spreadsheet risk?

Spreadsheets will also be a part of a business and these four basic steps above can help reduce the risk businesses take in relying heavily on the number-crunching going on behind the scenes in our spreadsheets. As technology solutions grow and more data can be stored through an automated process, it should allow for greater controls around the risks of errors. Other potential benefits include meeting regulatory and data privacy, increased efficiencies and increased data analysis. 

We are seeing businesses looking to hire accounting and finance professionals who have experience in technology software and senior professionals with the experience automating the finance function. All in all, it is a sign that businesses recognise the need to bring in resources who have the technical expertise and a high degree of risk management awareness to help with their spreadsheet risk.


At Robert Half we specialise in placing highly skilled professionals within a wide range of companies across the UAE. Contact our experienced recruitment consultants today to help you find professionals that are best for your business.

More From the Blog...