Spreadsheet Risk - A New Direction for HMRC?

Her Majesty’s Revenue & Customs (HMRC) was born out of the need to create a UK tax authority by merging both the Inland Revenue and HM Customs & Excise into one department. HMRC encounters spreadsheets in tax-payers’ systems on a very regular basis as well as being a heavy user of spreadsheets internally. The approach to spreadsheet risk assessment and spreadsheet audit is by the use of trained computer auditors and data handlers. This, by definition, limits the use of our specialist spreadsheet audit tool to such trained staff. In order to tackle the growing use of spreadsheets, a new way of approaching the problem has been piloted. The aim is to issue all staff who come across spreadsheets with a simple to use analysis and risk assessment tool, based on the departmental software SpACE (Spreadsheet Audit & Compliance Examination). 1. BACKGROUND Historically, UK tax authorities have been encountering spreadsheets during systems audits at businesses since the inception of spreadsheets; however the risks inherent didn’t immediately manifest themselves and it was some time before they became apparent and were ultimately acknowledged. Initially it was computer auditors who, having recognised the existence of these risks, were able to address them using software tools to examine the spreadsheet in detail at file level rather than as hard copies. In fact, Ray Butler’s paper, “Is this spreadsheet a tax evader” did much to raise awareness of those risks, and it was subsequently to help prove the problem was common amongst the international community and was not restricted to the United Kingdom. Spreadsheets used by businesses may serve many purposes, some of which include the monitoring or controlling of both direct or indirect taxes, which in the UK includes taxes such as VAT, Corporation Tax and PAYE. They usually play a major role within the business accounts and will likely be found at the most critical points in the audit trail, significantly impacting upon the revenue base. They are often designed and developed by company employees who are rarely qualified to do so and are seldom checked to make sure they do what was actually intended, not realising that creating a spreadsheet is akin to programming and the untested spreadsheet is as dangerous and untrustworthy as an untested program. 2. OUR APPROACH Having recognised and acknowledged the inherent risks posed by the use of spreadsheets within audit trails, we created our own spreadsheet audit tool, SpACE (Spreadsheet Audit & Compliance Examination), designed, written and developed to our own specification, to allow us to begin examining spreadsheet files in-depth. This provided us with a means Spreadsheet Risk A new direction for HMRC? Price Page 2 to test the accuracy and completeness of those spreadsheets and as expected we found errors. Obviously, from the thousands of spreadsheets HMRC encounters, realistically only a small proportion can be examined in depth by our specialist auditors using SpACE. To help us decide which spreadsheets to target, we use our own methodology, naturally risk based – i.e., how much potential tax revenue is at risk? This question will then be followed by others about the spreadsheet itself, its design, development, author, documentation and place in the audit trail, all of which will inform the risk process. Some spreadsheets reviewed belong to stock or accounting datasets which are more suitably examined using file interrogation software, such as IDEA or ACL, rather than carrying out a full spreadsheet audit using SpACE. As mentioned previously, should a full spreadsheet audit using SpACE be warranted, then this will be carried out by specially trained staff, most of whom are computer auditors, data handlers or internal auditors. SpACE of course is widely established and well known to colleagues within EuSpRIG. For more information on obtaining a copy for either evaluation or purchase, please see the Lexis Nexis website at http://rimer.butterworths.co.uk/webcat/enquiry/index.htm and search for “SpACE”.