Managing Critical Spreadsheets in a Compliant Environment

The use of uncontrolled financial spreadsheets can expose organizations to unacceptable business and compliance risks, including errors in the financial reporting process, spreadsheet misuse and fraud, or even significant operational errors. These errors have been well documented and thoroughly researched by the European Spreadsheet Risks Interest Group [EuSpRIG, 2005]. With the advent of regulatory mandates such as SOX 404 and FDICIA in the U.S., and MiFID, Basel II and Combined Code in the UK, leading tax and audit firms are now recommending organizations automate internal controls over critical spreadsheets and other end-use computing applications, including Microsoft Access databases. At a minimum, auditors mandate version control, change control and access control for operational spreadsheets, and more advanced controls for critical financial spreadsheets [PwC, 2004]. While regulatory compliance has remained a key business driver, many organizations are implementing spreadsheet controls to manage operational risk, and to achieve sound corporate governance and process improvements.