Open Platform: Supervising Spreadsheets to Manage Risk

What connects a billion-dollar reporting mistake by a global oil giant and an error in the growth of the UK construction industry by the UK’s Office of National Statistics? The answer is spreadsheet risk. By Ralph Baxter

The most recent example of the seriousness of spreadsheet risk concerns the UK’s Office of National Statistics (ONS). On August 12 this year, the ONS issued a correction after admitting an “arithmetical error” had caused it to overstate the strength of the UK construction industry for the second quarter by 180 basis points. According to the ONS’ initial calculation, the sector grew 2.3 percent in the three months to June—enough for some economists to revise upward UK economic prospects. The ONS subsequently cut the number to 0.5 percent.

While a significant number of firms have introduced processes and controls to eradicate spreadsheet risk and are managing to successfully avoid financial inconsistencies, cases such as that of the ONS are far from rare. Think of the profound way modern businesses, financial services institutions and insurers across the world use spreadsheets to manage their affairs—the truth is that at the heart of any business decision is a spreadsheet.

Their use has become widespread, from performing complex modeling for trading decisions to accounting reconciliations and financial reporting. A review of a typical corporate network would reveal thousands to millions in use.

Limited Options
Despite a desire by many firms to replace spreadsheets with robust, centrally managed applications, the reality is that spreadsheets are often the only solution that can address immediate needs. For example, treasury management systems were not developed to manage each new and creative financial instrument that has appeared over the past decade. The only logical step has been to use one or more spreadsheets to record millions or even trillions of dollars’ worth of transactions and associated repayments and risk.

And this pace of use is growing all the time. With an intensifying regulatory burden, demands from shareholders and auditors for more transparency, and internal demands for firms to maximize business opportunities, spreadsheet usage is increasing considerably. Their systemic importance has been noted by regulators and auditors: Most recently, the UK’s Financial Services Authority (FSA) has stated that one of the biggest risks for insurance companies in the run-up to Solvency II is managing the data contained in large estates of spreadsheets.

The latest guidance from the Federal Reserve and the Office of the Comptroller of the Currency on model risk management, directed at US banks, has many similarities with the FSA’s Solvency II guidance.

However, while it is encouraging to see the FSA and major institutions treating spreadsheet risk as a serious issue, it is important to emphasize there are still organizations leaving themselves exposed. These firms are being left behind in a global competitiveness race and in danger of financial and reputational risk by not establishing an ownership policy or instigating a coordinated and transparent global control environment.

Avoiding spreadsheet errors has therefore become crucial, and the issue has become how companies can control data management systems to minimize the threat of the wrong data becoming integrated into a business without someone noticing—or being made to notice.

Firms need to examine much more proactively the control systems and procedures in place that would allow spreadsheet risks to be flagged. Indeed, while effective oversight and controls are critical in avoiding spreadsheet risk, there are other benefits that follow from a proper data management system: corporate efficiency, increased transparency, and the ability to generate value and opportunities from better quality data. Even when spreadsheets are completed accurately, time moves on and people leave the business without necessarily explaining to colleagues how a spreadsheet works or where data came from to populate it. The problem is not the spreadsheet, per se, but how it is managed and monitored.

Proactive View
In our experience, very few organizations take a proactive view of spreadsheet usage across the organization. According to research by ClusterSeven, just over one in two (56.5 percent) of spreadsheet users have never received formal training on the spreadsheet package they use.

Almost three-quarters of respondents (72 percent) admit that no internal department checks their spreadsheets for accuracy. Only 12.9 percent said an internal audit reviews their spreadsheets, while a mere 1.1 percent receive checks from their risk department.

While firms feel they may manage spreadsheet processes accurately and effectively, it is unlikely that they will have seen the full extent of the spreadsheet estate, and their interdependent relationships, or fully understand the controls in place to check data.

The first step for firms is therefore to understand what they have, where it is, and how it is connected to their business applications. By allocating direct responsibility and establishing a unified risk management process, organizations can start to mitigate the threats they face. In some companies, spreadsheet risk is not even on the agenda; it is only when a serious financial mistake occurs that this subject is given priority.

Trigger
This means that the main trigger for firms to invoke an investigation is a request from the business to document and explain their internal systems or models. Of course it is possible to trawl through every user application manually, but this can result in a discovery outcome that not only takes an extraordinary amount of time, but that is also out of date once completed.

On top of more robust accountability and management architecture, using the right tools and technological application, firms can now automatically scan their networks to intelligently locate key spreadsheets and access databases. This builds a complete dependence tree that demonstrates the relationships between files with multiple connections.

On their own, user-developed applications such as spreadsheets and access databases have demonstrated the flexibility to support many processes over recent decades. However, it is becoming clear that without careful monitoring and management they may lack the robustness to meet the demands of increasing compliance with regulation such as Solvency II or Basel III.

Complexity
This is not because of user error—by the nature of their work, most financial professionals are extremely careful and accurate in their calculations. It is the sheer complexity of interdependent spreadsheets across the business that organizations need to be aware of.

Spreadsheets are a vital component of day-to-day calculations, tasks and processes. For companies facing the obligations of new regulation it is therefore a major challenge to see how they can maintain this critical flexibility but also demonstrate overall control to the authorities. Financial institutions and businesses are facing up to the fact that they need to tackle the data risk issue as a matter of urgency.

Ralph Baxter is CEO of ClusterSeven, a London- and New York-based provider of spreadsheet and data management software to financial institutions and financial reporting divisions.