Spreadsheet compliance issues 218



  • There are two things that the PwC paper covers:

    1. What spreadsheets do you need to look at - this is a function of how complex are they and how important are they to the financial statements.
    2. What controls do you need - which is covered by ‘Determine the necessary level of controlfor the spreadsheet’. Testing the spreadsheet is covered under Development Lifecycle and Logic Inspection. Some support is provided by analytics.
      Be aware that there are also several spreadsheet auditing tools out there that can help identify potential logic issues for complex spreadsheets.


  • One should try to reduce significantly the spreadsheets in scope.
    To do so you like to only look at spreadsheets which have a direct impact on your financial statements, disclosures. E.g. if you do IFRS / GAAP adjustments, asset validation, footnotes etc. in Excel. Then you start to apply the PWC Paper.
    There’s a second group of spreadsheets which is used to transport or convert data automatically into other systems. E.g. for Batch Input in SAP. These should already be covered by General IT Controls.
    I definetly wouldn’t look at Spreadsheets which are used as a key control. E.g. using XL for reconsolidation. That would be something like a control over a control. The key control is already documented…
    Everything else would take away the reasons for using excel. The individual flexibility.
    This is despite the question if Excel is right tool to prepare in significant parts your financial statements. You may like to replace those parts of your financial statement process with something more appropriate. 😄



  • There’s a second group of spreadsheets which is used to transport or convert data automatically into other systems. E.g. for Batch Input in SAP. These should already be covered by General IT Controls.

    That might be a dangerous assumption.



  • No risk no fun… 😉



  • We were advised on Thursday or Friday that we should use Track Changes on our major Excel financial spreadsheets. Because you can’t change macros or delete sheets with Track Changes on I’ve had to copy and paste history worksheets, meaning that by today I have filled up the history worksheet (yes, 65536 rows). Surely SOX doesn’t require such a mass of data that no one can possibly check through.
    This is a key spreadsheet. It reads a dump of our main business system and picks up sub-totals etc. and produces a pretty set of accounts. But every time I download new data (several times a month) it tracks it as a change. Surely this is overkill. We as a business are becoming less and less competetive because of unreasonable demands on our time.



  • We were advised on Thursday or Friday that we should use Track Changes on our major Excel financial spreadsheets.
    I’d recommend instead looking at ‘Change Management’ or ‘Change Control’ versioning products that you could use on your server. For example, you’d checkout Workbook v1.0 of the spreadsheet, modify it, and check it back in as Workbook v2.0 (perhaps with an approver).
    I’m personally using this versioning controls for serval non-SOX compliant spreadsheets I publish. It provides backups, an audit trail and history of changes, and a great way of ensuring everyone is using the correct version of the document. In my own case, I’m not using Change Management software as it’s not required.
    Versioning using Change Management software is probably a more preferrable way of handling spreadsheet changes – just like you would program source code.


Log in to reply