Audit Knowledge Base

Nearly 30 percent of participants in a recent Deloitte webcast said their spreadsheets are not considered as part of their organization's periodic risk assessment process. Yet, installation of effective, auditable controls surrounding critical spreadsheets and their use can have a direct impact on financial reporting and compliance. A carefully structured approach to spreadsheet management can help protect critical spreadsheets. Implementing a controlled environment can be achieved, albeit with challenges, which can be identified more clearly in addressing questions, including:

• How many versions of a given spreadsheet are out there? Who else is modifying this spreadsheet? Which is the correct or most-recent version?
• Who can view or modify data in the spreadsheet? Should they have this level of access?
• Are the formulas and calculations in the spreadsheet accurate?
• Is there documentation of the way the spreadsheet processes data?
• How does one ensure that unauthorized users cannot manually override spreadsheet functionality?
• What built-in audit function tracks changes and restricts authority to make changes to this spreadsheet?
• How is the current version of the spreadsheet backed up?

Responses to these questions are not theoretical exercises. Among "real-life" spreadsheet horror stories cited by Deloitte is a utility company that found, at the last minute, that in a lengthy spreadsheet formula, parentheses were out of place--projected gains fell from US $200 million to US $25 million. In another instance, executives of a health-care service provider admitted to preparing a false spreadsheet for auditors that inflated assets, thus falsifying the company's worth--earnings were overstated by at least US $3.5 billion.

Source: Deloitte