In my previous Industry Insight, I discussed the necessity of performing high-level analyses, which are critical to establishing control over spreadsheets the organisation uses.
In this, the third Industry Insight in the series investigating spreadsheet risk management, I examine the benefits of establishing a spreadsheet review group.
The aim of this group is to ensure users throughout the business become more aware of the risks associated with spreadsheet use, and to ensure the organisation has the skills, tools and training to address the risk in-house. It is also useful to have this group established before the organisation delves into any detailed inventory of the spreadsheets used. In this way, as specific risk areas are identified, testing of the more critical spreadsheets can begin.
The spreadsheet review group`s function should be to act as the central point in addressing spreadsheet risks throughout the business. It needs to have the tools and training to review and comment on spreadsheets in the organisation.
The most logical place for this group to be positioned is in the internal and/or the IT audit departments. Employees in these departments are often confronted by spreadsheets in their daily activities and having these skills will enable them to test through the spreadsheet instead of testing around the spreadsheet.
The combination of business and IT skills associated with these employees means they can also provide valuable input into the workings of the spreadsheet from a business perspective.
In more specialised areas such as complex financial instrument spreadsheets, this group can provide the time saving skills to identify possible errors and leave the business issues to the correctly skilled person. Another major benefit for organisations spread over wide geographic areas is that spreadsheets can be mailed to the group from far-off locations to be reviewed and returned. So even offshore operations can benefit from the review group.
The spreadsheet review group`s function should be to act as the central point in addressing spreadsheet risks throughout the business.
Adrian Miric, MD, Miricle Solutions.
The overall aim of this group is to increase every employee`s ability to review spreadsheets in their normal functions, particularly if they are in the internal audit division, and to provide an independent review to the business as to where complex and important spreadsheets reside.
One of the quickest ways to minimise spreadsheet risk is to have the review group establish an online training portal for all users. Excel training video clips are an invaluable tool, and with current technology there is no reason why every company intranet cannot offer this.
Spreadsheet review groups are critical to achieving a level of control over the risks of spreadsheets. Given the requirements of the Sarbanes-Oxley Act and other regulations in the future, this will be a core requirement and should become as critical as the internal audit function is now.
In the next Industry Insight I will address the process of establishing a more comprehensive inventory of spreadsheets and spreadsheet users.
Share