New software products aim to help companies get the whip hand over ubiquitous but risky spreadsheets.
Concur Technologies helps companies automate the processes by which they manage employee travel and entertainment spending, but some of its own processes aren’t fully automated. “We’re like everyone,” says Terry DePolo, Concur’s director of accounting. “We’re trying to minimize the number of spreadsheets we rely on. We’re currently on the Oracle 11i system, and it’s just not flexible enough for us to migrate completely off of spreadsheets–and we probably never will.”
As a result, finance staffers have to spend time checking that all monthly tasks on spreadsheets have been completed and signed off by a manager. And it wasn’t always clear where spreadsheets were. “We had a hard time locating them for audit,” DePolo says.
Concur isn’t alone. In fact, experts say there isn’t a company out there that isn’t using spreadsheets–either for core operations or to fill gaps left by enterprise software platforms and centralized databases. These spreadsheets pose operational, financial and compliance risks for companies. But an array of new software tools aim to help companies locate, manage and audit these documents.
Concur, for example, uses a product from Calabasas, Calif.-based BlackLine Systems that lets employees upload key spreadsheets to a secure Web site. Once a spreadsheet is loaded up, the Web site notifies the appropriate manager to certify or decertify it. Auditors get read-only access to spreadsheets for their reviews. “We spend a lot less time tracking stuff,” DePolo says.
Since Concur began using the product in late 2008, it has improved the company’s control over its spreadsheets, he says. “We have a lot more confidence in our spreadsheets at this point.”
According to Michael Juergens, a principal in Deloitte & Touche’s audit enterprise risk services, the down economy has only exacerbated the problem of spreadsheets. Staff cuts mean “a lot more people are doing multiple jobs, using new workarounds for old processes,” he says. “This has led to greater use of spreadsheets and more problems with spreadsheets, because the people who created them are laid off.”
In addition, the economy has created new business needs for which companies are using spreadsheets, like banks tracking defaulting mortgages. And hard times mean companies are less likely to spend money on new enterprise-level systems. “So there’s more of an emphasis on using spreadsheets to plug gaps in the meantime,” Juergens says.
The first step toward taking control of spreadsheets is finding them, which can be a difficult manual process. Companies need to look at key business processes and track where spreadsheets come into the equation. Then they need to track back to all the spreadsheets those spreadsheets link to.
One approach is to use software to find every spreadsheet used in the enterprise and rank them by risk factors, such as the presence of financial information or customer Social Security numbers. One of the leading vendors in this area is New York-based ClusterSeven.
ClusterSeven’s software, Enterprise Spreadsheet Manager, will not only find spreadsheets but make a copy of a spreadsheet every time a change is made, tracking what was altered and the person who made the change. “We do all that without interfering with the user’s desktop,” says ClusterSeven CEO Ralph Baxter.
The product is priced based on the number of employees using it, with a typical implementation running in the “mid five-figure range,” Baxter says. Customers say the product pays for itself three to 10 times over in the first year, he says, as a result of lower audit costs and savings from operational losses.
Providers offering products that run in the background and don’t interfere with the end user’s experience, similar to ClusterSeven’s, according to TowerGroup analyst Rodney Nelsestuen, include Cimcon Software, Prodiance and Finsbury Solutions.
Another approach is to change the Excel interface by adding management or control functionality, Nelsestuen says. Companies with products in this category include Risk Integrated, SecondFloor, Qtier Business Software and Ofni Systems. Other vendors, such as DevExpress and Spreadsheet Advantage, offer audit and control platforms for spreadsheets, he says.
Companies can also use features built into Microsoft Excel and Microsoft SharePoint, Nelsestuen adds. For example, companies can centralize all their spreadsheets on servers, making it impossible for users to have individual copies of spreadsheets on their own machines. “You can get enterprise-level control, and lock them down,” he says.
It’s easy to make a mistake in a spreadsheet, whether it’s entering an incorrect number or making an error in a formula. According to Ray Panko, a professor at the University of Hawaii and an expert on spreadsheet error rates, creating a complex spreadsheet is similar to writing a new piece of software, with all the potential for bugs that entails. “One big difference is that with spreadsheets, they don’t do the extensive testing that they do in software development,” he says.
Microsoft, for example, spends 40% of its software development budget on testing–and despite that effort, the software still has bugs, Panko says. “Even if you only have 50 formulas in a spreadsheet, the odds are good that you have an error,” he says. “I’ve never audited a spreadsheet that didn’t have an error.”
The solution, Panko says, is to test the spreadsheets, though some software tools can help a little bit.
Chris Cochran, senior auditor in internal audit services at Oregon’s Portland General Electric (PGE), says he’s seen spreadsheet errors that led to internal control deficiencies.
Three years ago, his department began using spreadsheet review software. “It’s really good for value overrides,” Cochran says. “It can also identify differences in formulas–if the user does a correction on a spreadsheet and types in a formula different from the one above or below. It’s a valuable tool which works very efficiently.” Over the next three years, he says, PGE plans to roll out additional spreadsheet controls, including spreadsheet inventory management.
Companies historically have not paid much attention to the possibility of spreadsheet-related errors, fraud or compliance issues unless there was a problem. Sarbanes-Oxley changed all that, and accountants and auditors are starting to focus on spreadsheets.
There haven’t been specific regulations addressing spreadsheets, but the Institute of Internal Auditors is putting out a guidance report in the second quarter of this year, says Lisa Hirtzinger, director of technology practices at the institute. Companies need to inventory important spreadsheets, she says, and automated tools can help with the process.
Companies also need to monitor links between spreadsheets and manage the change process, Hirtzinger says. “You need to make sure that policies and procedures are followed.”
Read full article at Treasury & Risk. (Free registration required.)
