Spreadsheets, spreadsheets, everywhere, but not a cell to check.
Accountants love spreadsheets. They are very flexible and useful in manipulating and presenting information. The problem with spreadsheets is that they are easy to create but difficult to control.
A mistake in a single spreadsheet cell may contaminate a critical material report that could affect the entire financial-reporting system of a company. The error could result in the restatement of financial statements, an increase in audit time and fees, embarrassment to the firm, and a resulting drop in the organizations’s stock-price.
Don't let your firm be tied up by complex spreadsheets.
Internal or external auditors do normally discover most material errors before serious harm is done, but the huge number of spreadsheets an average company uses and the frequency with which they are updated multiplies the risk. It takes only one person to make one mistake in one formula to bring about disaster. Checks should be built in to the spreadsheet, but the more likely situation is that those safeguards are not created.
Spreadsheets may be very complex. They may be linked to hundreds of other worksheets maintained throughout the organization. Some huge models are simply too complicated to be properly reviewed. I believe in the KISS principle: keep in simple, stupid. Smaller units that can be easily checked are superior to huge monsters that no one understands.
Kodak almost paid an erroneous $11 million dollar severance check to a severed employee until a spreadsheet error was discovered. Kodak spokesman Gerard Meuchner said, “There were too many zeros added to the employee’s accrued severance.” Robert Brust, Kodak’s chief financial officer, called it “an internal control deficiency that constitutes a material weakness that impacted the accounting for restructurings.” In plain English, Kodak did not have adequate controls over the spreadsheets controlling the accounting for reorganization and severance pay.
In an infamous case, the Nevada City Missouri budget was misstated by $5 million. The spreadsheet apparently worked OK until sometime in late December 2005, when, city finance director Ron Chandler says, it “developed” a problem. The 2006 budget inaccurately presented a $5 million deficit in the water and sewer fund. Chandler “assumed” that the information in the spreadsheet was correct and he did not check the version that was provided to the city council and posted on the city’s web site.
A change management system should be instituted for spreadsheets material to the financial reporting process. The process of managing critical spreadsheets for accounting processes should be formalized. Any proposed changes should be tested before they are put into production. Documentation is very important. Record where the critical spreadsheets reside, who reviewed and approved changes, and keep the before and after versions.
Commercial software products are available that report which spreadsheets have changed, who made the changes, when, and for what reason. These applications may also provide prioritized lists of spreadsheets that should receive more attention based on attributes such as the number of changes, cells, or links, or dollar amounts above a certain threshold. These products look for signs of likely mistakes or attempts to deceive, such as text that is the same color as a background. Spreadsheets that are not updated according to a pre-set mandated schedule are documented and reported to independent auditors or top management.
Security over the spreadsheets is also very important. Access should be limited. Back ups are required for critical, material models. Too many times an important spreadsheet is kept on one person’s laptop without adequate controls. A vulnerable laptop could be stolen or its data corrupted or lost.