Risk & Compliance

Failure to Excel

Spreadsheet auditing tools help strengthen a weak link in the compliance chain.
John EdwardsApril 27, 2007

“We use a lot of spreadsheets,” says Evelyn Dryer, energy settlements director for southern Arizona utility Tucson Electric Power. “Companies have all these fancy financial applications, but a lot of stuff is still going into spreadsheets because they’re so flexible.”

But although she considers spreadsheets to be indispensable tools for budgeting and analysis, Dryer — and many other executives and managers in this era of wall-to-wall compliance mandates — recognizes their soft spot. “Excel just didn’t offer the level of compliance support we needed,” she says. Dryer began looking into software that provides enhanced logging, tracking, and cell-by-cell auditing capabilities.

Until the release of Excel 2007 late last year, Microsoft offered little compliance support for its ubiquitous spreadsheet software. Today Excel users can connect to Sharepoint Server 2007, Microsoft’s enterprise portal, and access key compliance-oriented functions including document management, version control, and access control.

Dryer also found that many companies offer compliance-oriented Excel add-ons. Prodiance, for example, offers a Web-based Spreadsheet Compliance Manager that automatically identifies changes to formulas, macros, and data, and generates audit trails that record changes made at the system level, the file level, and even cell by cell.

Mobius, a records-management software provider, also focuses on “internal controls for spreadsheets that collect and consolidate data for planning, budgeting, and reporting,” in the words of Garth Landers, the company’s director of compliance solutions. Mobius’s ABS for Spreadsheet Compliance provides Excel with cell-level locking and auditing, a built-in review and approval process, and data reconciliation between spreadsheets and source applications.

Version control for both data and formulas proved to be the key selling point for Dryer, now a Mobius user. “My auditors were really big on tracking formula changes,” she says.

For users who find that essential finance tasks have outgrown their spreadsheet home (a subject to be covered more fully in an upcoming story), business-planning software specialist Applix has incorporated compliance assurance into its TM1 analysis software. TM1 automatically logs every data change, cell by cell, as well as the identity of the person making the change; the audit log can also be used, selectively, to reverse any entries.

Andy Saxena, internal reporting manager for DHL Logistics, appreciates the software’s ability to provide at-a-glance tracking and verification. “You can take any number and very easily figure out exactly how that number got to where it is,” he says. “Even if it’s in the billions of dollars, you can go all the way down to looking at individual invoices, individual transactions, whatever you have.”

With all the choices available, Dryer has a simple suggestion for selecting the most appropriate spreadsheet compliance tool. “Build your requirements from what your auditors tell you,” she says. “Then take a look at what’s out there.”