Part 3- Review groups are the foundation for
dealing with spreadsheet risks
By Adrian Miric*
|
|
|
In the previous column we discussed the
necessity of performing high-level analyses, which are critical to
establishing control and management over spreadsheets the organisation uses.
In this, the third column in the series investigating spreadsheet
risks, we examine the benefits of establishing a spreadsheet review
group. The aim of this group is to ensure that users throughout the
business become more aware of the risks associated with spreadsheet
use, and to ensure that the organisation has the skills, tools and
training to address the risk in-house. |
It is also useful to have this group established
before the organisation delves into any detailed inventory of the
spreadsheets used. In this way, as specific risk areas are identified,
testing of the more critical spreadsheets can begin.
The
spreadsheet review group’s function should be to act as the central
point in addressing spreadsheet risks throughout the business. It needs
to have the tools and training to review and comment on spreadsheets in
the organisation.
|
|
|
The most
logical place for this spreadsheet risk review group to be positioned is in the internal and/or
the IT audit departments. Employees in these departments are often
confronted by spreadsheets in their daily activities and having these
skills will enable them to test through the spreadsheet instead of
testing around the spreadsheet.
The
combination of business and IT skills associated with these employees
means they can also provide valuable input into the workings of the
spreadsheet from a business perspective.
In more
specialised areas such as complex financial instrument spreadsheets,
this group can provide the time saving skills to identify possible
errors and leave the business issues to the correctly skilled person.
Another major benefit for organisations spread over wide geographic
areas is that spreadsheets can be mailed to the group from far-off
locations to be reviewed and returned. So even offshore operations can
benefit from the review group.
|
The overall
aim of this group is to increase every employee’s ability to review
spreadsheets in their normal functions, particularly if they are in the
internal audit division, and to provide an independent review to the
business as to where complex and important spreadsheets reside.
One of the
quickest ways to minimise spreadsheet risk is to have the review group
establish an online training portal for all users. Excel training video
clips are an invaluable tool, and with current technology there is no
reason why every company intranet cannot offer this.
Spreadsheet
review groups are critical to achieving a level of control over the
risks of spreadsheets. Given the requirements of the Sarbanes-Oxley Act
and other regulations in the future, this will be a core requirement and
should become as critical as the internal audit function is now.
In the next article we address the process of
establishing a more comprehensive inventory of spreadsheets and
spreadsheet users.
Go to part 4[
Z Go
back to Part 2
* Adrian Miric is MD of Miricle Solutions. He is a chartered accountant
with IT experience, financing experience and spent five years auditing
and designing spreadsheets with KPMG. In the next column he discusses
the importance establishing an inventory of risks; how to identify them
in the business and how to deal with them.
|
