Spreadsheet change control (or new developments)
Sarbanes Oxley S404 spreadsheets need to be controlled particularly with regards changes made to them. All significant changes should be noted, tested and signed off for Sarbanes Oxley purposes.
The change made must be noted on the ‘Documentation’ sheet. All changes should be tested to the same level as indicated in the Testing section.
New spreadsheet developments that would be a SoX 404 spreadsheet must be reported to the person responsible for Sarbanes Oxley spreadsheets in your organisation and put on the SoX spreadsheet inventory list if it exists.
How to implement spreadsheet change control
Spreadsheet change control is ongoing through the life of the spreadsheet and can be documented as part of the text in the ‘Documentation’ sheet of the spreadsheet.
Change logs should contain:
- Date of change;
- Version of the spreadsheet (full spreadsheet name);
- Name of person performing the changes;
- Brief rational for the changes being made;
- Confirmation that testing was satisfactorily completed (formula, module, system and user acceptance if relevant)