There has been a steady flow of spreadsheet horror stories from public companies hitting the headlines in recent months – the latest being Conviviality.
While the details are not in the public domain, I am particularly struck by the fact that none of these situations appear to have involved especially complex application or use of spreadsheets. For the most part these are high level tools being used to report key results and data to the companies’ stakeholders. The models seem conceptually to have been quite simple and the errors largely manual.
However, just because a spreadsheet model is simple (the proverbial ‘back of a fag packet’ analysis) it doesn’t necessarily follow that it is lower risk or free from risk. Indeed, simple spreadsheets can breed a degree of complacency about their propensity for error.
We review scores of spreadsheet models each year and consistently find that the majority contain significant errors and risk indicators - whether they are simple spreadsheets or complex financial models. Unsurprisingly, larger volume, more complex models simply tend to contain more. I’ve written on this elsewhere, but academic research repeatedly shows that spreadsheets are just as susceptible to human error as any other activity. Being aware of the problem is the first step to remediation.
The good news is that these issues are largely preventable, and the ICAEW’s Twenty principles for good spreadsheet practice is a good place to start. At its simplest, businesses need to:
- Establish a robust control environment – to ensure end user application development (whether spreadsheets or other platforms) is transparent and rigorous. Such a framework should help prevent errors at source.
- Propagate spreadsheet best practice – providing staff with the skills and risk awareness needed to underpin a cautious, preventative approach to spreadsheet development and use. A lot of the guidance available, including our own best practice guideline, focuses on forecasting applications, but the general principles are very transferable to other spreadsheet applications. This discipline should guard against inadvertent mistakes and reduce the risk of errors being introduced and multiplied through the development process.
- Subject any pivotal or published analysis (however simple) to appropriate independent quality assurance – to give results a business sense check and mitigate the risk of self-review ‘snow blindness’ that can affect modellers. In environments where spreadsheets proliferate uncontrolled, one weak link in the chain of information can bring the house tumbling down.
But above all, businesses should create a culture of awareness around spreadsheet risk. After all, there’s a reason fag packets have warnings.
For more information, please get in touch with Alistair Hynd or your usual RSM contact.