Spreadsheet Blues: Few Controls Yield Many Weaknesses
|
ussain Hasan, managing director of technology risk management services at the Chicago accounting firm RSM McGladrey, does not mince words when discussing how poorly spreadsheets satisfy the requirements of The Sarbanes-Oxley Act of 2002.“They don’t at all,” Hasan says. “Most public companies should not use spreadsheets as their main financial tool.”
Such criticism from Hasan might sound harsh for one of corporate America’s most ubiquitous business tools, but experts say the lack of enterprise-strength security controls means spreadsheets must remain in the crosshairs of executives and auditors worried about financial reporting.
 Hasan |
In fact, a review of recent internal control disclosures indeed shows that numerous companies have already cited deficiencies and weaknesses related to spreadsheets. In May 2005, for example, $90.6 million Sonic Solutions disclosed that it “did not maintain adequate controls over spreadsheets used in our financial reporting process.” The same was the case at $185.2 million Modtech Holdings, which in June noted that it “did not have adequate controls over spreadsheets used in our financial reporting process.”
Titanium producer RTI International Metals also acknowledged in May that it did not maintain effective controls over certain spreadsheets. Specifically, “the company's controls over the completeness, accuracy, validity, and restricted access and the review of certain spreadsheets … were either not designed appropriately or did not operate as designed.”
| ||
|
Email Security Poses IT And Compliance Obstacles
The Use Of Spreadsheets: Considerations Under SOXAt Crown Media Holdings, internal control deficiencies included the company’s controls to assess and review spreadsheet formulas. And at Audible Inc., problems included “ineffective review of spreadsheet calculations used in the financial statement preparation process.”
But spreadsheets aren’t just a source of headaches when it comes to controls and oversight processes—they’re also a source of errors.
In July, cleaning and personal care specialist CPAC—which operates The Fuller Brush Company and Stanley Home Products—disclosed misstatements that were caused by “a computational error in valuation of a component of inventory and related reliance on a spreadsheet for completion of such valuation.”
$1.3 billion Foamex also noted that an ineffective control did not prevent or detect an improper formula in a spreadsheet, “resulting in a misstatement of work in process and finished goods inventories...”
At Edge Petroleum, management discovered an error in a spreadsheet application that was designed to eliminate intercompany balances. “As a result of the error, amounts accumulated in the property account for one subsidiary were also included as an accrued capital expenditure by another subsidiary and inadvertently not eliminated in consolidation,” said the company in a regulatory filing. “This caused property balances to be overstated.”
The same was the case at video retailer Rentrak, which noted in June that its auditor “discovered a data error in a program supplier spreadsheet that resulted in an overstatement of our cost of sales for this fiscal period.”
Hand Washing
“It isn’t an inherent control weakness to use spreadsheets; it’s how people use them,” says Joseph Prudente, director of internal audit for New York-based accounting firm Rothstein Kass.
According to Prudente, most companies utilize spreadsheets out-of-the-box, without applying the diligence and controls inherent in the rest of their financial systems. “At worst, [spreadsheets] are computer applications that are run, managed, developed and supported outside the normal system-development lifecycle.”
| ||
|
To be fair, most spreadsheet applications—including the most common ones like Microsoft Excel and Lotus 1,2,3—do have rudimentary security controls. But those controls, which enable a user to password-protect a worksheet or certain cells, tend to be user-specific—they are tactics aimed a helping a single user protect his or her data.
At the corporate level, where a chief financial officer might oversee thousands of spreadsheets, much stronger controls are required. That’s especially the case now that CFOs must report quarterly changes in the company’s internal control over financial reporting as per Section 302 of The Sarbanes-Oxley Act.
But establishing centralized security controls over spreadsheets is not easy. IT managers can place important spreadsheets on secured hard drives to keep unauthorized users from gaining access to the document, but it’s not uncommon for accounting staffers to save “local” versions of the spreadsheet on their hard drives for convenience. Enforcing version control or change management, while considered vital to the satisfaction of SOX Sections 302 and 404, is often impossible unless done manually.
“This is an area that IT organizations have washed their hands of, really,” says Michael Heintz, a principal consultant with the PA Consulting Group.
Common Area
When it comes to handling critical financial data, Heintz, Hasan at RSM McGladrey, and others advocate abandoning spreadsheets wherever possible.
 Heintz |
Instead, experts argue companies should migrate to ERP applications or Web-enabled databases that employ more rigorous controls. The latest versions of most applications, at least those released after Sarbanes-Oxley, include controls that can be centrally managed and tested by auditors. The latter functionality is becoming more critical as companies focus on “sustainability” as it pertains to SOX 404—as they look to automate processes and minimize costs.
Islandia, N.Y.-based Computer Associates, for example, uses ERP software from Germany’s SAP to house all its financial data in one system. Doing so enables the company to employ controls at the network, host and application layers, says Ken Williams, vice president of CA’s technology services division.
That “common area” concept can make it easier to pull together more complete pictures of the control environment. It can also provide better views into that data, sorting information by business process, for example, or by categories detailed in the internal control framework published by the Committee of Sponsoring Organizations of the Treadway Commission.
Spreadsheets, of course, can track that information too, but typically they do so in a much more fractured way. And because spreadsheets lack a sense of “time” or version control, they offer little help with enterprise risk management initiatives, which often hinge on a constant monitoring of—and controlling against—risk.
 Williams |
A Pain To Monitor
In fact, since spreadsheets have become so ubiquitous and addictive at public companies, it may be difficult for some companies to extricate themselves from their usage—the cost to unwind systems may offset the long-term benefit. For those companies, auditors recommend several basic steps that can be taken to impose proper security controls around spreadsheets and their usage.
First is to take careful inventory of what spreadsheets a company has, what purposes they serve, and exactly who uses them; many companies have already done this as part of their “Year One” SOX 404 documentation efforts. The companies can then map the spreadsheets to the processes, and can determine which ones qualify as high-priority issues needing extra attention.
What controls are necessary? PricewaterhouseCoopers urges that any spreadsheet have locks in place to freeze data. In a white paper published in July 2004 (see excerpt above, left), the firm also recommended that spreadsheets have access controls, as well as an approval system requiring independent sign-off for any changes to processes like macros. There should also be a reconciliation process to confirm inputs. Key spreadsheets might also warrant documentation and back-up procedures.
Prudente at Rothstein Kass emphasizes change controls as particularly important. “In my opinion, you need to go through a formal change-management process for some of these sophisticated spreadsheets,” says Prudente, “just like the developer would go through for a standard application change.” To those ends, companies would want to understand how changes are made to the spreadsheets, and how they are tested and approved.
Then there’s the matter of testing spreadsheet controls, which can be a major headache; if spreadsheets are created manually by users, most likely they will be tested manually by auditors. “With some of my clients, what I hear from the controller groups is that they never would have made the request to create some of these sheets had they known the pain it would cause them to monitor the controls around them now,” says Heintz at PA Consulting Group.
And according to Computer Associates’ Ken Williams, auditors may pay even closer attention to testing this year, since most of the SOX 404 documentation efforts are in the past. If that’s the case, Williams says, executives may want to “go back and ask how you can automate [processes] and how you can create sustainability.”
A world of more secure spreadsheets—or no spreadsheets at all—may seem daunting at first glace. But, given the proliferation of spreadsheets in the modern corporation and the exhaustive controls mandated by Sarbanes-Oxley, companies might have little choice. “They should be relying on a back-end application,” argues Hasan at RSM McGladrey. “Maybe it doesn’t have to be a full ERP package … but spreadsheets definitely aren’t the right tool.”