Spreadsheets and Access Databases Enterprise Control, Efficiency and Insight. Find It. Audit. Profit

Transcription

1 Spreadsheets and Access Databases Enterprise Control, Efficiency and Insight Find It. Audit. Profit

2 Everybody has problems with spreadsheets Clients Exec Brand Protection Loss of Reputation Avoiding major losses Compliance / Audit concerns Data Integrity Operational Risk / Losses Fraud Sustainable Controls Prompt, Reliable Data IT Management Reporting Overheads Business Information Client Relations Users Lean IT Low Support Costs Tactical and Strategic Needs Accuracy of work / fewer errors Manually Intensive Analysis Productivity

3 There are really two distinct groups of problems Bad spreadsheets This has traditionally been the focus of Eusprig Poor logic, poor layout, sensitive content, lack of security Where resources permit this is solved through audit, testing, rewriting etc. Good for Day 1 but this does not solve the problem on Day 2, 3... Good spreadsheets that go bad during usage This is one of the biggest problems for business Could audit and test the spreadsheet after every use but this would be prohibitively expensive and slow Need to automate the process to provide continuous validation (can be called continuous audit) against a wide range of business rules

4 Mindset For this presentation: Forget about spreadsheets as models Think about them as IT applications: used repeatedly (hourly, daily, monthly etc.) used by people who didn t write them and often don t have the skills to write/understand them don t say it shouldn t be a spreadsheet get real, it is primarily data processing, but functionality changes common (that s why it is a spreadsheet) most will be replaced by IT, but in months or years

5 Spreadsheet application usage common operations The role of spreadsheets and systems in supporting the information supply chain.

6 Manual approach Operations Decision Makers Issues: How do you know what to check? Check Release Internal e.g. Executives How can you possibly check thousands/millions of cells? Fix (& document?) Work (& document?) External e.g. Clients Relies on diligence/integrity of individuals = many wasted hours Check

7 Automated Operations Issues: Validation is more than just change. It is activity combined with context Most activity is business as normal Just having an audit trail is pretty useless Automated Operations Repair / Approve Validate Alert Productivity Passed Failed Decision Makers Internal e.g. Executives External e.g. Clients Can t drown users in information. Must work from exception reports/alerts How do you know you are tracking ALL of the right spreadsheets?

8 Expanding control Identify Automated Operations Productivity Decision Makers Passed Register Test & Secure Validate Failed Internal e.g. Executives Assess Repair / Approve Alert External e.g. Clients Discover Issues: How do you keep track & document of all this data/operations? How do you confirm that required processes are actually occurring?

9 Knowing what is going on Productivity Identify Operations Decision Makers Passed Register Test & Secure Validate Failed Internal e.g. Executives Assess Repair / Approve Alert External e.g. Clients Discover Summary Reporting

10 Reaping more benefits Productivity Identify Operations Decision Makers Passed Register Test & Secure Validate Failed Internal e.g. Executives Assess Repair / Approve Alert External e.g. Clients Discover Summary Reporting Retire Opportunity

11 Operations Identify EUC control stages Discover Locate critical EUCs Assess Register Secure Validate Alert Update/Approve Understand risk of each EUC Nominate EUC for management Apply appropriate security settings Confirm that EUC continues to meet integrity tests Notify relevant users of integrity breaks Repair or approve integrity breaks Report Productivity Opportunity Provide enterprise reporting on activity and workflow Accelerate/eliminate manual processes Expose hidden business trends

12 Operations Identify Example User Mappings / Roles Discover Assess Register Secure Validate Alert Update/Approve Report Productivity Opportunity Execs OPS Risk & Mgt Excel Users Watched General Super Technology

13 ClusterSeven Architecture EUC Users Integrity Managers Data Consumers Data ClusterSeven User Interface Enterprise Software e.g. BI/CMS ERP (e.g. SAP) Exception reports, alerts Accounting (e.g. Investran) BI/CMS (e.g. Hyperion, Cognos) Trading (e.g. Murex) Noninvasive File Watchers Cluster Seven Engine Cluster Seven Database Downstream systems User Stack ClusterSeven Stack Central Systems Stack

14 Examples of validation issues within a spreadsheet Good activity Live data feeds (e.g. foreign exchange values) are updated Protected data and protection settings are unchanged Formulas remain unchanged No error cells created No changes to VBA and VBA objects No changes to links Cell values stay within business tolerances Potentially bad activity Live data feeds fail to update Protected data and protection settings are changed Formulas changed or overwritten Error cells created Changes to VBA or VBA objects Changes to links Values move outside business tolerances Will vary from business process to process

15 Fraud Validation One value two answers -250, Real Value +239, Display Value

16 Intelligent validation the key to reducing Operational Risk A good example is locating a critical change after a data sort This display shows all apparent changes Automated validation shows the only change that counts

17 Examples of validation issues beyond the spreadsheet Data validation against external system-held parameters Data reconciliation against parameters held in other spreadsheets Process validation (e.g. Sign off for critical changes) Trend validation across multiple versions of the spreadsheet Inventory validation (e.g. Use of specific DLLs)

18 Data validation example

19 Multiple access points for validation within a unified architecture Management Reports Dashboards Central Database Excel Ribbon/ Command Bar

20 Thank you and Questions For more information