Spreadsheets and Access Databases Enterprise Control, Efficiency and Insight Find It. Audit. Profit
Everybody has problems with spreadsheets Clients Exec Brand Protection Loss of Reputation Avoiding major losses Compliance / Audit concerns Data Integrity Operational Risk / Losses Fraud Sustainable Controls Prompt, Reliable Data IT Management Reporting Overheads Business Information Client Relations Users Lean IT Low Support Costs Tactical and Strategic Needs Accuracy of work / fewer errors Manually Intensive Analysis Productivity
There are really two distinct groups of problems Bad spreadsheets This has traditionally been the focus of Eusprig Poor logic, poor layout, sensitive content, lack of security Where resources permit this is solved through audit, testing, rewriting etc. Good for Day 1 but this does not solve the problem on Day 2, 3... Good spreadsheets that go bad during usage This is one of the biggest problems for business Could audit and test the spreadsheet after every use but this would be prohibitively expensive and slow Need to automate the process to provide continuous validation (can be called continuous audit) against a wide range of business rules
Mindset For this presentation: Forget about spreadsheets as models Think about them as IT applications: used repeatedly (hourly, daily, monthly etc.) used by people who didn t write them and often don t have the skills to write/understand them don t say it shouldn t be a spreadsheet get real, it is primarily data processing, but functionality changes common (that s why it is a spreadsheet) most will be replaced by IT, but in months or years
Spreadsheet application usage common operations The role of spreadsheets and systems in supporting the information supply chain.
Manual approach Operations Decision Makers Issues: How do you know what to check? Check Release Internal e.g. Executives How can you possibly check thousands/millions of cells? Fix (& document?) Work (& document?) External e.g. Clients Relies on diligence/integrity of individuals = many wasted hours Check
Automated Operations Issues: Validation is more than just change. It is activity combined with context Most activity is business as normal Just having an audit trail is pretty useless Automated Operations Repair / Approve Validate Alert Productivity Passed Failed Decision Makers Internal e.g. Executives External e.g. Clients Can t drown users in information. Must work from exception reports/alerts How do you know you are tracking ALL of the right spreadsheets?
Expanding control Identify Automated Operations Productivity Decision Makers Passed Register Test & Secure Validate Failed Internal e.g. Executives Assess Repair / Approve Alert External e.g. Clients Discover Issues: How do you keep track & document of all this data/operations? How do you confirm that required processes are actually occurring?
Knowing what is going on Productivity Identify Operations Decision Makers Passed Register Test & Secure Validate Failed Internal e.g. Executives Assess Repair / Approve Alert External e.g. Clients Discover Summary Reporting
Reaping more benefits Productivity Identify Operations Decision Makers Passed Register Test & Secure Validate Failed Internal e.g. Executives Assess Repair / Approve Alert External e.g. Clients Discover Summary Reporting Retire Opportunity
Operations Identify EUC control stages Discover Locate critical EUCs Assess Register Secure Validate Alert Update/Approve Understand risk of each EUC Nominate EUC for management Apply appropriate security settings Confirm that EUC continues to meet integrity tests Notify relevant users of integrity breaks Repair or approve integrity breaks Report Productivity Opportunity Provide enterprise reporting on activity and workflow Accelerate/eliminate manual processes Expose hidden business trends
Operations Identify Example User Mappings / Roles Discover Assess Register Secure Validate Alert Update/Approve Report Productivity Opportunity Execs OPS Risk & Mgt Excel Users Watched General Super Technology
ClusterSeven Architecture EUC Users Integrity Managers Data Consumers Data ClusterSeven User Interface Enterprise Software e.g. BI/CMS ERP (e.g. SAP) Exception reports, alerts Accounting (e.g. Investran) BI/CMS (e.g. Hyperion, Cognos) Trading (e.g. Murex) Noninvasive File Watchers Cluster Seven Engine Cluster Seven Database Downstream systems User Stack ClusterSeven Stack Central Systems Stack
Examples of validation issues within a spreadsheet Good activity Live data feeds (e.g. foreign exchange values) are updated Protected data and protection settings are unchanged Formulas remain unchanged No error cells created No changes to VBA and VBA objects No changes to links Cell values stay within business tolerances Potentially bad activity Live data feeds fail to update Protected data and protection settings are changed Formulas changed or overwritten Error cells created Changes to VBA or VBA objects Changes to links Values move outside business tolerances Will vary from business process to process
Fraud Validation One value two answers -250,000.00 Real Value +239,058.45 Display Value
Intelligent validation the key to reducing Operational Risk A good example is locating a critical change after a data sort This display shows all apparent changes Automated validation shows the only change that counts
Examples of validation issues beyond the spreadsheet Data validation against external system-held parameters Data reconciliation against parameters held in other spreadsheets Process validation (e.g. Sign off for critical changes) Trend validation across multiple versions of the spreadsheet Inventory validation (e.g. Use of specific DLLs)
Data validation example
Multiple access points for validation within a unified architecture Management Reports Dashboards Central Database Excel Ribbon/ Command Bar Email
Thank you and Questions For more information inquiries@clusterseven.com rbaxter@clusterseven.com www.clusterseven.com