[Paper Review] Archiving: The Overlooked Spreadsheet Risk

Victoria L. Lemieux|ArXiv.org|Mar 21, 2008

Spreadsheets and End-User Computing1 references3 citations

TL;DR

This paper argues that spreadsheet archiving is a critical but overlooked internal control, demonstrating through the case of failed Jamaican commercial banks that poor archiving increases operational risk. It proposes records management programmes to enforce retention compliance, support regulatory inquiries, and prevent unauthorized destruction, ensuring Sarbanes-Oxley compliance and reducing spreadsheet-related risks.

ABSTRACT

This paper maintains that archiving has been overlooked as a key spreadsheet internal control. The case of failed Jamaican commercial banks demonstrates how poor archiving can lead to weaknesses in spreadsheet control that contribute to operational risk. In addition, the Sarbanes-0xley Act contains a number of provisions that require tighter control over the archiving of spreadsheets. To mitigate operational risks and achieve compliance with the records-related provisions of Sarbanes-Oxley, the author argues that organisations should introduce records management programmes that provide control over the archiving of spreadsheets. At a minimum, spreadsheet archiving controls should identify and ensure compliance with retention requirements, support document production in the event of regulatory inquiries or litigation, and prevent unauthorised destruction of records.

Motivation & Objective

• To highlight archiving as a neglected yet essential internal control in spreadsheet management.
• To demonstrate how inadequate spreadsheet archiving contributed to operational failures, using the case of Jamaican commercial banks.
• To address the regulatory implications of spreadsheet archiving under the Sarbanes-Oxley Act.
• To propose structured records management programmes to enforce compliance with retention policies and legal requirements.
• To reduce operational risk by ensuring integrity, availability, and auditability of spreadsheet records.

Proposed method

• Analyzing the failure of Jamaican commercial banks to illustrate how poor spreadsheet archiving led to operational risk.
• Examining Sarbanes-Oxley provisions related to records management and their relevance to spreadsheet control.
• Proposing records management programmes as a framework to institutionalize spreadsheet archiving controls.
• Defining minimum archiving controls: identification of retention requirements, support for document production, and prevention of unauthorized destruction.
• Using case study evidence and regulatory analysis to validate the need for formalized archiving processes.
• Applying principles from software engineering and records management to design a control framework for spreadsheets.

Experimental results

Research questions

• RQ1 How does inadequate spreadsheet archiving contribute to operational risk in financial institutions?
• RQ2 In what ways do the records-related provisions of the Sarbanes-Oxley Act apply to spreadsheet management?
• RQ3 What specific controls are necessary to ensure compliance with retention and regulatory inquiry requirements for spreadsheets?
• RQ4 How can organizations institutionalize effective spreadsheet archiving to prevent data loss and non-compliance?
• RQ5 What role does records management play in mitigating spreadsheet-related risks in regulated environments?

Key findings

• Poor spreadsheet archiving was a contributing factor in the failure of Jamaican commercial banks, demonstrating its impact on operational risk.
• The Sarbanes-Oxley Act mandates tighter control over records, including spreadsheets, making archiving a compliance necessity.
• Organizations must implement records management programmes to enforce spreadsheet archiving controls.
• Effective archiving controls must identify and enforce retention requirements to ensure regulatory compliance.
• Archiving controls must support document production during regulatory inquiries or litigation.
• Unauthorized destruction of spreadsheet records can be prevented through formalized archiving procedures.