[Paper Review] Controls over Spreadsheets for Financial Reporting in Practice

Nancy Coster, Linda Leon+2 more|arXiv (Cornell University)|Nov 29, 2011

Spreadsheets and End-User Computing13 references3 citations

TL;DR

This study investigates spreadsheet governance practices in financial reporting among 38 U.S. organizations complying with the Sarbanes-Oxley Act (SOX). It identifies widespread deficiencies across all lifecycle stages—design, testing, documentation, usage, modification, sharing, and archiving—highlighting the lack of formal controls and proposing actionable controls to improve reliability and compliance in financial reporting systems.

ABSTRACT

Past studies show that only a small percent of organizations implement and enforce formal rules or informal guidelines for the designing, testing, documenting, using, modifying, sharing and archiving of spreadsheet models. Due to lack of such policies, there has been little research on how companies can effectively govern spreadsheets throughout their life cycle. This paper describes a survey involving 38 participants from the United States, representing companies that were working on compliance with the Sarbanes-Oxley Act of 2002 (SOX) as it relates to spreadsheets for financial reporting. The findings of this survey describe specific controls organizations have implemented to manage spreadsheets for financial reporting throughout the spreadsheet's lifecycle. Our findings indicate that there are problems in all stages of a spreadsheet's life cycle and suggest several important areas for future research.

Motivation & Objective

• To understand how organizations implement controls over spreadsheets used in financial reporting, particularly in the context of SOX compliance.
• To identify gaps and challenges in managing spreadsheets throughout their lifecycle, including design, testing, documentation, and archiving.
• To explore the extent to which formal policies or informal guidelines are adopted to govern spreadsheet use in financial reporting.
• To provide practical insights into effective spreadsheet governance based on real-world organizational practices.
• To highlight areas requiring further research in spreadsheet risk management and control frameworks.

Proposed method

• Conducted a survey of 38 professionals from U.S. organizations actively working on SOX compliance related to spreadsheet use.
• Focused on organizations that rely on spreadsheets for financial reporting and are subject to internal control requirements under SOX.
• Collected data on current practices related to spreadsheet lifecycle management, including design, testing, documentation, usage, modification, sharing, and archiving.
• Analyzed responses to identify recurring control practices, common challenges, and inconsistencies in governance approaches.
• Used qualitative and descriptive analysis to summarize findings and highlight patterns in control implementation.
• Reported findings through structured tables and a color figure illustrating control distribution across lifecycle stages.

Experimental results

Research questions

• RQ1 What types of controls do organizations implement to manage spreadsheets used in financial reporting?
• RQ2 How consistently are these controls applied across the spreadsheet lifecycle stages?
• RQ3 What challenges do organizations face in implementing formal controls for spreadsheet use in financial reporting?
• RQ4 To what extent do organizations document, test, and audit spreadsheet models for financial reporting?
• RQ5 What are the key gaps in governance that could lead to errors or non-compliance in financial reporting?

Key findings

• Only a small percentage of organizations implement formal rules or informal guidelines for spreadsheet development and management.
• Deficiencies were identified in all stages of the spreadsheet lifecycle, including design, testing, documentation, usage, modification, sharing, and archiving.
• Many organizations lack consistent processes for version control, peer review, or validation of spreadsheet models.
• Despite SOX requirements, many companies do not systematically document changes or maintain audit trails for financial spreadsheets.
• There is a notable absence of standardized control frameworks for spreadsheets in financial reporting, even among regulated firms.
• The study reveals a critical need for improved governance models to reduce error risk and support compliance with financial reporting standards.