[Paper Review] Spreadsheet Risk Management in Organisations

Ben G. Rittweger, Eoin Langan|arXiv (Cornell University)|Sep 14, 2010

Spreadsheets and End-User Computing3 references3 citations

TL;DR

This study investigates spreadsheet risk management in Irish organisations through surveys and case studies, finding widespread spreadsheet use with frequent errors and weak controls—though attitudes are shifting, with one organisation implementing comprehensive policies. The research supports Panko’s (1998) findings on error prevalence and control gaps while identifying emerging awareness and structured risk management initiatives.

ABSTRACT

The paper examines in the context of financial reporting, the controls that organisations have in place to manage spreadsheet risk and errors. There has been widespread research conducted in this area, both in Ireland and internationally. This paper describes a study involving 19 participants (2 case studies and 17 by survey) from Ireland. Three areas are examined; firstly, the extent of spreadsheet usage, secondly, the level of complexity employed in spreadsheets, and finally, the controls in place regarding spreadsheets. The findings support previous findings of Panko (1998), that errors occur frequently in spreadsheets and that there is little or unenforced controls employed, however this research finds that attitudes are changing with regard to spreadsheet risk and that one organisation is implementing a comprehensive project regarding policies on the development and control of spreadsheets. Further research could be undertaken in the future to examine the development of a "best practice model" both for the reduction in errors and to minimise the risk in spreadsheet usage.

Motivation & Objective

• To assess the extent of spreadsheet usage in Irish organisations.
• To evaluate the level of complexity in organisational spreadsheets.
• To examine existing controls for managing spreadsheet risk and errors.
• To investigate shifts in organisational attitudes toward spreadsheet risk management.
• To explore the potential for developing a 'best practice model' for reducing spreadsheet-related risks.

Proposed method

• Conducted a mixed-methods study involving 17 survey participants and 2 case studies from Irish organisations.
• Collected data on spreadsheet usage patterns, complexity levels, and control mechanisms.
• Analyzed findings in relation to prior research, particularly Panko (1998), on spreadsheet error frequency and control deficiencies.
• Identified organisational initiatives aimed at formalising spreadsheet policies and controls.
• Used qualitative and descriptive analysis to interpret attitudes and practices around spreadsheet risk.

Experimental results

Research questions

• RQ1 To what extent are spreadsheets used in Irish organisations for financial reporting and other critical functions?
• RQ2 How complex are the spreadsheets used, and what implications does this complexity have for error risk?
• RQ3 What types of controls, if any, are currently in place to manage spreadsheet errors and risks?
• RQ4 How have organisational attitudes toward spreadsheet risk evolved in recent years?
• RQ5 What are the prospects for developing a formal best practice model for spreadsheet risk management?

Key findings

• Spreadsheets are widely used in Irish organisations, particularly in financial reporting and decision-making processes.
• High levels of complexity are present in many spreadsheets, increasing the likelihood of errors.
• Controls to manage spreadsheet risk are generally weak or unenforced, consistent with Panko’s (1998) earlier findings.
• Despite this, there is growing organisational awareness of spreadsheet risks, with one organisation implementing a comprehensive policy and control framework.
• The study identifies a need for a formal 'best practice model' to standardise risk reduction and error prevention in spreadsheet usage.