Protecting Spreadsheets Against Fraud

TL;DR

This paper surveys methods for protecting spreadsheets from fraud, emphasizing the need for different safeguards against deliberate fraud versus inadvertent errors, and compares spreadsheet-specific approaches with traditional software fraud prevention techniques.

Contribution

It highlights the distinction between error prevention and fraud detection in spreadsheets and reviews existing methods tailored for fraud protection in spreadsheet environments.

Findings

Spreadsheet fraud protection requires different tools than error prevention.

Auditing is crucial for detecting deliberate fraudulent modifications.

Existing approaches are contrasted with traditional software fraud prevention methods.

Abstract

Previous research on spreadsheet risks has predominantly focussed on errors inadvertently introduced by spreadsheet writers i.e. it focussed on the end-user aspects of spreadsheet development. When analyzing a faulty spreadsheet, one might not be able to determine whether a particular error (fault) has been made by mistake or with fraudulent intentions. However, the fences protecting against fraudulent errors have to be different from those shielding against inadvertent mistakes. Faults resulting from errors committed inadvertently can be prevented ab initio by tools that notify the spreadsheet writer about potential problems whereas faults that are introduced on purpose have to be discovered by auditors without the cooperation of their originators. Even worse, some spreadsheet writers will do their best to conceal fraudulent parts of their spreadsheets from auditors. In this paper we survey the available means for fraud protection by contrasting approaches suitable for spreadsheets with those known from fraud protection for conventional software.