Automating Spreadsheet Discovery & Risk Assessment

TL;DR

This paper presents an automated method for discovering, inventorying, and assessing risks of spreadsheets across enterprises to improve control and compliance, transforming these processes into sustainable business practices.

Contribution

It introduces a novel automated approach to spreadsheet discovery and risk assessment, addressing the lack of systematic controls in end-user developed applications.

Findings

Automated discovery significantly improves inventory accuracy.

Risk assessment helps identify high-risk spreadsheets for prioritized control.

The approach enables continuous monitoring and management of spreadsheet risks.

Abstract

There have been many articles and mishaps published about the risks of uncontrolled spreadsheets in today's business environment, including non-compliance, operational risk, errors, and fraud all leading to significant loss events. Spreadsheets fall into the realm of end user developed applications and are often absent the proper safeguards and controls an IT organization would enforce for enterprise applications. There is also an overall lack of software programming discipline enforced in how spreadsheets are developed. However, before an organization can apply proper controls and discipline to critical spreadsheets, an accurate and living inventory of spreadsheets across the enterprise must be created, and all critical spreadsheets must be identified. As such, this paper proposes an automated approach to the initial stages of the spreadsheet management lifecycle - discovery, inventory and risk assessment. Without the use of technology, these phases are often treated as a one-off project. By leveraging technology, they become a sustainable business process.