Question

Write a business report (about 600 words) critically evaluating spreadsheets as a tool for accounting. Use Internet resources. Include a section on the advantages and disadvantages of spreadsheets. Refer to the Internet for advice on Business Report structures. Reference ALL your sources.

Answer 1

Introduction

Many companies rely on spreadsheets as a key tool in their fi nancial reporting and operational processes. As a result, the use of spreadsheets is an integral part of the information and decision-making framework for these companies. In developing and using spreadsheets, companies need to balance their ease and fl exibility against the importance of reliable information for management’s use. The requirements under Section 404 of the Sarbanes-Oxley Act increase the focus on controls related to the development and maintenance of spreadsheets. This paper discusses the evaluation of the control environment and specifi c control activities that should be considered by management in evaluating the use of signifi cant spreadsheets as part of their 404

process.

As users of spreadsheet applications such as Microsoft Excel® or Lotus 1-2-3® have become more

sophisticated, so have spreadsheets. Once used to support simple functions such as logging, tracking and totaling information, spreadsheets with enhanced formulas and built-in advanced features are now used to support such business functions as complex valuation models. The use of macros and multiple spreadsheets which are linked together allows users to build very complicated—and sometimes convoluted—models and other business functions with minimal or no documentation. In addition, these complex spreadsheets are not

normally supported by the same control environment as formally-developed, purchased applications. For example, the developers and users of spreadsheets are usually not trained in structured programming, testing, version control or systems development life cycles, and spreadsheets are rarely restricted from unauthorizedaccess by security controls.BackgroundSpreadsheets typically have a wide rangeof complexity and usage. It is important toseparate the complexity and usage issues, asthe control requirements may be different for acomplex spreadsheet used by one person withspecifi c expertise than for a spreadsheet used and modifi ed by many people. Whatever the

situation, companies need to carefully evaluate if it is possible to implement adequate controls

over the spreadsheets supporting signifi cant accounts and disclosures. As some companies have discovered, errors in relatively simple spreadsheets can result in potential material misstatements in their fi nancial results. Recently, several large companies have either

publicly disclosed control defi ciencies or been publicly censured by regulators related to insuffi cient spreadsheet controls.

An article in the May 24, 2004 issue of Computer World indicated that, “Anecdotal evidence suggests that 20% to 40% of spreadsheets have errors, but recent audits of 54 spreadsheets found that 49 (or 91%) had errors, according to research by Raymond R. Panko, a professor at the University of Hawaii.” The Journal of Property Management on July 1, 2002 stated, “30 to 90 percent of all spreadsheets suffer from at least one major user

error. The range in error rates depends on the complexity of the spreadsheet being tested. In addition, none of the tests included spreadsheets with more than 200 line items where the probability of error approaches 100 percent.” Perform an online search for spreadsheet errors or spreadsheet audit, and you will find a number of major failures attributed to spreadsheet inaccuracies that hit the press in the past year alone. Even seemingly simple calculations may

present the risk of a misstatement. Macros (symbols, names or keys that represent a

list of commands, actions or keystrokes) or other functions embedded into spreadsheets

may drastically impact the functioning of the spreadsheet. For example, a macro embedded into a spreadsheet designed to total invoices for recording an accounts receivable balance may add unsupported amounts to the balance. Visual review of the spreadsheet

would probably not identify the error, and analytical review would also not identify the error if the macro is consistently present across the periods under review. Controls that may help mitigate these risks include access controls that limit which employees may view and update the spreadsheet, recalculation of key spreadsheet metrics and comparison to calculated values, and detail review and testing of calculations embedded in the spreadsheet. How Are Companies Using Spreadsheets?

To assess how companies are using spreadsheets, it is helpful to categorize both the uses and complexity of spreadsheets. The uses of information contained in spreadsheets can be grouped into the following categories: _ Operational: Spreadsheets used to facilitate tracking and monitoring of workfl ow to support operational

processes, such as a listing of open claims, unpaid invoices and other information that previously would have been retained in manual, paper fi le folders. These may be used to monitor and control that fi nancial transactions are captured accurately and completely.

_ Analytical/Management Information: Spreadsheets used to support analytical review and management

decision-making. These may be used to evaluate the reasonableness of fi nancial amounts.

_ Financial: Spreadsheets used to directly determine fi nancial statement transaction amounts or balances

that are populated into the general ledger and/or fi nancial statements.

The complexity of spreadsheets may be categorized in the following manner:

_ Low: Spreadsheets which serve as an electronic logging and information tracking system.

_ Moderate: Spreadsheets which perform simple calculations such as using formulas to total certain

fi elds or calculate new values by multiplying two cells. These spreadsheets can be used as methods to

translate or reformat information, often for analytical review and analysis, for recording journal entries or

for making a fi nancial statement disclosure.

_ High: Spreadsheets which support complex calculations, valuations and modeling tools. These

spreadsheets are typically characterized by the use of macros and multiple supporting spreadsheets

where cells, values and individual spreadsheets are linked. These spreadsheets might be considered

“applications” (i.e., software programs) in their own right. They often are used to determine transaction

amounts or as the basis for journal entries into the general ledger or fi nancial statement disclosures.

Summary

Many companies rely on spreadsheets as a key component in their fi nancial reporting and operational

processes. However, it is clear that the fl exibility of spreadsheets has sometimes come at a cost. It is

important that management identify where control breakdowns could lead to potential material misstatements

and that controls for signifi cant spreadsheets be documented, evaluated and tested. And, perhaps more

importantly, management should evaluate whether it is possible to implement adequate controls over signifi cant

spreadsheets to suffi ciently mitigate this risk, or if spreadsheets related to signifi cant accounts or with higher

complexity should be migrated to an application system with a more formalized information technology control

environment. Understanding how spreadsheets are used and the adequacy of related controls is a critical part

of management’s assessment of the effectiveness of its internal control over fi nancial reporting under Section 404.

Preventing Unauthorized Access to Spreadsheets

Spreadsheets offers technolgies for helping to secure critical spreadsheets from

unauthorized access and modification on both the client and server related to work book

encryption, permission, sharing, better control over who can open, copy, print, or forward

information