Quantifying risk in Excel spreadsheet changes

DiffXL

By their very nature, spreadsheets change

Change matters

But who cares about spreadsheet change?

Spreadsheet owners & risk managers

Internal & external auditors

Paul Sarbanes

Mike Oxley

How do companies deal with spreadsheet

change?

In a perfect world …

Every spreadsheet would be audited

and all risks would be mitigated

What do real-world managers say about spreadsheet changes?

We would obviously test and document any changes – But we haven’t amended anything this year.

We always check the changes before release, but they’re not major enough to change the documentation

What do real-world managers say about spreadsheet changes?

What happens when we talk to real-world auditors about spreadsheet auditing?

Realistically, we’d probably expect some small unexplained variations in the final results

What happens when we talk to real-world auditors about spreadsheet auditing?

We’ll always check the high risk spreadsheets, but the rest tend to get ignored – We’ll do them all some day.

The result?

Everything’s fine, boss

… yes, just fine

Is this how you see a spreadsheet?

This is how DiffXL sees a spreadsheet

Base X Y Gamma DeltaCORONA - GLASS7.031065 4.502179 0.01311 0.059024CORONA - GLASS61.91627 17.35029 0.308808 5.357904CORONA - GLASS126.6281 96.10542 4.662414 448.0832CORONA - GLASS0.856899 0.316199 0.032906 0.010405CORONA - GLASS14.93735 7.117257 0.428304 3.048348

Standard spreadsheet view

Formula view(R1C1 style, available in Excel)

Formula map view(as processed by a formula map tool)

Formula mapsA visual representation of a spreadsheet

Examples of changes to the shape & colour

of a formula map

Original view(Formula map version)

Original view(Formula map version)

Column addedwith new text and formula

Original view(Formula map version)

Original view(Formula map version)

Region extended, one text cell and one new formula added at the bottom

Original view(Formula map version)

Some changes offer little

genuine risk

Original view(Formula map version)

Entire region moved and text entered in cell B2

Original view(Formula map version)

Others give cause for concern

Original view(Formula map version)

Text overwrites formula in C5, new formula in cell E5

Original view(Formula map version)

DiffXL also stores some other basic data about the structure. Altogether this means it can ascertain data and formula ranges that have been …

Changed, Combined, Created, Deleted, Extended,

Moved, Overwritten, Shrunk, Sorted or Split

DiffXL

Considers a spreadsheet as a set of contiguous coloured rectangles

DiffXL

Considers a spreadsheet as a set of contiguous coloured rectangles

Looks at how the shapes & colours change

DiffXL

DiffXLConsiders a spreadsheet as a set of contiguous coloured rectangles

Looks at how the shapes & colours change

And assigns the spreadsheet an appropriate change-risk metric

Why measure risk and not just change?

Because when we understand the true

Effort

Riskwe can assign themost appropriate

to minimize the overall

Cost

... and so concentrate on the things that really

matter

DiffXL analysis can be run ….

Automatically during a file save or publish (SharePoint)

DiffXL analysis can be run ….

Automatically during a file save or publish (SharePoint)

As part of a monthly, quarterly or yearly checking process (Excel or SharePoint)

DiffXL analysis can be run ….

Automatically during a file save or publish (SharePoint)

As part of a monthly, quarterly or yearly checking process (Excel or SharePoint)

Manually in Excel by a user, manager or auditor

DiffXL analysis can be run ….

How can DiffXL helpauditors?

It can be run quickly and simply against every important spreadsheet

It identifies spreadsheets where the underlying data has changed

It highlights spreadsheets whose

calculation methods have been modified

It can spot spreadsheets that are fundamentally the same

How can DiffXL helpdepartmental & risk

managers?

It can identify spreadsheets that have been changed accidentally

It can isolate spreadsheets that require re-documenting or re-testing

It can recognize a spreadsheetin need of attention

... and it can be used to locate

issues pro-actively, allowing managers

to resolve problems at a

convenient time before audit.

Plus, there’s a little benefit on the side …

Happy users!

Happy users!

Why so?

They can demonstrate that their changes are

of little risk

Restrictive or time consuming change procedures can be targeted towards high risk changes

They can identify any high-risk changes themselves

… and mitigate them if required

So where does that leave companies using a DiffXL approach to spreadsheet change?

Informed managers

DiffXL

Satisfied auditorsInformed managers

DiffXL

Happy users Satisfied auditors

Informed managers

DiffXL

Beautiful

Excel & SharePoint are registered trademarks of Microsoft Corporation.

DiffXL is a registered trademark of ExcelforManagers.com.Copyright 2009 Excel For Managers. All rights reserved.