Getting to Grips With Spreadsheet Risk

Every now and then a new story of corporate embarrassment, or worse, caused by spreadsheet errors hits the business headlines. Sometimes the mistakes are on a scale that can only be described as monumental, like Fannie Mae's $1 billion-plus underestimate of total stockholder equity in 2003, the result of errors in a spreadsheet used in the implementation of a new accounting standard. Or the cut-and-paste snafu in the same year that caused Canadian power company TransAlta to spend $24 million more than it intended to on hedging contracts. Both of those horror stories pale, though, next to the $2.6 billion error uncovered at Fidelity Investments in 1994 when a tax accountant omitted a minus sign while keying information from the fund's financial records into a separate spreadsheet, turning a $1.3 billion loss into a $1.3 billion gain.

Chilling though the stories may be, finance leaders tend to shrug them off, believing "it could never happen here." But a slew of academic studies over the last 10 years showing that upwards of 86 percent of spreadsheets contain errors suggests that confidence may be misplaced. And the errors are by no means always trivial, according to Kenneth R. Baker, professor in the Tuck School of Business at Dartmouth College. In a 2007 paper, Baker and colleagues Stephen G. Powell and Barry Lawson examined 25 spreadsheets provided by two consulting companies, a financial services firm, a manufacturing company, and an educational institute. They found 381 potential errors, 117 of which were confirmed as errors by the developers of the spreadsheets. About 60 percent of the confirmed errors had a quantitative impact on the spreadsheets' results; the largest was $100 million.

Interestingly, many of the spreadsheet developers were not particularly surprised or dismayed by the errors that the research turned up. "We were prepared for the fact that there were large economic implications in some cases," says Baker, "but we were also a bit surprised to find that sometimes when we discovered errors, the people whose spreadsheets these were dismissed our findings for one reason or another." Sometimes the reaction was that the result was "close enough."

Maybe so, but still ... a note of complacency here? More reason to think so comes from a recent Deloitte online poll of some 3,000 finance pros. When asked how their company handles spreadsheet risk, only about 42 percent of respondents said it's part of a periodic risk assessment. And more than 17 percent answered "don't know/not applicable," a result that surprised Michael Juergens, principal with Deloitte & Touche LLP. "Spreadsheets are so widely understood in terms of functionality -- and everybody's got a spreadsheet story about something bad that happened -- that it seemed to me that people would be very aware of the problem," he says. "You would think they'd be having discussions about what to do about it."

Sarbanes-Oxley was a strident wake-up call, but one that didn't give companies enough time to approach spreadsheet risk management systematically. "They may have touched on it a little bit, but they didn't know how to handle it, so they stepped away," says Sarah Adams, director with Deloitte & Touche LLP and leader of the firm's national IT internal audit practice.

But now companies are starting to circle back to the problem, armed with a deeper understanding of what's needed to fix it and an expanded range of software tools for the job.