Uses of Excel in Companies/impact of SOX legislation

[Richard Schollar]

Guys

The firm I work for are in Life Assurance (they effectively operate as a store of retirement savings, however, invested in 3rd party funds). Over the recent past, management has placed an emphasis on moving away from using Excel for back office functions such as Finance and onto deriving data from a data warehouse model to provide and analyse the numbers.

This is to move away from the risks inherent in spreadsheets such as it being too easy to amend a critical formula etc. Indeed, the implementation of Sarbanes-Oxley legislation has made even the amendment of a single formula in a SOX-critical spreadsheet require a change request to be submitted to IT (who have zero knowledge/expertise with Excel) for review and sign-off before that amended formula can be implemented. This atmosphere therefore encourages users to move as much critical stuff away from reliance on Excel as possible.

I would be very interested to hear what others' experiences of how Excel is utilised in their firm's systems and processes are, and especially how and if SOX has impacted them. I think it would be especially relevant to know the size of the organisation concerned (my firm is a subsidiary of Credit Suisse).

Best regards

Richard

 

[Andrew Fergus]

Gidday

What is a SOX-critical spreadsheet? I'm curious about this SOX legislation because, in my current state of ignorance, it sounds patently absurd.

Unless I'm misunderstanding something, what organisation (or management for that matter) would have a business critical operation / function held in a spreadsheet? The way I interpret this is that if for example a user doesn't carry the one, then the entire business is at risk? It sounds absurd.

Which brings me to my second point. I don't have an issue with data warehouses per se but to be succesful they need a user friendly interface. Unfortunately the risks of users performing incorrect calculations is not eliminated by the platform, so why pick on Excel? Because most people use it? It sounds like complication for complications sake, because a user can make mis-calculations in data warehouse applications.

And the third absurdity, which you touched on, is the requirement for IT to sign-off any changes made to such spreadsheets. What qualifies an IT person any more than anyone else to judge if a function / formula has been used correctly in Excel? IT <> Excel. Much like an Excel expert is not necessarily a network expert - is there no distinction? What I can see is IT employing the services of Excel contractors to audit changes to SOX-critical spreadsheets. It sounds like an expensive and slow solution to what could be a really simple problem.

How did this legislation come about? Is it a consequence of a Barings Bank debacle or something?

Just my musings....

Andrew

 

[Richard Schollar]

Hi Andrew

Sarbanes-Oxley, or SOX, seeks to prevent inaccurate or misleading financial information finding its way into a company's financial statements (for example, the profit&loss account) by ensuring that companies have internal controls (for which read 'nightmare bureaucratic structures') in place to ensure this doesn't happen. In my workplace, a SOX critical spreadsheet is therefore one that will subsequently feed a line in the reported results (say Financial Investments or Inventories or Revenue for the period) because it has been used to calculate a number aggregated into that line.

It came about in the wake of the Enron scandal in the US when a perceived lack of internal controls enabled the management to hide enormous liabilities from public view.

I can see benefits from using the warehouse, because at the moment we have x thousands of spreadsheets which are all potential sources of error (I'm not saying they are all wrong), whereas the warehouse model assists in limiting, but not removing, the potential for errors, and there is a whole team of IT people supporting the warehouse.

I do agree that a well developed and executed spreadsheet can be as good as any system, the problem (at my work, anyway) is that not all spreadsheets we use meet such standards. It also makes life a little difficult if someone who has created and maintained that spreadsheet then goes off sick or leaves the company, especially if no-one else really knows how it works. I agree that this is not actually the fault of the spreadsheet, however.

Richard

 

[Andrew Fergus]

Hi Richard

Ah now I see. I suspect the Enron case wasn't an issue about an Excel spreadsheet. Those who are sufficiently determined will always find new (and old) ways of defrauding investors. Booking loans as income is not a new technique for defrauding investors (not in this part of the world anyway!).

Whilst I agree with your comments on internal controls, for a fraud of that magnitude to go undetected takes some pretty sloppy practices on the part of independent directors (if any) and external auditors. I know auditors are the perennial whipping boys, and whilst I commiserate with them, not all are as *clean* or independent as we are lead to believe.

That aside, I don't believe a data warehouse is the answer because the absence of controls in an environment where an Excel spreadsheet is employed would be equally lacking in the same environment that uses a data warehouse. Like I mentioned in my first post, most front end packages for data warehouses have the ability to perform calculations. So in a nutshell, the controls have to be independent of the platform - it is not the platform that provides the internal control.

Blind reliance on financial results from any computer system is asking for trouble - at a minimum any such results should be subjected to a 'reasonableness' test. Does this number make sense? Does it reflect what I know about the business? I could bang on about internal controls all night (but I won't ) and I agree with your closing comments. A number of orgnisations in NZ are trying to clamp down on the proliferation of databases for exactly the same reasons.

Cheers and good luck!
Andrew

 

[gwkenny]

If someone goes on vacation and gets sick and someone can't understand the tools (spreadsheets what not) they are using, then that is the fault of the Company.

Everybody's work should be well documented. Everyone is replaceable, but the question is how long does it take for someone to takeover another's duties? That's where documentation and standard operating procedures are important.

As for what you are describing, that seems a very unworkable solution. Companies are not single business entities, more often than not there are a number of core businesses. Each may have it's own Enterprise Wide solution, but those ERP systems over different business segments are not going to be able to be consolidated into a single financial statement reporting system unless someone spent a hell of a lot of amount of time to build it all so it all comes together and the line items for each business segment correlate with all the others. Also, imagine the software integraton required for takeovers or mergers!!!

Unfortunately you are a subsidiary of Credit Suisse. That certainly doesn't help things. Credit Suisse Top management is not free with their information and have very little credibility in my opinion (top management came in and said my department wasn't going to get axed, and then a month later, all 200+ of us were let go. Employees had to sue credit suisse to get their just compensation - and the ex-employees won of course, but it didn't have to be so arduous except for CS's stance).

I agree with Andrew, this won't help prevent another Enron. GIGO. This just adds to overhead which needs to be passed on the consumer and it's also a pass the buck thing so management can blame someone else if things screw up (something that seems to be in the CS culture).

As for the concept of data warehousing... I don't like the concept in general. If one is going to the bother of warehousing data, then they should put it into an enterprise solution so that the data can be manipulated to create reports and be actionable.

 

[Richard Schollar]

One big problem I see in our data warehouse is it severely limits our flexibility to provide time-critical reports if requirements change. Still, I'm sure our top management gave that due consideration before they ploughed millions into the DW

One thing I passionately believe is that SOX - or a system of rules like it - will not in any way, shape, or form, materially limit, reduce or remove the likelihood or potential for another Enron. Of course, the politicians who created the legislation would no doubt disagree.

Richard