If any further proof was needed that the use of spreadsheets to manage financial data is one of the business world's self-acknowledged unhealthy habits, consider this: Not a single company agreed to discuss its use of spreadsheets on the record for this story.
In fact, nearly a dozen organizations from various industries, most of which undoubtedly use spreadsheets in one fashion or another, declined invitations to participate. One brave company that has adopted spreadsheet governance software agreed to share its story, but only if it was not identified.
And it's no wonder. Even our anonymous interview subject was clear about the problems spreadsheets introduce.
"Any process that's managed in a spreadsheet is a huge red flag," said the source, a director of information systems for a provider of bond insurance. Yet, despite that assessment, "the spreadsheets are a necessity. You'll never squeeze them out of your financial processes."
In fact, the event that led the company to share its story was the discovery of a "material deficiency" that allowed an incorrect number to appear in a quarterly earnings report, a clear no-no, given that the company is publicly traded and thus regulated by the Sarbanes-Oxley Act.
"Even though we had people eyeballing that stuff, we still published a wrong number," the source said.
The company's experience provides a textbook example of how the data manipulated in spreadsheets -- even those used for very specific calculations that have little to do with a profit and loss statement -- can result in erroneous numbers finding their way into inconvenient places.
Errors set the stage for spreadsheet governance software
In the case of the bond insurance company, one of its main uses of spreadsheets is for financial modeling. For instance, it uses spreadsheets to model risks associated with unpredictable events, such as Hurricane Katrina or the city of Detroit's bankruptcy. Financial analysts fill spreadsheets with a variety of data, including newsfeeds on the developing crisis and a variety of financial considerations, and use them to determine how much cash is the right amount to keep in reserve to cover anticipated claims.
The reason a process like this unfolds in spreadsheets is simple, according to the source: "You don't want to build institutional systems for these kinds of bespoke situations." In other words, since crises are normally one-off events that pass relatively quickly, the associated data is only needed temporarily before being placed in longer-term storage, or potentially even deleted. And each crisis that arises is unique, making it difficult to find a software product that can handle every variation.
But such transient data still needs some level of institutional control.
"As the quantitative analysts develop these bespoke models, they do wind up with numbers that find way into regular ERP [enterprise resource planning] systems," the source said. "Hence, we need controls to meet regulatory requirements."
The company thought it had set up sufficient controls, having developed a model governance framework to oversee these modeling spreadsheets. The policy dictates how spreadsheets are written, and it subjects each spreadsheet to a peer review process to ensure its integrity.
And yet, that material deficiency still found its way into an earnings report -- as did other lesser deficiencies. The reality, the source said, is that when so much data is presented in rows and columns, the human eye simply can't be expected to catch everything.
Spreadsheet governance software spots problem areas humans miss
The glaring error spurred the company to get more sophisticated in its governance efforts by deploying technology from Cimcon Software, a vendor of spreadsheet governance software tools.
Not that the adoption of software to watch over spreadsheets -- software that would require a few extra process steps on the part of spreadsheet users, mind you -- wasn't met with resistance.
"Culturally, it's very tough at a company to bring certain disciplines into play," the source said. "People say, 'I've been doing spreadsheets for years; this is just more stuff; I don't understand the value.'"
More on spreadsheets
Discover the top five risks of using spreadsheets in finance
Sarbanes-Oxley compliance: GRC technology or spreadsheets?
What's the danger of using spreadsheets for statistical analysis?
To those types of grievances, the source offered users a more practical reason: Namely, that spreadsheet governance tools mitigate the risk of key employees leaving and taking best practices with them.
But where Cimcon's spreadsheet governance technology has had its greatest impact is in the newfound transparency it's lent to the company's spreadsheet processes. The software's ability to search for out-of-pattern scenarios has ensured that errors are brought to the forefront, enabling them to be addressed during the peer review and model governance processes. For instance, some 80%of those processes were previously devoted to looking for problem areas, while just 20% was spent actually investigating known issues. Now, that proportion has flipped.
"What Cimcon has allowed us to do is literally put eyeballs on things that humans couldn't put eyeballs on before," says the source. "It's allowed us to get much more confident that [the] number we're signing off on is correct."
Entrenched Excel use creates demand for spreadsheet governance tools
Even though, as the source said, any process managed in a spreadsheet should be considered a red flag, the company has no plans to abandon its use of spreadsheets any time soon. And, experts say, the same can be said for many other companies whose reliance on spreadsheets for critical numbers-crunching processes has become deeply embedded. This is why the source said spreadsheet management has become "extraordinarily critical."
"Companies that realize they need to operate in the spreadsheet world really need a solution," he said.
As a result, things look rosy for Cimcon and other vendors that are addressing what is an expanding market opportunity. They're essentially helping companies ensure that a seemingly untenable process remains a justifiable part of doing business -- at least for now.
When it comes to spreadsheets, "The best thing you can do is manage the risk," said Sanjay Agrawal, director of product management at Cimcon. "If and when you do replace the spreadsheets, that's great. Until then, we'll be there."
About the author:
Tony Kontzer has been writing about technology and business for nearly 20 years and currently freelances from his home in the San Francisco Bay area community of Albany. A 1988 graduate of the University of Missouri-Columbia School of Journalism, Tony spends his spare time relaxing with his wife, playing with his three sons, tinkering around his home, and when time allows, playing saxophone and traveling. His somewhat infrequent Twitter posts can be found at @tkontzer.