Close this search box.

How Companies Can Manage Spreadsheet Risk [Part 2 of 4]



This series of articles will give you an overview of how to manage spreadsheet risk. These articles are written by Myles Arnott from Excel Audit

Introduction to Spreadsheet Risk Management

In the first article in this series we highlighted the risks that poorly managed spreadsheet solutions can introduce to a business. In this article we will demonstrate how companies can manage this risk.

A formal governance framework

The first, and arguably most important step is to ensure that the senior management team buy into the need for a robust spreadsheet risk management framework, and that they define and effectively communicate their spreadsheet risk management policy.

Spreadsheets identified and catalogued

It is impossible to know the level of spreadsheet risk in an organization without first identifying and then risk assessing all of the spreadsheets. It is therefore necessary to create a catalog of all of the spreadsheets and then to gather the key information about each spreadsheet to enable a risk assessment to be carried out.

The two key factors for determining the spreadsheet risk are the probability of there being an error and the impact that that error could have.

Risk = Probability of an error  X  impact if an error were to occur

The probability of error is related to the complexity of the spreadsheet. Complexity attributes differ across companies but include:

  • Spreadsheet size (Mbs)
  • Spreadsheet design (hard coded numbers in formulae, poor model structuring etc)
  • The number of users
  • The use of complex formulae (particularly array formulae, nested formulae etc)
  • The number of cells populated
  • The number of internal and external links
  • The use of VBA

The impact of the error is related to how critical the spreadsheet is within the business. Each company will have a slightly different definition of the impact levels of spreadsheets, but generally:

  • A spreadsheet is low impact if it is not used as part of a critical business process and an error would not have a material impact on the business.
  • A spreadsheet is medium impact if it contains confidential information and an error could have a material impact on the business.
  • A spreadsheet is high impact if it contains highly confidential information and an error would have a significant impact on the business. Spreadsheets used within processes that fall under external regulation (such as Sarbanes-Oxley and Solvency II) are deemed to be of high impact.

Finally, the spreadsheets should be placed in order of risk. Those identified as business critical and high risk should be prioritized for detailed review and placed under control.

This is clearly an on-going process. As new spreadsheets are developed they will need to pass through the risk assessment process as defined by the company’s spreadsheet risk management policy. A periodic review should also be carried out to ensure that all spreadsheets have been correctly categorized.

A best practice standard

The company should define its own best practice spreadsheet development standard that is applied to spreadsheets deemed to be medium or high impact. The standard should clearly outline the standards and conventions to which a spreadsheet should be built. New developments can then be reviewed to ensure that they adhere to the standard.

We advocate the use of the Excel Best Practice Standard from the Spreadsheet Standards Review Board (‘SSRB’).

We also recommend that tailored schedules are added to the standard to reflect your specific design standards. For example this could be a specific color scheme, use of logo or the use of specific text within the header or footer (e.g. document security levels).


A fundamental, but often overlooked step in the Excel model development cycle is testing. All spreadsheets (but especially business critical spreadsheets) need to be first peer reviewed and then rigorously tested.

It helps to consider the steps that an IT department would take to ensure that something they deliver is correct. It will pass through stages of unit and system testing prior to quality assurance and finally user acceptance testing. So why should a spreadsheet being used for a critical process be any different?

The fact is that no matter how hard we try, humans make errors. The purpose of testing is to identify them and get them resolved before the model goes into the live environment.

Remember that in the first article we highlighted the fact that 94% of spreadsheets and 5% of all formulae within spreadsheets contain errors.

Here is Scott Adams’ view on spreadsheet testing in Dilbert




All staff should be trained so that they have sufficient Excel knowledge for their role and to use the spreadsheets that they are responsible for. As part of the induction process all staff should also be taught the company’s best practice standard.

Whilst this sounds obvious, research has shown that few companies prioritize investment in spreadsheet training.



A key risk with spreadsheets is that they are often built and used by one individual within a team (often referred to as a “key man dependency”). If this person is ill or leaves unexpectedly the other members are totally reliant on the documentation left behind. From experience this rarely exists.

Each spreadsheet that is used within a process should as a bare minimum have documentation stating:

  • the purpose of the spreadsheet;
  • how the spreadsheet fits within the process;
  • the source of all inputs for the spreadsheet;
  • all key assumptions and drivers;
  • key calculations;
  • distribution list for outputs.

Spreadsheets that are part of as critical business process should have detailed documentation. This should include a technical specification and user notes.



All business critical and confidential spreadsheets should be subject to access control. Security controls can be implemented across three levels:

  • Directory level: Only specific individuals have access to key directories
  • File level: Confidential and critical spreadsheets should be password protected to restrict access
  • Cell level: Non-input cells should be password protected


Change control, backups and archives

To minimize the risk of losing the current version of a spreadsheet and ensuring that the correct version is being used at all times, all business critical spreadsheets should be backed up, archived and subject to change control procedures.

So, in summary..,

the characteristics of a well-managed environment are:

  • a formal governance framework, sponsored by the senior management team, is in place for all spreadsheet development;
  • a catalog of spreadsheets is maintained and prioritized by risk profile;
  • a best practice standard is applied to the development of all new spreadsheets;
  • all new spreadsheets pass through a formal risk assessment, are peer reviewed and formally tested;
  • staff are provided with sufficient training to carry out their roles;
  • all spreadsheets and their associated processes are well documented;
  • access to critical spreadsheets is subject to security controls;
  • spreadsheets are subject to change control and are regularly backed up and archived.

What next?

In the next article we will look at the built in Excel functions that can help you to manage spreadsheet risk.

What about you?

How do you (or your company) manage spreadsheet risk? What best practices & guidelines you follow? Please share using comments.

Thank you Myles

Many thanks to Myles for writing this series. Your experience in this area is invaluable. If you enjoy this series, drop a note of thanks to Myles thru comments. You can also reach him at Excel Audit or his linkedin profile.


Share this tip with your colleagues

Excel and Power BI tips - Chandoo.org Newsletter

Get FREE Excel + Power BI Tips

Simple, fun and useful emails, once per week.

Learn & be awesome.

Welcome to Chandoo.org

Thank you so much for visiting. My aim is to make you awesome in Excel & Power BI. I do this by sharing videos, tips, examples and downloads on this website. There are more than 1,000 pages with all things Excel, Power BI, Dashboards & VBA here. Go ahead and spend few minutes to be AWESOME.

Read my storyFREE Excel tips book

Excel School made me great at work.

– Brenda

Excel formula list - 100+ examples and howto guide for you

From simple to complex, there is a formula for every occasion. Check out the list now.

Calendars, invoices, trackers and much more. All free, fun and fantastic.

Advanced Pivot Table tricks

Power Query, Data model, DAX, Filters, Slicers, Conditional formats and beautiful charts. It's all here.

Still on fence about Power BI? In this getting started guide, learn what is Power BI, how to get it and how to create your first report from scratch.

9 Responses to “How Companies Can Manage Spreadsheet Risk [Part 2 of 4]”

  1. Sachin says:

    Thank you Myles and Chandoo. I've forwarded this to my department and we are going to instutute the review this month.

    What a great series!

  2. Frank Linssen says:

    Great serie of articles about a subject that doesn't get enough attention and can't get enough attention too.
    When can we expect article nr 3 and 4 ?

    Really curious to read the rest.


  3. Patricia says:

    Myles - Nice series. It is an important topic that so often is overlooked as people rush to meet deadlines and/or rely on the worksheets of others.

  4. Brian says:

    When it comes to someone else auditing your spreadsheet it not practical in most cases. To often no one has time and magament expect my sheets to be right. Often no one in the company has the skills to correctly audit my sheets.

  5. Múcio Batista says:

    Brilliant Article! Congratulations guys! Very useful tips to effectively mitigate the risk in the corporations. I'll share this serie with my team here in Brazil.

  6. Marco G says:

    Very interesting article. Somebody has an example of spreadsheet inventory? Thanks.

Leave a Reply