What is spreadsheet risk ?

Spreadsheet risk is the risk of a serious adverse event for an organisation as a result of errors in the logic or operation of spreadsheets.

Spreadsheets made the modern business world.  Without them all sorts of business activities would not be possible.  They help model complex business deals;  they are essential to numbers driven activities like accounting and risk management.  They also act as the universal glue to patch together systems and business processes that do not quite work.

However, a constant stream of errors have made spreadsheets infamous.   Finsbury research with thousands of companies found that 70% of companies admitted to having had serious errors.   (Twenty percent said “do not know”, whilst only 10% said they had definitely not had an error.)

This research is corroborated by a steady stream of very large errors that hit the newspapers.   A few examples illustrate how spreadsheet errors can happen.

Public Health England Public Health England  (similar to the CDC in the USA) used spreadsheets to consolidate COVID case data.  A series of errors, including uses an old version of Excel and poor construction of spreadsheets resulted in them missing 16,000 cases from the statistics.   This had a significant impact on the official statistics and damaged the credibility of the organisation.

JP Morgan
JP Morgan reported a $6.2 billion loss when positions in a small, opaque derivatives market quickly lost value. An investigative report covered a catalogue of spreadsheet errors and control issues alongside significant management and operational deficiencies. Spreadsheets were mentioned 14 times in the report.

Lazard Ltd (LAZ.N), the investment bank that advised SolarCity Corp (SCTY.O) on its $2.6 billion sale to Tesla Motors Inc (TSLA.O), made an error in its analysis that discounted the value of the U.S. solar energy company by $400 million. This was the result of “ a computational error in certain SolarCity spreadsheets setting forth SolarCity’s financial information that Lazard used in its discounted cash flow valuation analyses,” according to a regulatory filing.


These errors have attracted the attention of regulators, especially in Financial Services and Life Sciences.   Regulators are gradually increasing the standards they require of spreadsheets.  See our summary of regulatory requirements for more info

This stream of errors has resulted in considerable suspicion of spreadsheets, without there being an obvious way to replace them or address the problem.   Many companies have had audit points warning that the company is heavily dependent on spreadsheets for years.

Fortunately, there are well established spreadsheet management processes out there that reduce risk and improve business processes. As is so often the case the company must address a mixture of people, process and technology.

A spreadsheet management process must reduce the risk of error, but the best environments also make sure the organisation gets the best out its spreadsheets, by training staff and actively re-engineering manual spreadsheet processes. If this is not done the spreadsheet management process can just become another layer of bureaucracy.

How to get started

Trying to get started with a new spreadsheet management process can be daunting.

A good starting point is to benchmark your current spreadsheet management processes.  Finsbury provide a free automated self-assessment questionnaire.   This looks at your controls, training and business process and provide a rounded assessment that considers all aspects of spreadsheet control.  Just click the spreadsheet control self-assessment link to get started.

If you want more information about how to create an effective spreadsheet management process or would like to discuss your self-assessment, please email us at info@finsburysolutions.com.

If you are starting out on spreadsheet risk management there are some common questions that many people have.  These are some of them.

Spreadsheets or end user computing ??

Q: Should we be considering other end user computing tools, such as Access databases??

A: In this introduction to keep it simple we have just talked about spreadsheets.  The reason for this is in most organisations spreadsheets make up 90% of the high risk end user computing applications.  However there is no reason why you should not cover other end user developed applications.   The only note of caution is to avoid being distracted by low risk items.  In most organisations spreadsheets comprise most of the risk.

Model risk vs spreadsheet risk

Q: How does spreadsheet risk relate to model risk?

A: Many financial services organisations need to manage model risk as well as spreadsheets.  In our experience around 60% of models are implemented on spreadsheets, although there will be plenty of models not on spreadsheets and plenty of high risk spreadsheets that are not models.  There is considerable overlap between spreadsheet and model risk, so it is sensible to consider combining aspects of each into a single whole.  For example both model risk and spreadsheet frameworks require an inventory.   Creating a single inventory avoids having to operate two inventories.