By Diane Robinette, CEO, Incisive
This past October during a sale to Vista Equity Partners, Tibco Software suffered a costly, $100 million, spreadsheet mistake. Goldman, Tibco’s adviser in the deal, used a spreadsheet that overstated the company’s share count in the deal. This error led to a miscalculation of Tibco’s equity value, a $100 million savings for Vista, and a slightly lower payment to Tibco’s shareholders.
While it is too soon to know if this mistake was fraudulent or if it was a simple “fat finger” error, this blunder confirms enterprises continue to struggle with spreadsheet management. It is unclear who created the spreadsheet and who changed what; however, had spreadsheet management software been in place, these answers would have been easily obtained.
Manually double checking numbers in complex and critical spreadsheets leaves an organization vulnerable to risk. Spreadsheets alone provide little to no protection against data corruption and no way to validate information or error checking, nor do they offer the transparency organizations require today.
Despite spreadsheet risk, and as hard as some organizations have tried to reduce their usage, spreadsheets continues to proliferate. Users are comfortable in Excel, and spreadsheets continue to meet the analytical needs of companies today, especially for analyzing and reporting financial results and providing evidentiary support for decision-making.
Fortunately, advances in technology are enabling financial institutions to overcome spreadsheet complexities. Automated risk and analysis solutions provide the much needed insight into potential risk and errors that may be hiding in spreadsheets. Yet most organizations don’t utilize spreadsheet management solutions simply because they are unaware this technology exists.
Spreadsheet visibility is critical
Taking a methodical approach to understanding where risk may hide is the first step in managing spreadsheet risk across an organization, this requires visibility. Spreadsheet management solutions offer detailed insight into spreadsheets regardless of where they reside on a network or how many spreadsheets exist. These solutions provide visibility into who is working on a spreadsheet, how many people are working on them, when something changes, what changed, and who made those changes. The ability to monitor and track this information over a period of time provides valuable insight into whether policies are being met while making it significantly easier for auditors to identify potential risk.
For even greater visibility and risk management, many spreadsheet management solutions will allow organizations to set threshold alerts if certain changes occur such as commission percentages or diluted shares. These red flag-type alerts can be customized to meet a certain criteria and can be as basic or detailed as necessary. Thresholds can also be set to alert users to disparate currency and tax changes; this information is especially helpful when dealing with global mergers and acquisitions. Threshold alerts serve as automated checks and balances to ensure changes are not missed. For example, had an alert been set to notify users when the number of shares was changed in the Tibco case, this issue could have easily had been avoided.
Solution requirements for reducing risks
It is important to note when considering a spreadsheet management solution that not all systems are created equal. To minimize the chance of costly errors, enterprises must implement a systematic, cross-departmental solution for spreadsheet analysis. Some of the requirements for implementing such a solution include:
- Completeness. Enterprises need a way of automatically discovering and cataloging all spreadsheets so that no relevant collection or analysis of data is excluded from error-checking and analysis;
- Accuracy. Error-checking should automatically uncover risks and errors and improve the accuracy of spreadsheets;
- Speed. Enterprises need to be able to check spreadsheets, even 100 MB spreadsheets, quickly. Manual inspection often takes days or weeks;
- Scalability. Analysis tools that might work on a few 10 MB spreadsheets might become impractical when there are 25 spreadsheets averaging 100 MB each. At many large enterprises, the core business may be managed through hundreds of spreadsheets averaging 80-100 MB each. The solution should be able to accommodate this much data or more;
- Ease of use. Once risks are identified, correcting them should be fast and easy. Users should not have to switch back and forth between reports and spreadsheets or databases and spreadsheets in order to assess errors and apply corrections. They should be able to assess risks and make changes directly in the spreadsheet itself;
- Rapid training. Intuitive design and helpful documentation should make it easy for organizations to adopt a spreadsheet risk management solution. By reducing training requirements, the risk management solution boosts spreadsheet users’ productivity; and
- Support for best practices. Spreadsheet analysis and risk notification should support industry and organizational best practices for developing and maintaining spreadsheets. For example, if a spreadsheet risk analysis application flags errors by reformatting spreadsheet cells, it might create confusion in organizations that use formatting such as color-coding to identify different types of cells, such as input cells. Risk analysis should highlight risks without altering or overwriting spreadsheet contents.
Spreadsheets remain critical analysis tools for enterprises. In the coming years, spreadsheets can be expected only to grow in size and complexity. This means the challenges of managing spreadsheets and the associated risk will only increase.
Errors or deviations can be costly, resulting in bad business decisions, regulatory penalties, and even lawsuits. The Tibco situation didn’t need to happen. There are user-friendly enterprise offerings available for managing spreadsheets and reducing risks so that other companies can avoid similar costly spreadsheet mistakes. With the right controls and technology in place, visibility can be achieved, and costly errors avoided.