EuSpRIG 2002 symposium
European spreadsheet risks interest group third annual conference
July 18/19 2002 Cardiff, Wales. http://www.eusprig.org
The theme of this year, “Spreadsheets – the hidden corporate gamble” captured the current concerns about corporate risk and auditing accounting systems. One of the talks described how the manipulation of a spreadsheet at AIB’s Allfirst subsidiary could easily have been seen by a spreadsheet formula audit tool.
David Chadwick (University of Greenwich) in his introduction in the proceedings “Training Gamble leads to Corporate Grumble” highlighted the need for awareness of spreadsheet risks to be included in curricula for professional examinations such as the Certificate in Information Systems Auditing (CISA) and the Qualification in Computer Auditing (QiCA).
David Banks, Ann Monday (University of South Australia) ‘Interpretation As A Factor In Understanding Flawed Spreadsheets’
David Banks summarised what we know about the prevalence of spreadsheet errors. He went on to discuss the place of interpretation as a complicating factor, the tendency of people to selectively present data that support their case. He described some teaching situations where the students find it very had to believe that there is more than one possible answer, and no single ‘correct’ answer. Looking at how they work and think, and some of the cultural background, gives some insights into how easy it is for people to get hooked into certain patterns of thinking.
Thomas Grossman (University of Calgary, Canada) ‘Spreadsheet Engineering : A Research Framework’
Tom Grossman took what is known from the long and painful history of of software ‘engineering’ and applied it to spreadsheet development. He listed eight principles showing the benefits of best practices chosen for specific situations. He also described distinguishing features of spreadsheet use, such as exploratory modelling and their use for rapid re-evaluation of strategic impact. The observation that increased experienced with spreadsheets is not correlated with increased quality is related to the difference between amateurs who are results-focused and tend not to consciously improve their process; and professionals, who do reflect on their own work methods. The heterogeneous nature of spreadsheet developers means that no ‘one-size-fits-all’ model of spreadsheet ‘programmer’ can be applied. He concluded by outlining a number of areas where further research could usefully by conducted.
Markus Clermont (University of Klagenfurt, Austria) ‘A Spreadsheet Auditing Tool Evaluated In An Industrial Context’
Markus Clermont described the classic scenario where a computer science student was given a project to audit some spreadsheets in industry. A Linux-based toolkit was made available. The company concerned said “Well, of course you won’t find anything, our developers are very good and these spreadsheets have been in use for a while”. (Spreadsheet auditors don’t take bets with project managers on statements like that, it would be like taking candy from babies.) In fact, the student found 109 different kinds of defect giving rise to 1,832 actual errors, an overall error rate of 3%. The true measure of the significance of the finding was the changes the company then made, not just to the spreadsheets but to the personnel!
Martin Campbell-Kelly (Warwick University) “The rise and rise of the spreadsheet”
Professor Martin Campbell-Kelly gave an historical perspective from the early days of modelling systems to VisiCalc, Lotus 1-2-3, and Microsoft Excel. That induced nostalgia in a number of members of the audience; I remember my own financial modelling system that I developed for the PDP-11 and the VAX in the late seventies!
Ray Butler (HM Customs and Excise) “Losing at Spreadsheet Roulette”
Ray Butler told three stories: the AIB/Allfirst fraud that involved among other things the falsification of a spreadsheet; a school that lost £30,000 from their school funding because of a budget spreadsheet error; a local authority pension fund spreadsheet omitted £4 million from their cash book. He also showed how their tool SPACE would have helped an auditor quickly detect such errors.
Grenville Croll “A typical Spreadshet Audit Approach”
Grenville Croll described an approach used for a model review process. It uses model maps (like the SPACE tool above) to find patterns; code review; range names review; high-level risk analysis and review; documentation; and sensitivity analysis.
“We frequently find … organisations do not even have the most rudimentary internal modelling standards” Barry Pettifor, PwC.
“The presence of a spreadsheet application in an accounting system can subvert all the controls in the all other parts of that system”. Ray Butler, HM Customs and Excise.
EuSpRIG is sponsored by:
See www.sysmod.com/sslinks.htm for a comprehensive set of references and links related to the topics discussed.