5000 Crossmill Road McLeansville, NC 27301 +1 (336) 375-2991 litera.com answers@litera.

com

Implementing strong controls for Excel Spreadsheets Using ChangePro

By Bob Broda Managing Partner, Visage Solutions

Date: December 2011

Introduction

Contents
Introduction ......................................... 2 Problem Statement ............................. 2 Previous Options .............................. 33

1. Version Control ..................... 33 2. Backup .................................. 33 3. Validation .............................. 43 4. Change Management ............ 44
ChangePro for Excel Solution ...... 54

Most companies use spreadsheets as an integral component of their financial reporting process. This means that Auditors and Accountants have the responsibility to ascertain the accuracy and validity of these spreadsheets.

Problem Statement
Spreadsheets can be problematic in the finance and auditing communities because, for the most part, they are viewed as an application. Often the Worksheet designer, programmer, tester and end user are same person, Excel provides no real audit trail in the spreadsheet and version control is a process manually controlled by the person responsible for creating and modifying the spreadsheet. Spreadsheets can be problematic in the finance and auditing communities because, for the most part, they are viewed as an application. Often the Worksheet designer, programmer, tester and end user are same person, Excel provides no real audit trail in the spreadsheet and version control is a process manually controlled by the person responsible for creating and modifying the spreadsheet. In 2006, the AICPA released guidance on how dealing with spreadsheets in a financial regulatory environment. This guidance is not for all spreadsheets, but only those identified as key spreadsheets and being used to: Calculate significant account balances, or Serve a role in the financial statement closing process, or Interface between critical financial IT systems or databases.

Benefit 1 .................................... 64 Benefit 2 .................................... 65 Benefit 3 .................................... 65

Implementation ................................. 65 Summary ........................................... 65 About Litra....................................... 65

Date: December 2011

Page 2

Previous Options
The company must identify, document, test, and control selected key spreadsheets. Spreadsheets used in financial applications require the same SOX general controls as an IT financial systems application. Most spreadsheets will not qualify as key. To decide if it is a key spreadsheet, you should create an inventory of all spreadsheets within the organization that are used to support significant financial processes. It is important to identify how the spreadsheets support all significant accounts and financial statement disclosures and their relationship to relevant financial statement assertions. All departments utilizing spreadsheets should be evaluated, including, but not limited to, financial reporting, accounting, tax, and operations.

Most auditors would rather do away with the use of spreadsheets altogether.

The inventory should include: Name of the spreadsheet Brief description of the spreadsheet and the financial amounts calculated Department responsible for the development as well as any other departments that utilize the spreadsheet Frequency and extent of changes to the spreadsheet Key spreadsheet indicator Spreadsheets that qualify as key must be managed and controlled following the same IT General Controls process as any other financial systems application. The controls and protection include the following:

1. Version Control
Because of the ease with which an average user can edit or revise formulas, data and values in a spreadsheet, each version of a key spreadsheet should be controlled as though it were a separate application. Master versions of each key spreadsheet should be identified as such.

2. Backup
An exact copy of each master key spreadsheet should be saved to protect against loss. Typically these spreadsheets should be saved on a network drive within your business unit to ensure others can access the files. Backing up each spreadsheet includes saving all formulas, formats, data, and linkages intact in the spreadsheets. An auditor or other third party must be able to load the spreadsheet and independently review all processes and calculations that the spreadsheet performs.
Date: December 2011 Page 3

All transaction spreadsheets should be archived with meaningful names to facilitate identification for up to seven years.

3. Validation
Validation is required every time a critical computation or formula is changed in the spreadsheet. This validation does not require that all aspects of a spreadsheet be re-validated or tested. However, any changed functionality should be validated for accuracy when the change is made. Every two years all functionality of the spreadsheet must be validated. The real problem is identifying when a change to the formulas occurred. Periodically, the calculations and operations that are performed by key spreadsheets must be validated even when there have been no changes made to the spreadsheet. Guidance from the AICPA and PCAOB suggests that such validation must occur at least every two years assuming that formulas, computations, and operations performed by the spreadsheets have not changed during the two year period.

Change-Pro for Excel eliminates the cost, confusion and error-prone nature of manual comparisons.

4. Change Management
Change management aims to prove that alterations to formulas, data and other functions are made only with appropriate management authorization and provide an audit trail of the changes made in such a way that auditors can track and validate them. All changes and revisions to key spreadsheets should be logged by the person making the change and periodically reviewed by management. Change management logs may be configured within the key spreadsheets themselves or maintained as a separate log which must be archived with the key spreadsheet. All changes to the spreadsheet should be tracked. Change management logs should include: Date of change Name of person making the change Brief description of the change made Name of person approving the change, and a Brief recap of the validation test to assure change is appropriate and correct At least annually, all changes to each key spreadsheet should be reviewed by a separate member of management.

Page |4

Taking into account all the above considerations, maintaining compliance can be a painstaking manual process which requires a tremendous amount of management oversight by individuals who are usually very busy at month, quarter or year end when changes are identified. Manual review processes are extremely expensive and do ensure 100% percent accuracy. For this reason Auditors are recommending people refrain from using these key spreadsheets although their use continues to be pervasive.

ChangePro for Excel Solution

Litra has created software technology that provides the controls necessary to satisfy even the most stringent audit processes. These can be implemented to your current approval or review workflows immediately for even the most complex spreadsheets. Litras ChangePro for Excel provides three capabilities which enable these controls inside your current approval and/or review workflows: 1. Redlined changes for formulas 2. Ability to identify changes only to formulas 3. An Audit report that identifies all changes between versions as well as logging all versions that have been compared.

Page |5

Benefit 1
Litras ChangePro for Excel provides the controls and the confidence to know the differences between versions of key spreadsheets.

Benefit 2
Change-Pro for Excel eliminates the cost, confusion and errorprone nature of manual comparisons

Benefit 3
More important, ChangePro for Excel removes the need for costly transformations of Excel spreadsheets into actual programs maintained by IT that would fit into the normal program control environment.

Implementation
ChangePro for Excel is available via a desktop or SaaS (cloud). The download is simple and seamlessly integrates with Microsoft Excel

Summary

Change-Pro allows you to strengthen your controls over spreadsheets in less than a minute.

ChangePro for Excel allows you to build strong controls using Excel by quickly identifying the formula changes between different versions of spreadsheets. This greatly reduces the time and effort in having confidence in your version control of key spreadsheets.

About Litra
Litra enhances professional productivity and risk reduction through a comprehensive suite of document creation, collaboration, comparison, control and cleansing solutions. Litra's patented applications eliminate the need for tedious, error prone manual reviews and give you true content confidence across complex spreadsheets, documents, PowerPoint and PDFs. For more information, visit www.Litera.com/answers

About VisageSolutions Visage Solutions is a consulting company operating in the areas of regulatory compliance, risk assessment, information security, risk management and compliance processes. Visage has provided solutions to a client base ranging from private, entrepreneurial companies to large multinationals. For more information, visit www.visagesolutions.com.

Page |6