Live Online Training

Spreadsheet Risk

Session overview

When IT risk assessments of ‘business critical’ applications are conducted, there tends to be an understandable focus on the major corporate systems that utilise large-scale enterprise software.

But what about all those little ‘user developed’ applications? These are usually built by ‘ordinary’, non-IT employees (those ‘clever enough to be dangerous’) using common desktop software – in particular Microsoft Excel.

Often these simple, small, and peripheral spreadsheets and databases morph into quite powerful and complex applications that underpin critical business processes and decisions for your organisation.

How exposed is your organisation? What coverage should Internal Audit be providing?

Expected Learning Outcomes

The objective of this presentation is to present both overview and detailed information on this significant area of IT risk:

• An interactive demonstration of spreadsheet auditing in practice.


• Definition of ‘User-Developed’ and how they can be critical to the business – covering Spreadsheets in particular, but also Databases, and other categories of software.


• Risk profile of these applications – why the risks are different and why they are the same as enterprise business applications.


• Discussion on real case studies, and information on available resources.


• Practical overview of Auditing the User developed application control environment:
  - Application governance
  - Application logic
  - Data protection
  - Application Security (physical and logical)
  - Application dependencies (with the enterprise architecture)
  - Systems Development Lifecycle