Quantifying risk in Excel

spreadsheet changes

DiffXL

By their very nature,

spreadsheets change

Change matters

But who cares about

spreadsheet change?

Spreadsheet owners
& risk managers

Internal & external

auditors

Mike Oxley

Paul Sarbanes

How do companies
deal with spreadsheet
change?

In a perfect world

Every spreadsheet would be audited

and all risks would be mitigated

What do real-world managers say about

spreadsheet changes?

What do real-world managers say about

spreadsheet changes?

What happens when we talk to real-world

auditors about spreadsheet auditing?

What happens when we talk to real-world

auditors about spreadsheet auditing?

Realistically,
wed probably
expect some small
unexplained
variations in the
final results

The result?

Everythings fine, boss

 yes, just fine

Is this how you see a spreadsheet?

This is how DiffXL sees a spreadsheet

Formula maps

A visual representation of a spreadsheet

Standard
spreadsheet
view
Formula view

(R1C1 style, available in Excel)

Formula map view

(as processed by a formula map tool)

Base
CORONA
CORONA
CORONA
CORONA
CORONA

X
- GLASS
7.031065
- GLASS
61.91627
- GLASS
126.6281
- GLASS
0.856899
- GLASS
14.93735

Y
4.502179
17.35029
96.10542
0.316199
7.117257

Gamma
0.01311
0.308808
4.662414
0.032906
0.428304

Delta
0.059024
5.357904
448.0832
0.010405
3.048348

Examples of changes
to the shape & colour
of a formula map

Original view

(Formula map version)

Original view

(Formula map version)

Original view

(Formula map version)

Column added
with new text
and formula

Original view

(Formula map version)

Original view

(Formula map version)

Region
extended, one
text cell and
one new
formula added
at the bottom

Some changes
offer little
genuine risk

Original view

(Formula map version)

Original view

(Formula map version)

Entire region
moved and
text entered in
cell B2

Others give cause

for concern

Original view

(Formula map version)

Original view

(Formula map version)

Text
overwrites
formula in C5,
new formula in
cell E5

DiffXL also stores some other basic data

about the structure. Altogether this means
it can ascertain data and formula ranges
that have been

Changed, Combined,
Created, Deleted, Extended,
Moved, Overwritten, Shrunk,
Sorted or Split

DiffXL

DiffXL
Considers a spreadsheet as a set
of contiguous coloured rectangles

DiffXL
Considers a spreadsheet as a set
of contiguous coloured rectangles
Looks at how the shapes &
colours change

DiffXL
Considers a spreadsheet as a set
of contiguous coloured rectangles
Looks at how the shapes &
colours change
And assigns the spreadsheet an
appropriate change-risk metric

Why measure risk

and not just change?

Because when we
understand the true

Risk
we can assign the
most appropriate

Effort

to minimize
the overall

Cost

... and so concentrate on the

things that really matter

DiffXL analysis can be run .

DiffXL analysis can be run .

Automatically during a file save or
publish (SharePoint)

DiffXL analysis can be run .

Automatically during a file save or
publish (SharePoint)
As part of a monthly, quarterly or
yearly checking process (Excel or
SharePoint)

DiffXL analysis can be run .

Automatically during a file save or
publish (SharePoint)
As part of a monthly, quarterly or
yearly checking process (Excel or
SharePoint)

Manually in Excel by a user,

manager or auditor

How can DiffXL help

auditors?

It can be run quickly and simply

against every important spreadsheet

It identifies
spreadsheets where
the underlying data
has changed

It highlights spreadsheets whose

calculation methods have been modified

It can spot spreadsheets that

are fundamentally the same

How can DiffXL help

departmental & risk
managers?

It can identify spreadsheets that

have been changed accidentally

It can isolate spreadsheets that

require re-documenting or re-testing

It can recognize a spreadsheet

in need of attention

... and it can be

used to locate
issues pro-actively,
allowing managers
to resolve problems
at a convenient
time before audit.

Plus, theres a little benefit

on the side

Happy users!

Happy users!

Why so?

They can demonstrate

that their changes are
of little risk

Restrictive or time
consuming change
procedures can be
targeted towards
high risk changes

They can identify any high-risk

changes themselves

and mitigate them if required

So where does that

leave companies using
a DiffXL approach to
spreadsheet change?

Informed managers

DiffXL

Informed managers
Satisfied auditors

DiffXL

Informed managers
Satisfied auditors
Happy users

DiffXL

Beautiful

Excel & SharePoint are registered trademarks of Microsoft Corporation.

DiffXL is a registered trademark of ExcelforManagers.com.
Copyright 2009 Excel For Managers. All rights reserved.