Stopping Spreadsheet Fraud

Last fall, Microsoft Excel celebrated its 30th anniversary – a miraculous feat considering the industry has endured rumor after rumor of its pending demise for the past 10 plus years. While many financial applications have been launched touting their ability to “rid companies of error-prone spreadsheets,” it seems we are no closer to finding a better alternative.

Excel spreadsheets have stood the test of time because they continue to meet the analytical needs of companies today, especially for analyzing and reporting financial results and providing evidentiary support for decision-making. There is no waiting for IT to make changes to systems.  There are no workarounds necessary and no compromises. For complex calculations that require the use of cell functions and where data is continually changing, Excel is often the go-to tool to get the job done. Spreadsheets are used for budgeting, forecasting, financial reporting, determining tax computations, operational analysis and much more. Unfortunately, spreadsheets are also one of the easiest places to commit fraud.

Hidden Data Dangers

Countless news stories have appeared over the years revealing how easy it is to manipulate spreadsheets. With just a few tweaks, spreadsheet data can be deliberately hidden or cleverly disguised, making it is easy for unscrupulous employees to manipulate spreadsheets for personal gain. On a larger scale, spreadsheet fraud also can make a company appear to be worth more much more than it is.

Without internal spreadsheet controls in place, changes easily can be made and data hidden without anyone being the wiser. For example, when formatting and organizing spreadsheets, it is common practice to insert a blank column for the purpose of creating a gap between results. A row or column can be shrunk to five pixels, making it easy to overlook. The problem is, no matter how small the “blank” cell may appear, it is a real cell. Therefore, if a value is inadvertently or intentionally hidden within this cell, it will still be included in the calculations.

Another common way to hide data is by merging cells. Cells are typically merged to make a spreadsheet easier to read and to eliminate clutter. A user may also merge cells to hide irrelevant or sensitive data. While the ability to merge cells was intended to help users, it quickly can become a way to hide data from unsuspecting eyes. One of the most high-profile examples of the dangers associated with merged cells is the Lehman Brothers Holdings/Barclays Capital case, the largest bankruptcy case in U.S. history. Contracts that had been marked as “hidden” in the spreadsheet when received by the law firm were added to the purchase offer during the reformatting process, according to the motion. Those contracts weren’t supposed to be part of the deal. While this instance was a case of human error, it clearly demonstrates the risks associated with hidden cells (and how easy it is to hide data).

Another very basic, yet effective way to hide data is by manipulating font color. Data can be hidden in plain sight simply by changing the font color to the same color as the background of the cells. A more complex way to hide data is misrepresenting something that appears to be a number when it is actually formatted as text. When something is formatted as text, a formula will not look at it; therefore, it will be omitted from the calculation.

Fortunately, advances in technology are making it harder to hide data, thus significantly reducing risk and exposure for organizations.

The Benefits of Technology

Spreadsheets alone are not perfect. As discussed, by themselves they provide little to no protection against data corruption and no way to validate numbers or check errors, nor do they offer the transparency businesses require today. Simply double-checking numbers will not cut it, especially when there are so many ways to hide or misrepresent data. However, when combined with spreadsheet management technology, errors and fraudulent activities can be significantly reduced, and, in many instances, completely eliminated. Unfortunately, most organizations do not utilize spreadsheet management solutions merely because they are unaware this technology exists.

Taking a methodical approach to understanding where risks may hide is the first step in managing spreadsheets across an organization. Spreadsheet management solutions offer detailed insight into spreadsheets, regardless of where they reside on a network or how many exist. These solutions provide visibility into who is working on a file, how many people are working on it, when something changes, what changed and who made those changes. The ability to monitor and track this information over a period of time provides valuable insight into whether policies are being followed while making it significantly easier for accountants to identify potential risks.

For even greater transparency and risk management, many spreadsheet management solutions will allow threshold alerts to be set if certain changes occur to key numbers such as commission percentages or diluted shares. These red flag-type alerts can be customized to meet particular criteria and can be as basic or detailed as necessary. Thresholds also can be set to alert accountants to disparate currency and tax changes; this information is especially useful when dealing with global mergers and acquisitions. Threshold alerts serve as automated checks and balances to ensure inaccuracies are not missed.

Spreadsheet management technology that offers automated detection capabilities makes it easy to locate hidden and misrepresented data within spreadsheets so that fraudulent activity is not overlooked. The ability to identify rows and columns that are significantly reduced in size and merged cell activity will ensure nothing is missed.

It’s time organizations stop putting themselves at risk by using Excel in a silo. Automated risk and analysis solutions provide the necessary control and insight into potential risk and errors that may be hiding in spreadsheets. With the right technology in place, fraudulent behavior can be stopped before it damages your company and your reputation.