This insurance firm with over 8,000 employees and revenue over $25bn identified spreadsheet risk as a key area to improve when aiming to enhance their regulatory compliance processes.
Implementing our ESM and IMS solutions, this insurer took their spreadsheet management to a new level, automating processes and achieving significant efficiency savings over a manual approach.
One element of this insurers response to spreadsheet risk has been to review and enhance its operational risk management, both to reduce the risk and the cost of managing these risks. The company also recognized that enhanced risk management would enable it to free up and utilize resources in more effective ways, providing opportunities to leverage its balance sheet to create more products and services, and ultimately boosts its margins.
Like many of their peers, this business uses spreadsheet extensively throughout its processes, in areas such as pricing, portfolio management, actuarial analysis, asset management, as well as regulatory and management reporting.
Recognizing the importance of carefully managing these business critical spreadsheets, the company had built its own spreadsheet inventory system. It was designed to enforce company policies and ensure these spreadsheets met the company’s quality control standards, and help drive enhanced risk management.
The challenge for the insurer was that adoption and application of its inventory management was inconsistent across the business, relying on self-registration. A broad range of mission-critical spreadsheets held on PCs, shared drives, SharePoint sites in varying forms were unregistered and inappropriately managed.
This reduced the ability of the operational risk teams to scrutinize them effectively and business owners to manage quality and efficiency. Additionally, the process of self-assessment of the risk and significance of a spreadsheet to the business led to a level of subjectivity and inconsistency that meant spreadsheets and in particular high-risk spreadsheets were being managed in sub-optimal ways despite being posted in the inventory.
These issues meant that the efficiency savings and the risk management enhancements originally envisaged for the project were not being achieved. Looking to optimize the management of the inventory and spreadsheet use, the project team reviewed their options in the market, and worked with consultants Armour Risk, to select and implement our Inventory Management (IMS) and Enterprise Spreadsheet Management (ESM) solutions.
The project team recognized the key to meeting their risk management and business efficiency objectives was the ability to capture and review all the mission-critical spreadsheets in the business, whilst minimizing the change impact and ongoing management of spreadsheets to end users. This would enforce company policy, without being overly burdensome on the end-users. Entries from the in house system were migrated to IMS as part of the cut-over process minimizing the need for business teams to manually re-enter data. Instead business teams reviewed the migrated data as part of the annual re-certification process.
The platform’s powerful discovery capabilities provide the business’s teams with the ability to scan the file servers and SharePoint repositories to identify additional spreadsheets that could be candidates to bring under inventory management.
The tools provide a light scan to allow a volumetric impact analysis and a deep scan for a rules-based triage at a spreadsheet level. This allows the teams to efficiently identify key spreadsheets and bring them under effective management.
The most significant spreadsheets are managed using ESM, so that any changes, cell and formula errors, or risks such as formula weakness, can be quickly identified and addressed. The platform provides a comprehensive audit capability, so that internal and external audit, as well as compliance teams can be assured that their risk management policies are being appropriately and consistently applied to its critical spreadsheets. The continuous and centralized audit capabilities reduce the impact on end users in capturing and presenting evidence of spreadsheet management.
Implementing ESM has helped the customer to achieve the business efficiency and risk management benefits it had envisaged.
Automating EUC management provides the customer with a broad range of efficiency savings. The overhead of identifying, monitoring, reviewing and reporting of high risk spreadsheets, has been significantly reduced by streamlining and automating the process. There is less need for the constant checking and re-checking that comes from a manual, piecemeal process. Instead, users can carry out their 4-eye check processes to supplement the automated checks – for example ESM identifies the changes between spreadsheet versions highlighting which of the 17.1 billion cells per worksheet has changed.
Life is also easier for end users, as they only need to check-in their spreadsheet once, confident that all aspects of the EUC policy are consistently applied. It eliminates the need to review spreadsheet edits, every time someone makes change. The automated, transparent and fully auditable management process allows teams to quickly and efficiently demonstrate they have the essential risk management controls in place for the compliance, internal audit and management teams, as well as its regulators.
Enhanced Risk Management
Having a centralized framework for spreadsheet risk management allows this institution to enhance its overall risk management capabilities. It provides a holistic perspective of its spreadsheet risk, allowing it to proactively manage and address any issues that can affect the business, before they affect the business. The standardized approach to assessing spreadsheets, combined with the automated workflow processes align the spreadsheet risk with its operational risk profile.
Implementing enterprise-wide spreadsheet risk management gives the customer a potential business advantage in terms of efficiency gains and reducing the risks associated with spreadsheet use. By improving the quality and consistency of spreadsheets and associated decision making, the business is providing comprehensive visibility and control of these key business processes.