On 26 September 2005, Compassoft, the U.S.-based provider of discovery and change management products to control user-developed applications, announced that it has acquired Spreadsheet Auditing, the United Kingdom-based developer of the EXChecker spreadsheet validation product.

The spreadsheet remains one of the least-understood and least-controlled elements of corporate reporting risk. Nearly all financial statements and tax returns require the extensive use of spreadsheets (of which Microsoft Excel is by far the most widely used) for both data entry and manipulation. Nonetheless — even though governance regulations such as the U.S. Sarbanes-Oxley Act have resulted in higher levels of visibility and control for enterprise applications — spreadsheets remain a source of both inadvertent error and deliberate manipulation.

Concern about this issue — especially from auditors — is helping to drive the small but healthy market for "spreadsheet auditing" products such as EXChecker. Most large enterprises already make some use of such products, but comparatively few have methodically implemented across-the-board spreadsheet quality control. One important reason is that this market is typically addressed by two entirely different types of products: quality control products (such as Spreadsheet Professional, SpACE and Spreadsheet Detective) and governance products (such as Cluster Seven's products and Prodiance's Remediation Services for Microsoft Excel).

Compassoft is one of a growing number of companies that provide governance controls over the actual use of spreadsheets, with primary emphasis on tracking and logging changes to spreadsheets. The company is unique in that it also addresses user-developed applications that use Crystal Reports, Microsoft Access and Oracle. Enterprises that do not explicitly manage user-developed applications will inevitably run unnecessarily high levels of risk. The acquisition of the EXChecker product makes Compassoft the first provider that can address both key elements of spreadsheet management — quality control and governance — with offerings that address the quality of spreadsheets and their control after deployment. If enterprises do not simultaneously address both of these issues, spreadsheets will always be a source of losses.

This acquisition is a signal of new seriousness in a fragmented and still-immature market. The availability of useful tools from increasingly credible companies will encourage auditors to be more aggressive in demanding that regulated firms do a better job of finding, documenting and controlling their spreadsheets.

Recommendations

• Locate and document all spreadsheets that are financially material or relevant to regulatory compliance.
• Implement mechanisms to ensure that all spreadsheets are used accurately and appropriately.

Analytical Source: Jay Heiser, Gartner Research

Recommended Reading and Related Research

• "The SEC Fine-Tunes Operation of the Sarbanes-Oxley Act" — Businesses may be given more time to file quarterly reports, but they will be expected to improve the quality of the reports. By John Bace
• "The 2005 Planning Guidance for Compliance" — IT organizations are beginning to assume a more prominent role in compliance management. By French Caldwell and others

(You may need to sign in or be a Gartner client to access the documents referenced in this First Take.)