One of the best ever examples of ambivalence is a prohibition-era politician’s response to the question, "What is your stand on whiskey?" He replied:

If by whiskey you mean the water of life that cheers men’s souls, that smoothes out the tensions of the day, that gives gentle perspective to one’s view of life, then I am for it. But if by whiskey you mean the devil’s brew that rends families, destroys careers and ruins one’s ability to work, then I am against it.

There’s nothing like coming down squarely on both side of an issue.

We were reminded of this story when we set out to put a similar question to IT heads of investment firms – "What is your stand on spreadsheets?" We thought we might hear answers something like this:

If by spreadsheets you mean that powerful tool that affords end users unlimited analytical capability, that increases the firm’s ability to respond quickly in changing markets, that makes decision-making more rapid and less risky, then I am for it. But if by spreadsheets you mean that insidious tool that skirts controls, that opens the door to dangerous shortcuts and errors, that exposes the entire firm to unacceptable operational risk, then I am against it.

Unlike politicians, however, IT heads in investment firms have to make a decision; they cannot come down squarely on both sides of the issue. The consensus among IT heads is that spreadsheets should be accepted as a central fact of investment management, with controls in place to mitigate risk. As you would expect, even though their goal is the same, different firms approach this issue in different ways.

Some firms have completely banned spreadsheets for any analytic, production, or operational task. While users might jump-start a new process by using spreadsheets, IT will almost immediately code a custom application that provides the same functionality as the spreadsheet, but with more control. These firms still allow the use of spreadsheets for ancillary functions, such as customized client reporting.

Many firms have categorized their spreadsheets into risk categories. Most of these use a simple, high-medium-low risk rating with policies similar to the following:

• High risk applications, such as production systems or transaction generators – Rewrite as an application
• Medium risk applications, such as decision support – Leave as-is, but with some basic controls which are typically administered by the business unit, not by IT
• Low risk applications, such as reporting – Do not intervene

One firm we interviewed had a contrarian view. This firm embraces end-user computing, including the use of spreadsheets. This firm is expecting major upheavals in their organization, their products, the markets in which they invest, etc. They believe that harnessing the power of end-user computing is the only way they have a chance of their systems keeping up with the business. This firm has created new policies to support end-user computing, hired staff to assist end users, defined audit requirements for end-user computing, and created quality control procedures for spreadsheets (including testing and versioning). According to our source, the business users are very open to this plan, and the greatest challenge is in convincing various auditors that end-user computing can be properly managed.

Few firms would be willing to make this significant a commitment to end-user computing at this time. However, there are technologies emerging that, by bringing more controls to spreadsheets, might make this type of end-user computing commitment more common. For example:

• SavvySoft’s TurboExcel converts the calculations on a spreadsheet into a compiled C++ function in a DLL, also available as an Excel add-in. This means the calculation is available in any language that can use standard Windows DLLs (essentially everything), and the calculation can be standardized and reused.
• Actuate’s Spreadsheet Application Platform provides a spreadsheet environment "to build customized enterprise-level applications that utilize familiar spreadsheet interfaces and give IT better management control," according to the company.

We have also heard that Microsoft is working on an enterprise version of Excel, but we have not heard any details.

The important news, however, is not the specific technology, but that our industry’s problems with spreadsheets are shared by all other industries and that many software firms are working to address these problems. In the near future, expect highly-functional spreadsheets to be available that automate the controls and requirements that members are now enforcing manually for their spreadsheets, thereby changing "enterprise spreadsheet" from the oxymoron it is now to a powerful tool. Since the use of spreadsheets has become accepted practice at most investment firms – in fact, it sometimes seems that you cannot be a portfolio manager without also been a spreadsheet wiz – the advent of these new technologies is very welcome news.

In the meantime, if you do not yet have a set of formal processes and procedures governing the use of spreadsheets, you need to develop a set. Not only is this required for good management of operational risk, but many believe that this is essentially mandated in the U.S. by Sarbanes-Oxley. In developing your policies and procedures, we recommend the high-medium-low risk approach outlined above.