Getting started with Spreadsheet Risk Control

Moraph resells, implements and runs Apparity to bring your critical end-user computing tools (EUCs), mostly Excel models and workbooks, under control. Apparity keeps the inventory, versions, changes, approvals and checks for each registered file; Moraph configures it to your EUC policy, runs discovery and onboarding, and keeps the program moving with alert triage, attestation cycles and service reporting. Your owners and reviewers decide what is critical and approve the changes.

What it is for

Regulatory returns, reserves, valuations, capital figures and financial statements still pass through spreadsheets that sit on shared drives. Many institutions have an EUC policy but no reliable inventory, and controls amount to file naming conventions and an annual questionnaire. A formula overwritten with a typed number, a link to last quarter's file, or an unreviewed change to a model can flow straight into a filing. When auditors or examiners ask which spreadsheets matter and how changes to them are controlled, the answer is assembled by hand.

• No complete inventory of the spreadsheets that feed regulatory, financial and risk reporting
• Changes to critical workbooks are made without review or a record of what changed
• Formula errors, hard-coded overrides and broken links are found late, if at all
• Evidence for SOX, model risk and audit testing is gathered by hand each cycle

Who uses it

• Finance, treasury and regulatory reporting teams whose numbers pass through spreadsheets
• Operational risk and EUC program owners who own the EUC policy
• Model risk management teams whose inventory includes spreadsheet models
• SOX and internal control teams who test controls over financial reporting
• Internal and external auditors and examiners

Before you start

• Your organization uses Spreadsheet Risk Control as a managed platform from Moraph, under an agreement that covers it.
• Licences for Apparity, bought through Moraph or under your own agreement with the vendor.
• A Moraph account in your organization for each person who works with Moraph on the service.
• Named technical and security contacts, recorded in the Moraph Portal.

Steps to get started

1. Agree the scope of the managed service for Spreadsheet Risk Control with Moraph, including which environments and teams it covers.

2. Name your administrators, technical contact and security contact in the Moraph Portal under People and access.

3. Review the configuration baseline Moraph proposes for your regulations, and record any changes you need.

4. Confirm how users will sign in, through your identity provider where the platform supports it.

5. Agree the pilot group and the cut-over plan with your Moraph delivery lead.

Where to go next

• Onboard Spreadsheet Risk Control
• Everyday tasks
• Connect your systems
• Security, data and compliance
• Troubleshooting and the support guide
• Product overview on moraph.com