Security, data and compliance in Spreadsheet Risk Control

How Spreadsheet Risk Control protects data and supports your compliance obligations.

Security controls

Single sign-on

Your staff and Moraph's engineers sign in through identity providers with multi-factor authentication, so your access policies apply.

Role-based access

Owners and reviewers see their own files; administering the platform is separate from approving changes.

No routine access to content

Moraph staff cannot open file content without your explicit, time-bound authorization, and keys are handled on the same basis.

Complete audit trail

Registrations, changes, approvals, alert outcomes and attestations are logged with the person and time.

Data residency

File content and versions stay in the environment and region agreed for your deployment; Moraph-hosted components run in the United States, United Kingdom or Australia.

Controlled changes

Configuration changes and Apparity updates are tested before they are applied, and Moraph-built connectors pass its security testing gates and carry a software bill of materials.

Requirements it supports

• Sarbanes-Oxley Act Section 404 (internal control over financial reporting)
• PCAOB Auditing Standard AS 2201 (audit of internal control over financial reporting)
• Interagency Guidance on Model Risk Management (SR 11-7 / OCC Bulletin 2011-12)
• BCBS 239 (Principles for effective risk data aggregation and risk reporting)
• PRA Supervisory Statement SS1/23 (model risk management principles for banks)
• FDIC Part 363 (annual independent audits and reporting requirements)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Apparity cloud, run by Moraph: Apparity's hosted service, licensed through Moraph and configured and operated by Moraph's team.
• In your environment: Apparity installed in your data center or cloud account, close to your file shares, with Moraph operating it under agreed remote access.
• Co-managed: Your operational risk team keeps some program work, such as attestation cycles, and Moraph runs the platform, discovery and alert triage.

Limitations

• Moraph is not the vendor. Apparity owns the platform, and Apparity's own service commitments, roadmap and outages apply.
• Licences are subject to Apparity's terms, which you accept as part of the agreement.
• Discovery finds files only in the locations you approve. Spreadsheets on local drives, personal storage or email are not found unless those locations are included.
• Checks flag risk indicators; they do not prove a spreadsheet is correct. Owners and reviewers remain responsible for the logic and results.
• Moraph does not validate models. Model validation follows your model risk process, though version history and change records support it.
• Deciding which files are critical, and approving ratings and exceptions, is your organization's decision.
• Controls apply to registered files. Copies made outside Apparity's control are not tracked.
• Moraph does not rebuild or redesign your spreadsheets as part of the managed service; that can be scoped separately.