SPREADSHEET AUDIT WORK

PROGRAM

1 Source: www.knowledgeleader.com
 Table of Contents
SPREADSHEET AUDIT WORK PROGRAM: SAMPLE 1........................................................................................3
SPREADSHEET AUDIT WORK PROGRAM: SAMPLE 2......................................................................................15

2 Source: www.knowledgeleader.com
 SPREADSHEET AUDIT WORK PROGRAM: SAMPLE 1

Test Focus Work Program Step Review Method Evaluation Criteria

Workbook Is the recalculation setting "Automatic," "Automatic Review Excel: • “Pass” is

Calculation Except Tables" or "Manual?” Workbook Tools determined if the
-> Options -> setting is
Rationale: By default, Excel is set to recalculate
Calculation “Automatic” or if
formulas as cell contents change automatically. If
Settings there are
the recalculation setting is not set to "Automatic,"
practices in place
Excel will not automatically recalculate cell contents
that ensure that
when changes are made.
manual and table
recalculations are
performed during
normal use of the
end-user
computer (EUC)
user.
• “Marked for
Review” is
determined if the
setting is not
automatic and if
there are no
appropriate
procedures to
ensure that
manual and table
recalculations are
performed during
normal use of the
EUC.

Workbook Is the "Precision as Displayed" parameter checked Review Excel: • “Pass” is

Calculation or is the "1904" date system selected? Workbook Tools determined if the
-> Options -> "Precision as
Rationale: If the "Precision as Displayed"
Calculation Displayed"
parameter is checked, Excel will use the displayed
Settings calculation option
cell contents as part of calculations and when a
is not checked
workbook is saved. If this parameter is checked,
and the "1904"
any data with additional levels of precision will
data system is not
permanently lose accuracy. If the "1904" data
selected.
system is selected and date data is used across
multiple workbooks with different data system • “Marked for
settings, miscalculations can occur. Review” is
determined if the
"Precision as
Displayed"
calculation option
has been checked
(this would mean
any precision in
the original Excel
document would
be lost when it is

3 Source: www.knowledgeleader.com
 Test Focus Work Program Step Review Method Evaluation Criteria

saved) or if the
"1904" date
system was
selected (this
could cause
issues if date
information is
used in other
workbooks with
the "1900" data
system).

Workbook Are iterations used within calculations and are the Review Excel: • “Pass” determines
Calculation correct iteration settings configured? Workbook Tools if the iteration
-> Options -> calculation
Rationale: If the "Iterations" option has been set
Calculation method is not
within the calculation options, this is an indicator
Settings used or has been
that circular cell references are in use. The number
configured to
of calculation iterations that are performed should If the "Iterations"
appropriate
be set to an appropriate level to ensure the correct check box is
settings.
precision of the calculation. checked,
uncheck it, and • “Marked for
if a "Circular Review” is
Reference" determined if the
warning is iteration
displayed in calculation
Excel, use the method is being
circular used incorrectly or
reference inappropriately.
toolbar to
identify the
circular
reference cells.
Also, validate if
"Maximum
Iterations" is
correct.

VBA/Macros Do error handlers exist in visual basic for Inspect the • “Pass” is
applications (VBA) code that hides an error in the workbook object determined if error
execution of the VBA from the EUC user? VBA code. handlers are not
used or are used
Rationale: Error handlers are used in VBAs,
so that the EUC
including macros, to manage the error message
user is notified of
and code execution in the event of an error.
an error in the
Suppose the error is not displayed to the user
execution of the
(hidden). In that case, there is a risk that the user
VBA code.
assumes the calculation has been completed fully
and successfully with no knowledge that code • “Marked for
execution was interrupted. Review” is
determined if error
handlers are used
to hide error
messages from
EUC users.
• “NA” is
determined if

4 Source: www.knowledgeleader.com
 Test Focus Work Program Step Review Method Evaluation Criteria

there is no VBA
code in the
workbook.

VBA/Macros VBA code makes references to hard-coded cell Inspect the • “Pass” is
addresses (should instead refer to named ranges). workbook object determined if a
VBA code. brief inspection of
Rationale: VBA can be used to obtain cell contents
the VBA code
from individual worksheets. If cell references are
determines that
hard-coded (e.g., A1:A3) and the structure of the
hard-coded cell
worksheet changes, the VBA will refer to the wrong
addresses have
cell. Using named ranges reduces the likelihood of
not been used
error through changes to the worksheet structure.
within the module
code.
• “Marked for
Review” is
determined if a
brief inspection of
the VBA code
determines that
hard-coded cell
addresses are
used frequently
within the module
code.
• “NA” is
determined if
there is no VBA
code in the
workbook.

VBA/Macros Does a VBA code exist that makes updates to cells Inspect the • “Pass” is
(data or formula) that are not transparent to EUC workbook object determined if a
users? VBA code. brief inspection of
the VBA code
Rationale: VBA code can be used to directly
determines that
update cell contents or if formula updates are not
updates to cells
transparent/displayed, there is a risk that changes
(data or formula)
are not identified and understood by users.
are appropriate
and if the EUC
user is notified.
• “Marked for
Review” is
determined if a
brief inspection of
the VBA code
determines that
updates to cells
(data or formula)
are being made
that are not
transparent to the
EUC user.
• “NA” is

5 Source: www.knowledgeleader.com
 Test Focus Work Program Step Review Method Evaluation Criteria

determined if
there is no VBA
code in the
workbook.

PHASE 2: INDIVIDUAL WORKSHEET REVIEW QUESTIONS

Test Focus Work Program Step Review Method Evaluation Criteria

Worksheet Info Is the worksheet a "very hidden" worksheet? Inspect the • “Pass” is
“Visible Status” determined if the
Rationale: “Very hidden” worksheets are hidden
section in the worksheet is not
by VBA code and can be used to assist in the
spreadsheet'. "very hidden."
perpetration of fraud.
• “Marked for
Review” is
determined if the
worksheet is
"very hidden" and
does not have
appropriate
supporting
rationale from the
EUC owner.

Design Have cells containing calculations, fixed Inspect the • “Pass” is

standing data and outputs been appropriately spreadsheet. determined if
locked to prevent accidental or deliberate inspection of the
Review the
overtyping, and is worksheet protection worksheet
unlocked cell
activated? indicates that
analysis
appropriate cells
Rationale: Overtyping of such cells leads to incisively.
have been locked
errors, and cell locking is ineffective without
and worksheet
worksheet protection being activated.
protection has
been activated.
• “Marked for
Review” is
determined if
inspection of the
worksheet
indicates that
appropriate cells
have not been
locked or if
worksheet
protection has not
been activated.

Formula and No. 1: Formula Fails to Cover the Area Review the • “Pass” is
Cell Analysis formula/cell determined if no
analysis report inconsistencies
incisively. are identified or if
any potential
inconsistency has

6 Source: www.knowledgeleader.com
 Test Focus Work Program Step Review Method Evaluation Criteria

been proven to
have no effect on
the output or
future output of
the EUC.
• “Marked for
Review” is
determined if
inconsistencies
are identified that
indicate poor
design practice or
require follow-up
with the EUC
owner to
determine if
actual errors are
present.

No. 2: “Number” Error Formulas Review the • “Pass” is

formula/cell determined if no
analysis report inconsistencies
incisively. are identified or if
any potential
inconsistency has
been proven to
have no effect on
the output or
future output of
the EUC.
• “Marked for
Review” is
determined if
inconsistencies
are identified that
indicate poor
design practice or
require follow-up
with the EUC
owner to
determine if
actual errors are
present.

No. 3: Inconsistent Formulas Review the • “Pass” is

formula/cell determined if no
analysis report inconsistencies
incisively. are identified or if
any potential
inconsistency has
been proven to
have no effect on
the output or
future output of
the EUC.

7 Source: www.knowledgeleader.com
 Test Focus Work Program Step Review Method Evaluation Criteria

• “Marked for
Review” is
determined if
inconsistencies
are identified that
indicate poor
design practice or
require follow-up
with the EUC
owner to
determine if
actual errors are
present.

No. 4: Data in Formula Range Review the • “Pass” is

formula/cell determined if no
analysis report inconsistencies
incisively. are identified or if
any potential
inconsistency has
been proven to
have no effect on
the output or
future output of
the EUC.
• “Marked for
Review” is
determined if
inconsistencies
that indicate poor
design practice
are identified or
require follow-up
with the EUC
owner to
determine if
actual errors are
present.

No. 5: Formula in Data Range Review the • “Pass” is

formula/cell determined if no
analysis report inconsistencies
incisively. are identified or if
any potential
inconsistency has
been proven to
have no effect on
the output or
future output of
the EUC.
• “Marked for
Review” is
determined if
inconsistencies
are identified that

8 Source: www.knowledgeleader.com
 Test Focus Work Program Step Review Method Evaluation Criteria

indicate poor
design practice or
require follow-up
with the EUC
owner to
determine if
actual errors are
present.

No. 6: Referencing Blank Cells Review the • “Pass” is

formula/cell determined if no
analysis report inconsistencies
incisively. are identified or if
any potential
inconsistency has
been proven to
have no effect on
the output or
future output of
the EUC.
• “Marked for
Review” is
determined if
inconsistencies
are identified that
indicate poor
design practice or
require follow-up
with the EUC
owner to
determine if
actual errors are
present.

No. 7: Constant in Formula Review the • “Pass” is

formula/cell determined if no
analysis report inconsistencies
incisively. are identified or if
any potential
inconsistency has
been proven to
have no effect on
the output or
future output of
the EUC.
• “Marked for
Review” is
determined if
inconsistencies
are identified that
indicate poor
design practice or
require follow-up
with the EUC
owner to

9 Source: www.knowledgeleader.com
 Test Focus Work Program Step Review Method Evaluation Criteria

determine if
actual errors are
present.

No. 8: Formula References No Other Cell Review the • “Pass” is

formula/cell determined if no
analysis report inconsistencies
incisively. are identified or if
any potential
inconsistency has
been proven to
have no effect on
the output or
future output of
the EUC.
• “Marked for
Review” is
determined if
inconsistencies
are identified that
indicate poor
design practice or
require follow-up
with the EUC
owner to
determine if
actual errors are
present.

No. 9: Unlocked Cells Review the • “Pass” is

formula/cell determined if no
analysis report inconsistencies
incisively. are identified or if
any potential
inconsistency has
been proven to
have no effect on
the output or
future output of
the EUC.
• “Marked for
Review” is
determined if
inconsistencies
are identified that
indicate poor
design practice or
require follow-up
with the EUC
owner to
determine if
actual errors are
present.

No. 10: Sheet Is Hidden Review the • “Pass” is

10 Source: www.knowledgeleader.com
 Test Focus Work Program Step Review Method Evaluation Criteria

formula/cell determined if no
analysis report inconsistencies
incisively. are identified or if
any potential
inconsistency has
been proven to
have no effect on
the output or
future output of
the EUC.
• “Marked for
Review” is
determined if
inconsistencies
are identified that
indicate poor
design practice or
require follow-up
with the EUC
owner to
determine if
actual errors are
present.

No. 11: Same Foreground and Background Review the • “Pass” is

formula/cell determined if no
analysis report inconsistencies
incisively. are identified or if
any potential
inconsistency has
been proven to
have no effect on
the output or
future output of
the EUC.
• “Marked for
Review” is
determined if
inconsistencies
are identified that
indicate poor
design practice or
require follow-up
with the EUC
owner to
determine if
actual errors are
present.

No. 12: Hidden Row/Column Review the • “Pass” is

formula/cell determined if no
analysis report inconsistencies
incisively. are identified or if
any potential
inconsistency has

11 Source: www.knowledgeleader.com
 Test Focus Work Program Step Review Method Evaluation Criteria

been proven to
have no effect on
the output or
future output of
the EUC.
• “Marked for
Review” is
determined if
inconsistencies
are identified that
indicate poor
design practice or
require follow-up
with the EUC
owner to
determine if
actual errors are
present.

No. 13: Missing Argument Review the • “Pass” is

formula/cell determined if no
analysis report inconsistencies
incisively. are identified or if
any potential
inconsistency has
been proven to
have no effect on
the output or
future output of
the EUC.
• “Marked for
Review” is
determined if
inconsistencies
are identified that
indicate poor
design practice or
require follow-up
with the EUC
owner to
determine if
actual errors are
present.

No. 14: Referencing White Space Cells Review the • “Pass” is

formula/cell determined if no
analysis report inconsistencies
incisively. are identified or if
any potential
inconsistency has
been proven to
have no effect on
the output or
future output of
the EUC.

12 Source: www.knowledgeleader.com
 Test Focus Work Program Step Review Method Evaluation Criteria

• “Marked for
Review” is
determined if
inconsistencies
are identified that
indicate poor
design practice or
require follow-up
with the EUC
owner to
determine if
actual errors are
present.

No. 15: Referencing Missing External Workbook Review the • “Pass” is

formula/cell determined if no
analysis report inconsistencies
incisively. are identified or if
any potential
inconsistency has
been proven to
have no effect on
the output or
future output of
the EUC.
• “Marked for
Review” is
determined if
inconsistencies
are identified that
indicate poor
design practice or
require follow-up
with the EUC
owner to
determine if
actual errors are
present.

No. 16: Cell Is Hidden By Protection Review the • “Pass” is

formula/cell determined if no
analysis report inconsistencies
incisively. are identified or if
any potential
inconsistency has
been proven to
have no effect on
the output or
future output of
the EUC.
• “Marked for
Review” is
determined if
inconsistencies
are identified that

13 Source: www.knowledgeleader.com
 Test Focus Work Program Step Review Method Evaluation Criteria

indicate poor
design practice or
require follow-up
with the EUC
owner to
determine if
actual errors are
present.

No. 17: Hidden by Custom Format Review the • “Pass” is

formula/cell determined if no
Rationale: All these types of formulas are
analysis report inconsistencies
common sources of errors and should only be
incisively. are identified or if
used for valid reasoning.
any potential
inconsistency has
been proven to
have no effect on
the output or
future output of
the EUC.
• “Marked for
Review” is
determined if
inconsistencies
are identified that
indicate poor
design practice or
require follow-up
with the EUC
owner to
determine if
actual errors are
present.

Formula and • Perform a general review of "Formula • “Pass” is

Cell Analysis Directional Highlighting" and "Map Cell determined if no
Inputs/Outputs." inconsistencies
are identified or if
• Rationale: Review or verify manually that no
any potential
additional errors exist within a file.
inconsistency has
been proven to
have no effect on
the output or
future output of
the EUC.
• “Marked for
Review” is
determined if
inconsistencies
are identified that
indicate poor
design practice or
require follow-up
with the EUC
owner to

14 Source: www.knowledgeleader.com
 Test Focus Work Program Step Review Method Evaluation Criteria

determine if
actual errors are
present.

SPREADSHEET AUDIT WORK PROGRAM: SAMPLE 2

PROJECT TEAM (LIST MEMBERS):

Project Timing Date Comments

Planning

Fieldwork

Report Issuance (Local)

Report Issuance (Worldwide)

AUDIT OBJECTIVES:
• End-user computing (e.g., spreadsheets and other user-developed programs) provides a unique set of general
control needed within an organization. By its nature, end-user computing brings the development and
processing of information systems closer to the user.
• Providing end users with tools to assist in decision-making does not eliminate the need for information
technology general controls. The output of end-user computing processes frequently appears as an
authoritative document that management will rely on during the financial reporting process.
• The purpose of this work program is to outline the controls to be tested, review the results of management’s
testing and document the procedures to test each power. This specific review focuses on end-user computing.
• Document the procedures to be performed and conclude on the operating effectiveness of the controls
identified, including a specific description of the nature, timing and extent of procedures to be completed. For
all controls that are tested at an interim date, list the procedures performed to roll forward the interim testing to
period-end.

Time Project Work Step Initial Index

Audit Procedures

• Determine if management has identified the following:

− The complexity of calculations computed using the tool
− References to other computing tools
− Any applications that receive data from the tool (either manually or
automatically)
− Source of data input into the tool

• Determine if appropriate controls are in place to verify the accuracy and

completeness of the source data used in tool calculations.

• Determine if controls are in place to protect the formulas or other critical

15 Source: www.knowledgeleader.com
 Time Project Work Step Initial Index

calculation components from unauthorized/unintentional changes.

• Determine if management has a process to authorize specific individuals to

update the logic/calculations within the computing tool.

• Determine if the computing tool is subject to a change control process.

• Determine if effective procedures exist related to version control, backup

procedures and testing logic changes.

• Document the results of management’s testing and describe any deficiency

noted by management.

Management’s Assessment

• To support our overall assessment of management’s evaluation process,

document internal audit’s evaluation of management’s tests of operating
effectiveness for the related audit objective. Specifically, address the following
key considerations:

− Were procedures sufficient to assess the design and operating

effectiveness?
◦ Consider the nature, timing and extent of management’s procedures.

− Were findings supported based on the tests performed?

− Were exceptions/deficiencies adequately documented and followed up

on?

• Conclude on the operating effectiveness of the controls over this audit

objective and document any deficiencies noted. Weaknesses in pervasive
controls cause the auditor to alter the nature, timing or extent of tests of
operating effectiveness that otherwise would have been performed.

• Document the impact of any deficiencies on the planned testing of operating

effectiveness of other controls.

16 Source: www.knowledgeleader.com