Spreadsheets are ubiquitous in the business world. They are commonly used for collecting and storing data and for a good deal of business modeling and analysis. But mishandling of spreadsheets has led to serious problems, from fabricated data to botched exam scores (see the anecdotes collected at www.eusprig.org). In response to such problems, we organized the Spreadsheet Engineering Research Project, (SERP) in 2004 at Tuck for studying, developing, and promoting a set of best practices in spreadsheet use. A grant from the National Institute of Standards and Technology currently supports the research effort, which is administered with the help of Program Manager Barry Lawson.
Many Tuck alums will recall our invitation in March 2005 to participate in the SERP survey on spreadsheet use. The invitation went to everyone who receives the electronic alumni newsletter, and some 12 percent of the alumni completed the survey—an excellent response rate, according to our marketing colleagues. As a result, we have a deeper picture than before of spreadsheet use among Tuck alumni.
About half of our sample—those who graduated from Tuck before spreadsheets became integrated into the core curriculum—learned about spreadsheets after Tuck, while about half were at least initiated, if not educated, before or during their Tuck experience.
Using our contacts with software houses, we were also able to survey two other populations of spreadsheet users and compare their responses with those from Tuck alums. The two outside groups represent the advanced end of the user spectrum.
The survey dealt with several categories of spreadsheet use: creation, documentation, testing, actual use, sharing, modifying, and archiving. In addition, the survey probed for information about corporate policies relating to training, standards, quality control, and risk management.
In response to the question of how important spreadsheets were to their own job, 82 percent of the Tuck sample said either "Very Important" or "Critical," and 54 percent reported that they spent more than a quarter of their time on spreadsheets.
Early findings indicate the following about the Tuck cohort, compared with the advanced users: they were less likely to build spreadsheets from scratch; said less frequently that their spreadsheets were likely to become "permanent assets" in their organizations; tended to build smaller spreadsheet models, on average; and were more likely to say they "never" tested, documented, or protected their spreadsheets.
On the questions relating to corporate policies about spreadsheet use, Tuck alums were not very different from the advanced users. About half of the respondents in all groups—including Tuck alums—indicated that their company provides no training; and a substantial majority indicated that their company has no standards for spreadsheet models. A majority also believed that spreadsheets pose a "medium" or "high" level of risk in their organization, and over 40 percent "don't know" who in the organization is responsible for managing spreadsheet risks. Only about 20 percent indicated that their company had "full awareness" of spreadsheet risk. Tellingly, only about 4 or 5 percent of the non-Tuck groups reported that their companies used third-party spreadsheet-auditing packages; less than 1 percent of the Tuck group answered in the affirmative.
Spreadsheet risk appears to be gaining recognition as a widespread problem. Excel is so pervasive in the business world, and its use so difficult to control, that there is no easy way to deal with spreadsheet risk. The most effective corporate responses would seem to be multilayered: better training, broader standards, and more efficient auditing. In short, organizations need to take the same kinds of steps for spreadsheets that they take for other important areas of risk. As the SERP continues, we hope to shed some light on the best practices available in this realm.
