Last week the FT reported, “JPMorgan suffered almost $6bn in losses because of trades from the so-called ‘London whale’ caused in part by avoidable errors on Microsoft Excel spreadsheets used to calculate risk, according to an investigation by the US bank.” Despite this, said the report, commenting on a recent survey conducted by market research company Vision Critical, “More than half of financial services groups in the UK have poorly applied or no controls for managing business-critical spreadsheets,” leaving themselves open to similar problems.
That survey was commissioned by ClusterSeven and questioned more than 250 C-level executives and senior managers in the UK financial services industry. Its findings are surprising. More than 9 out of ten respondents admit to using spreadsheets as much or more than any other financial application in managing financial data; and one in five say these spreadsheets can handle values in excess of £1 billion. But at the same time, more than half of the C-level executives in financial services say there are either no usage controls at all or poorly monitored policies over the use of business critical spreadsheets at their firms.
“For years financial service software vendors have been saying, ‘abandon the spreadsheet’, we can do things much more securely,” ClusterSeven’s CEO Ralph Baxter told Infosecurity. “But people are still using spreadsheets – and possibly more than ever. I liken it to a transport analogy,” he continued. “Despite all the advice that we should use public transport for the sake of the environment, we still tend to prefer the private car because of the greater flexibility and immediacy it offers.” The same argument applies to the spreadsheet: users find it easier and more flexible than the company database.
The reality is that senior managers with critical data in major institutions are still faced with the same pressures found in other industries – there is a desire to take work home for the weekend. BYOD temptations affect senior managers in finance as much as any other employee in any other industry – and services like Box and Dropbox are just as available to them.
The danger for financial services – an industry that moves very fast – is that any hindrance to flexibility and immediacy can inhibit competitiveness. “And the old adage still applies,” said Baxter. “If you put controls in place, users will just find ways around them.” Baxter’s solution is to provide ‘cell-level’ management over the content rather than file level control over its movement. That way spreadsheets can still be used, and can still be taken home, but the content cannot be abused.
But whatever the solution, something needs to be done. Despite the high values managed in the spreadsheets, one in seven of the respondents admitted that their firm has suffered a ‘significant’ data breach.