Related Topics:
			Business Research: ERP, Finance Vendor Research: A3 Acorn Systems Adaptive Planning Alight Applix Business Objects Business Objects – ALG Software Business Objects - Cartesis Clarity Systems Coda Cognos Compassoft Epicor FRx Software IFS Infor Infor – Extensity/Systems Union Intacct KCI Computing Lawson Longview Solutions Lyquidity Microsoft Microsoft Business Solutions Mincom NetSuite Oracle Oracle - Hyperion PrecisionPoint Software Prodiance PROPHIX Sage SAP SAP - OutlookSoft Systems Modeling
			Printer friendly version Email this article Send feedback to editor

Summary
Compassoft’s latest release of its discovery, management and control (DMC) software for spreadsheets adds more policy-based automation, making it easier for organizations to manage the process of discovery management and control when dealing with thousands or even tens of thousands of spreadsheets, desktop database and report files. The software enables companies to automate the process of continuously discovering, monitoring and assessing these files to determine if they pose business or compliance risks. Until recently, organizations had to check these files manually, which meant the process was haphazard – if it was done at all. Today, software exists to automate this necessary process, and Ventana Research recommends that all companies with 1,000 or more employees investigate whether these products can work for them.

Assessment
Compassoft’s release 3.5 of its discovery, management and control software works with spreadsheets, PC databases (such as Microsoft Access) and Crystal reports. DMC software enables companies to gain more complete views of which spreadsheets and similar types of software exist on their corporate network and to see the links between these spreadsheets (and some of those other applications). DMC also can uncover certain types of errors or suspicious elements in spreadsheets (such as hidden cells or an “invisible” white typeface on a white background). Such software also offers controls than can limit access to entire spreadsheets or cells within them and other types of controls that are not available or not secure in Excel.

DMC software is important because it addresses many of the fundamental weaknesses inherent in spreadsheets, which pose substantial risks when they are used in collaborative, repetitive enterprise business processes. Studies have shown repeatedly that spreadsheets are riddled with errors even when they are audited. The fact that most of these errors are trivial and have no material impact on a company’s operations or financial statements should be considered more of a risk rather than a relief, since it leads to complacency about the substantial business, reputation or financial compliance disasters that could be lurking inside any spreadsheet.

Until recently the rational response to the risks posed by spreadsheets has been merely to check and recheck to see if the results pass a basic sanity test. Trying to manage the thousands (or tens of thousands) of constantly changing spreadsheets manually has never been feasible. Even managing manually the handful of spreadsheets that affect the critical closing process is a daunting effort. However, technology has advanced to the point where we think there is no excuse for doing nothing. Whether auditors worldwide will begin requiring stringent controls on spreadsheets and similar applications remains to be seen. Regardless, Ventana Research advises companies to implement DMC software because it is a relatively painless means of addressing spreadsheet shortcomings. When it is in place, people across the company can continue doing things the way they always have, but the risks related to spreadsheet use will be diminished.

Compassoft 3.5 reflects the vendor’s strategy of addressing the DMC market from a corporate-wide standpoint rather than a departmental one. Its objective is to automate the discovery process across all desktops, laptops and servers, and to extend the file types covered to include desktop databases, reports and forms. All of these files (especially desktop databases) pose control risks, especially since they are linked directly or indirectly to spreadsheets used in enterprise processes. While identifying and controlling the spreadsheets that can have a material impact on the accuracy of financial statements is necessary for achieving Sarbanes-Oxley compliance, we think it is not sufficient for the entire business. Since spreadsheets and other desktop applications are dynamic and affect operations as well as finance, being able to continuously discover, track and control them is a more comprehensive (and potentially more cost-effective) approach to addressing the issues these applications pose.

Compassoft’s approach to sifting through the mass of spreadsheets and other files is to have user companies set control policies that automate the identification process (for example, the degree of complexity, specific content, types of macros and types of cells) and configure how its software responds to situations (such as by sending an alert or initiating a process). The software manages this as an ongoing process so that new files are assessed as they are created. It not only can control access to files but also specify which people can save a file, e-mail it or do other things with it. Version 3.5 handles 71 types of macros and links, ranging from cell references to query tables created against databases.

Market Impact
The market for software that addresses the shortcomings of desktop spreadsheets used in enterprise processes is small but growing rapidly. Spreadsheets are pervasive in most business processes. Our research shows that a majority of businesspeople use spreadsheets in performing their most important tasks. The biggest competitor for vendors of spreadsheet discovery management and control tools is complacency, as expressed in the typical phrase, “We’ve always done it this way, and so far there haven’t been any problems.” But we expect the market to develop rapidly over the next five years as companies recognize that it is cost-effective to manage spreadsheets to reduce the chances of expensive business and financial events occurring. Demand would boom if the major audit firms begin to require tighter controls on end-user applications such as spreadsheets and desktop databases. Compassoft competes with a range of companies including Boardwalktech, Cimcon and Prodiance. Its strategy is to differentiate itself by focusing on an enterprise-wide target and senior executives who have authority to approve such an extensive purchase.

Recommendation
Ventana Research believes that all companies with 1,000 or more employees must at least investigate ways to manage and control spreadsheets more tightly than they do now. This likely would be a job for the controller or the head of internal auditing. As a first step, U.S. public companies should find ways to reduce the burden of handling spreadsheets that are “in scope” of a Sarbanes-Oxley audit. Yet the value of control extends well beyond regulations on those that issue securities. Companies in certain industries (particularly financial services and pharmaceuticals) are inundated by spreadsheets and other desktop applications that can pose substantial business risks. For them, we believe that taking a centralized, enterprise-wide approach to the discovery management and control cycle will prove the most cost-effective.