Glossary term
End-User Computing (EUC) Risk
Subject: Technology, Cyber and Data, IT and Data Governance
Also known as: Spreadsheet risk, User-developed applications
End-user computing risk is the chance of errors, data loss or misuse arising from spreadsheets, macros, databases and small tools built and run by business staff outside formal IT development and control.
Explanation
Staff build spreadsheets and scripts because they are quick and flexible. The trouble is that these tools often end up feeding real decisions, reports or customer outcomes without the testing, version control, access limits or backup that applies to official systems. Typical failures include broken formulas, copy-and-paste mistakes, hidden links to other files, a macro that only one departed employee understood, and sensitive data stored on a shared drive. Well-known losses and misstatements have been traced to spreadsheet errors. Control practice starts with an inventory of tools, then ranks them by materiality and complexity. High-ranked tools get documentation, independent review, locked cells, change logging, access restrictions and tested recovery. Some are retired in favour of proper systems. Auditors of financial reporting look at EUC closely, since key figures often pass through a spreadsheet at the last mile.
Example
A treasury team calculates month-end hedging positions in a workbook with many linked sheets. An internal review finds one formula range stops a row short, understating exposure by about 2%. The tool is classed as high risk, given review and locking, and a plan is drawn up to move it onto a controlled system.
Not to be confused with
- Shadow IT
- Shadow IT is unapproved systems or services; EUC risk concerns tools staff build themselves, even on approved software such as Excel.