Risk assessment helps you choose where to spend attention. The aim is a reasoned priority and a clear next step, supported by evidence about how the spreadsheet is actually used.
1. Begin with the consequence of a wrong result
Ask what could happen if the output were wrong, incomplete, late or unavailable. Consider financial loss, incorrect reporting, customer harm, operational disruption, privacy exposure and the time needed to recover. Use thresholds defined by your organization; a single universal monetary cutoff will not fit every process.
2. Look at how failure could arise
| Dimension | Questions to ask |
|---|---|
| Business impact | Which decisions and obligations rely on the output? What could a material error change? |
| Complexity | Are there intricate formulas, macros, hidden logic, manual overrides or calculations that few people understand? |
| Dependencies | Does the workbook import data or link to other files? Are those dependencies controlled and current? |
| Frequency and change | How often does it run? How quickly do data, logic and users change? |
| Data sensitivity | Could access, copying or an accidental disclosure affect people or the business? |
| Detectability | Would a wrong result be detected before someone relied on it? |
| Resilience | Are backups, recovery steps and a capable alternate operator available? |
3. Record inherent risk before control effectiveness
Describe the exposure before crediting the controls, then identify what reduces it. A high-impact spreadsheet does not become unimportant merely because it has a strong reviewer. Keep the underlying criticality visible alongside the assessment of controls and remaining risk.
4. Use a simple, explained priority
- Higher priority: a failure could materially affect an important decision, report or service; or the file has serious unresolved control weaknesses.
- Medium priority: the consequences are meaningful but contained, with a credible route to detect and correct issues.
- Lower priority: limited consequences, simple use and a readily available alternative or correction.
These are starting descriptions, not a prescribed scoring standard. Agree your definitions and escalation rules with the appropriate owners. If you use a numerical score, preserve the answers and reasoning behind it. Avoid allowing a low average score to hide one severe consequence.
5. Connect the assessment to action
For each file, record the priority, rationale, reviewer, evidence, assessment date and next action. The outcome might be an independent review, a change to access, a better input check, documented operating steps, or a decision to replace the spreadsheet.
Illustrative example
A monthly liquidity forecast supports a funding decision. Its calculations are modest, but an incorrect input could materially alter the decision. That consequence may justify a higher review priority even when the workbook is small and familiar.
Review when something important changes
Reassess after a material formula or data-source change, a new business use, an ownership transfer, a significant error, or a change in dependency. A calendar review is useful, but it should not be the only trigger.