A useful review goes beyond asking whether formulas look sensible. It connects the workbook to its business purpose, tests the important controls and records the limitations of the work.
1. Agree the scope and preserve the version
Confirm the workbook, business use, period and version being reviewed. Work from an appropriate protected copy when testing could affect live operations. Note which sheets, macros, linked files, data sources and downstream outputs are in scope. State what you did not test.
2. Check the controls that matter
| Review area | Practical checks |
|---|---|
| Inputs | Confirm approved sources, expected periods, completeness, data types and reconciliations. Test how blanks, duplicates and unexpected values are handled. |
| Calculations | Inspect important formulas, constants and overrides. Look for inconsistent formulas, hidden logic, broken references and error suppression. Reperform selected key calculations. |
| Outputs | Check totals, reconciliations, exception reports and whether recipients understand limitations. Compare selected results with a credible independent expectation. |
| Access | Confirm appropriate access to the storage location and sensitive data. Check who can change logic and who approves those changes. |
| Changes | Look for a record of significant changes, testing, approval and a recoverable earlier version. Check how emergency changes are handled. |
| Operation | Review instructions, run order, required inputs, handoffs, deadlines and evidence of routine checks. |
| Recovery | Confirm backups and recovery steps are usable. Check whether another authorized person can operate the process. |
3. Test, rather than only inspect
Select tests based on the consequences of failure. Examples include reconciling an imported total to its source, entering an invalid date in a test copy, tracing a key output back through its calculations, or asking an alternate operator to follow the documented steps.
Explain the sample you chose and why. A sample-based review does not establish that every formula and transaction is correct. Sheet protection can reduce accidental changes; it does not replace appropriate file access controls or encryption.
4. Write findings people can act on
- Condition: what you observed, with the relevant version and evidence.
- Consequence: why the issue matters to the business use.
- Action: the agreed change or decision.
- Owner and date: who will act and when.
- Closure evidence: how someone will verify that the action worked.
5. Keep the review record together
Retain the scope, workbook identifier, version, test steps, results, exceptions, reviewer and review date in an approved location. Link that evidence from the inventory. Set the next review date and the events that should trigger an earlier review.
A short completion check
- The owner understands the findings and limitations.
- Important unresolved issues have a recorded decision or action.
- Each action has a responsible person and due date.
- Closure will be checked with evidence.
- The inventory and next review date are current.