To Excel or not to Ex(c)el
During the SOX era, when risk and control registers became popular, this was the tool of choice for obvious reasons (needless to say that nowadays it is BWise). Whether it is audit work papers or sample sheets, planning, risk assessments, risk registers, SOX testing results or anything else, Excel is being used by pretty much all of our customers before any kind of GRC system is installed.
Two of our common challenges using Excel:
- To some, Excel might seem easier. Forget integration, forget 10 different GRC initiatives running with overlap and in parallel within any given organization, forget the number of people involved, independent reviews, risk assessment validation, organizational structure and such. Just look at one individual task of one individual that only has a very limited role in the holistic GRC space. Excel might be easier. During all of our implementations we have to move something from Excel to BWise. However, in any given case, one must always ask if it makes sense. Automate what makes sense, but don't automate to automate. And make sure that individuals that dislike change for valid reasons, get to know the bigger picture.
- Excel is always used to start migrating data into BWise whether it comes from a different GRC system/audit solution or from home grown Excel sheets/applications. Our data migration is built in Excel tools because of ease of use and commonly known Excel capabilities and experiences. Depending on the complexity of your data structures and the number of different Excel risk registers, we should never underestimate the time it takes to successfully convert it into the correct formatting. In most projects we train our customers to do the data migration themselves due to time and resource limitations. Some of our customers already have an appointed Excel guru and that surely helps :)! For those that don't, we don't know everything in Excel either, but we carry most of the basic functionalities needed for the conversions by heart so ask for our help.
Instead of writing my own guide, I will provide you some very relevant links to existing Excel tutorials on the World Wide Web that cover most of the basics:
In some really large customer cases (2.000 controls, 100 subsidiaries) even Excel is too limited. There it makes more sense to do the migration using MS Access but that's for experts only...