Articles - Spreadsheets light up on the insurance risk radar

 By Ralph Baxter, CEO of ClusterSeven

 It’s been a busy year for spreadsheet and related data management errors, with high-profile lapses and mistakes from across the world hitting the headlines.

 For a firm like ClusterSeven, which is focused on providing solutions to help high value business professionals manage their critical financial data files (such as spreadsheets, Microsoft Access Databases and CSVs – comma separated variables), this has been both good and bad: good, in that the issue of spreadsheet risk is clearly becoming a more well-known hazard; bad, in that too many people in the financial, business and analytical worlds are still in the dark about the huge levels of risk carried by poorly managed estates of spreadsheets.

 
 The biggest data error story of the year was largely under-reported by the mainstream media: at the end of October, the German government announced that the country was €55bn [sic] “richer” after an accountancy error undervalued assets at the state-owned mortgage lender Hypo Real Estate.
 Cited by Reuters, the finance ministry was quoted as saying: “It was due to sums incorrectly entered twice”. A few papers, particularly in Germany, focused on the huge size of the mistake – €55bn– but it was surprising how little analysis or debate was had on the origins of the errors and how to prevent such incidences happening again.

 
 Looking to better quantify market understanding within the insurance community of this issue, ClusterSeven and Actuarial Post surveyed readers of the magazine in October and early November on the use of spreadsheets and the financial data files that move and manipulate information between business systems.
 Overall, the survey results showed real understanding of the use – and importance – of these files and spreadsheets but also a lack of homogeneity in the way that institutions manage the associated risks.

 
 At the heart of business
 One of the key, initial findingsof the research mirrors a call that ClusterSeven has long been making: spreadsheets are at the very heart of theinsurance world, just like the rest of complex businesses.
 The survey found that 49% of respondents use spreadsheets more than any other software application for modelling, data management and reporting activities, including 9% that only usespreadsheets for these activities. In contrast, only 16% either do not use spreadsheets at all or less than other applications. For some readers it may be truly extraordinary that 84% of the insurance risk management and analysis supporting your pensions and policies are significantly, or entirely, dependent on the humble spreadsheet.

 
 A core thrust of the research was to calculate how exposed respondents felt they and their companies were to spreadsheet risks and the overall transparency and accessibility of their data management systems(s). Here, the survey indicated that people had real concerns about the inability of other people to understand their company’s spreadsheets and the lack of standardisation of data management.

 
 Over half (53%) of respondents said that a qualified actuary could work out what was happening with their work in their absence but they would have to rely on skills and experience as the internal corporate documentation is not sufficient.

 
 Worryingly, a further 19% warned that a qualified actuary would probably have to rebuild spreadsheets in the respondent’s absence. In contrast, only 30% said that there is full and sufficient documentation in place in case of their absence – an indication of risks institutions can leave themselves exposed to if key personnel for some reason leave the firm.

 
 It is also a strong endorsement for better in-house training as well as the use of software that can help trace and prevent data errors fomented by a lack of management continuity.

 
 The survey also wanted to understand how many untrainedor unqualified people could access and make changes to highly sensitive spreadsheets – again, the reason was to understand how exposed spreadsheets and similar files were, and how people would know if changes had been made.

 
 Asked how many people have the ability to make changes to spreadsheets or those that feed data into them, nearly half (46%) of respondents to the survey said that between four and 10+ people could change critical spreadsheets. One stark finding was that 12% of respondents did not know how many people have access to spreadsheets.

 
 Unsurprisingly, 40% of respondents said that corporate controls around data file and spreadsheet access could be improved, with a further 13% saying they were simply not confident about the oversight process behind spreadsheets. Some 30% said they were ‘largely’ confident of the process; only 20% said they were confident.

  

 The challenge of responsibility

 Talking to the actuarial and financial community over the past few years, one of the key discussion points around spreadsheets and spreadsheet risks has been one of ownership. Which individual and their teamin a particular bank, insurer or institution takes on responsibility for the estate of spreadsheets that underpin the business?

 
 This is imperative. It is common for audits of spreadsheet estates in leading financial institutions to exceed 10s of millions of active files. It has become vital for an individual and their team to have a clear understanding of what is actually important within this estate – however, for many firms this position does not exist.
 Asked who should be responsible for an insurance firm’s actuarial spreadsheets and data systems, 56% of respondentssaid the chief actuarial officer or actuarial function should be accountable, while 50% saidit should fall to the chief risk officer or risk function (they could tick more than one box). Just over one in four (28%) said thechief financial officer or finance department.

 
 The role a regulator may play in the debate about spreadsheets and data management is yet to be decided. Interestingly, a significant number of respondents (77%) said they would welcome more specific guidance from the Financial Services Authority on the FSA’s expectations for spreadsheet control.

 
 Asked about the FSA’s 2011 review of the Internal Model Approval process for insurance and its requirement for a control system for key spreadsheets, 32% of respondents said they were not aware at all of any Solvency II related regulatory statement on the control of spreadsheets. A further 37% said they were aware of the document but not aware of its content relevant to spreadsheets.

 
 It will be interesting to see what, if any, guidance regulators or associations give on best-practice spreadsheet and data management. With Solvency II now officially pushed back to 2014 and with concerns even whether that deadline will be hit, perhaps more time and focus will be given to the spreadsheets and data processes behind insurance firms and regulatory compliance.

 
 A  very serious affair
 For the final question in the survey, on a scale of 1 (not serious) to 5 (very serious), one in five respondents rated spreadsheet risk ‘very serious’ while a further 31% put it as fairly serious. These are high numbers, and show that spreadsheet risks are on the market radar.

 
 ClusterSeven will continue to highlight the risks around data management in 2012 and beyond. Financial institutions will continue to report high profile instances of data mismanagement - and fraud - unless they take 100% control of the vulnerable financial data files that move and manipulate information between their business systems.

  

 

  

  

 

  

 

  

 Source: Actuarial Post/ClusterSeven