Excel Horror Stories and the Business Case
for EUC Risk Management
A spreadsheet can begin as a quick fix and become essential to a business. It may calculate a financial exposure, produce a regulatory return or hold information that must never leave the organisation. As its importance grows, the controls around it need to grow too.
The consequences of getting this wrong extend well beyond an incorrect total. Documented incidents have led to regulatory penalties, delayed public health reporting and the disclosure of sensitive personal information. They show why end-user computing risk deserves attention from business leaders as well as spreadsheet developers.
What is EUC risk
End-user computing, or EUC, includes spreadsheets and other applications developed or maintained by business users outside the organisation’s usual software development processes. Excel, Access databases and VBA tools can all form part of an EUC estate.
These tools offer speed and flexibility. Risk increases when a critical process depends on an application whose logic, data, changes or ownership are poorly controlled. A workbook can look convincing while containing an incorrect formula, incomplete input data or information hidden from view.
Real incidents with serious consequences
Standard Chartered and unreliable liquidity reporting
In December 2021, the Prudential Regulation Authority fined Standard Chartered Bank £46.55 million for failures in regulatory reporting governance and controls, and for failing to be open and cooperative with the regulator. Five reporting errors between March 2018 and May 2019 prevented the PRA from obtaining a reliable picture of a tailored US dollar liquidity metric. The findings included inadequate testing, checks and escalation arrangements. [1]
The lesson for businesses is that checking a calculation is only part of the job. There must also be a clear process for investigating errors, escalating concerns and informing the right people promptly.
Metro Bank and weaknesses in capital reporting
In December 2021, the PRA fined Metro Bank £5.376 million for failures relating to its capital reporting and the governance and controls supporting its COREP returns. The bank had previously announced an approximately £900 million adjustment to its risk-weighted assets after correcting the treatment of certain commercial loans. [2]
This was a wider reporting and governance failure. It illustrates why critical calculations need documented rules, independent challenge and resources that keep pace with business growth.
Public Health England and incomplete data transfers
In October 2020, Public Health England confirmed that 15,841 positive COVID-19 cases had been omitted from daily reported figures because of a technical issue in its data loading process. Some files exceeded the maximum size accepted by the process. The issue also delayed transfer into the contact tracing system, although individuals received their test results normally. [3]
For any spreadsheet-based reporting process, the lesson is to check completeness from source to output. A successful import or a plausible total does not establish that every record has been processed.
PSNI and sensitive information hidden in a spreadsheet
In August 2023, the Police Service of Northern Ireland published a spreadsheet in response to a freedom of information request. An overlooked worksheet contained personal details of its workforce. In October 2024, the Information Commissioner’s Office imposed a £750,000 fine following the disclosure of information about 9,483 officers and staff. [4]
Hiding data does not remove it. Before a workbook is shared externally, the whole file needs to be checked, including worksheets and other content that may not be visible on screen.
Why these failures matter to your business
These incidents involved different organisations and processes, but each shows the consequences of weaknesses in data handling, checking or oversight. A routine mistake becomes far more serious when the affected output drives a decision, a regulatory submission or a public disclosure.
Warning signs in an EUC estate include repeated copying and pasting, several competing versions of a workbook, undocumented formulas and reliance on one person who understands the process. When these weaknesses occur in a business-critical application, they deserve priority.
Practical steps to reduce EUC risk
Identify critical applications. Build an inventory of the spreadsheets and tools supporting important decisions, reporting or sensitive data. Record their purpose, owner, users and dependencies.
Prioritise by business impact. Assess what would happen if an application produced a wrong result, became unavailable or disclosed information. Focus remediation on the highest-impact processes.
Strengthen data and calculation checks. Validate inputs, reconcile source and output record counts, test important formulas and investigate unexpected changes. Use checks that can detect plausible but incorrect results.
Control changes and access. Keep an approved version, document material changes and require review before release. Restrict access according to the information and process involved.
Reduce reliance on individual knowledge. Document the logic and operating procedures, nominate a backup owner and ensure another person can run and review the application.
Choose the right remediation approach. Some tools need better controls and targeted repairs. Others may benefit from automation or migration to a governed web application or API. Match the solution to the process and its risks.
How EUC Solutions can help
At EUC Solutions, we help businesses reduce risk in Excel and VBA processes through EUC tools. Depending on the application, this can mean using no-code or low-code tools, or converting a process into a web application or API.
The aim is to preserve useful business functionality while improving reliability and making the process easier to maintain. Technology changes need to be supported by clear ownership, testing and operating controls.
If an important business process depends on an unwieldy spreadsheet, contact EUC Solutions to discuss its risks and the options for making it more robust.
