A spreadsheet life cycle analysis and the impact of Sarbanes–Oxley

Past studies show that only a small percent of organizations implement and enforce formal rules or informal guidelines for the planning, design and development, usage, modification, and disposition stages of spreadsheet models. Due to the lack of such policies, there has been little research on how companies can effectively govern spreadsheets throughout their life cycle. This paper describes a survey involving 43 participants from the United States, representing companies that were working on compliance with the Sarbanes–Oxley Act of 2002 (SOX) as it relates to spreadsheets for financial reporting. The findings of this survey describe specific controls that organizations have implemented to manage spreadsheets for financial reporting throughout a spreadsheet's life cycle. Our findings indicate that there are problems in all stages of a spreadsheet's life cycle and we suggest several important areas for practice and future research.

► Presents a spreadsheet life cycle framework that details the operational stage.
► Reports survey results for spreadsheet controls in 43 organizations working on SOX compliance.
► Analyzes survey results using the spreadsheet life cycle framework.
► Identifies internal control processes that are not being effectively implemented.
► Makes suggestions for practice and future research.