Governance, Risk, Security, and Ethics

Introduction

Spreadsheets are among the most widely used technologies in supply chain management. They support demand planning, supplier evaluation, inventory analysis, transportation costing, service-level monitoring, and executive reporting. Their accessibility is a strength, but it is also a source of risk. A spreadsheet can become an informal information system without receiving the controls, documentation, testing, and accountability normally expected of an enterprise application.

Spreadsheet risk is the possibility that an error in spreadsheet design, data, calculation, access, interpretation, or use will produce financial loss, operational disruption, regulatory exposure, unsafe decisions, or reputational damage. In a supply chain, such consequences can propagate rapidly. An incorrect reorder recommendation may create stockouts; an incorrect supplier score may distort sourcing decisions; and an exposed customer file may violate privacy obligations.

Governance provides the structures through which data and spreadsheet use are directed, controlled, and made accountable. Risk management identifies and reduces threats. Security protects confidentiality, integrity, and availability. Ethics addresses whether data practices are fair, responsible, and respectful of human interests. These dimensions are interdependent: a technically secure spreadsheet may still be ethically inappropriate, while an ethically sound process may fail if ownership and controls are unclear.

This chapter examines how graduate-level supply chain professionals can establish ownership, access controls, audit trails, change management, model validation, privacy, cybersecurity, regulatory compliance, responsible data use, and practical mitigation of spreadsheet risk.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain why spreadsheets require formal governance in supply chain environments.
2. Design ownership, accountability, access, documentation, and audit arrangements.
3. Apply spreadsheet risk assessment and control frameworks.
4. Evaluate model validity, data quality, change management, and segregation of duties.
5. Distinguish privacy, cybersecurity, compliance, and ethical responsibilities.
6. Recommend proportionate controls for operational, managerial, and strategic spreadsheets.
7. Analyze a realistic spreadsheet-governance failure and propose corrective action.

1. Spreadsheet Governance as an Organizational Capability

Spreadsheet governance is the coordinated set of policies, roles, standards, controls, and review practices governing the creation, use, modification, storage, and retirement of spreadsheets. It is not synonymous with banning spreadsheets. A proportionate governance program recognizes that spreadsheets are useful for experimentation and local analysis, while ensuring that high-impact tools receive stronger controls.

A useful classification is based on business impact:

Classification should consider not only intended use but actual use. A worksheet initially created for personal analysis may become embedded in a daily planning process. Therefore, periodic discovery and inventory are necessary.

The governance principles

Several principles provide a foundation:

• Accountability: Every important spreadsheet has an identified business owner and technical custodian.
• Transparency: Inputs, assumptions, transformations, outputs, and limitations are documented.
• Least privilege: Users receive only the access needed for their responsibilities.
• Separation of duties: Where feasible, creation, approval, execution, and review are performed by different people.
• Traceability: Material changes and decisions can be reconstructed.
• Proportionality: Controls reflect impact, likelihood, and cost.
• Resilience: The organization can continue operating if the spreadsheet is unavailable or its results are questioned.
• Responsible use: Data are used lawfully, fairly, securely, and for legitimate purposes.

2. Ownership, Roles, and Accountability

Ambiguous ownership is a major source of spreadsheet risk. The person who created a spreadsheet may not be the person who understands its current logic, while the manager using its output may assume that someone else has validated it.

A robust role design commonly distinguishes the following:

The RACI model can clarify responsibility: one person may be Responsible for performing a task, another Accountable for its result, others Consulted, and others Informed. A RACI matrix should be specific to activities such as modifying formulas, approving new data sources, publishing reports, and responding to incidents. It should not be used merely as a decorative table; each assignment must correspond to a real decision right.

Ownership also requires succession planning. A spreadsheet that only one employee understands represents key-person risk. Documentation, cross-training, and controlled handover reduce this vulnerability.

3. Access Control and Information Security

Security objectives are often summarized as the confidentiality, integrity, and availability triad:

• Confidentiality: Only authorized people can view sensitive data.
• Integrity: Data and formulas remain accurate, complete, and unaltered without authorization.
• Availability: Authorized users can access required information when needed.

Access should be based on role rather than convenience. Effective controls include identity-based accounts, multifactor authentication where supported, role-based permissions, restricted sharing links, controlled folders, and prompt removal of access when a person changes role or leaves the organization.

Spreadsheet password protection alone is not a complete security strategy. Workbook passwords may protect against casual editing but may not provide strong encryption, identity management, or reliable evidence of who accessed a file. Sensitive workbooks should be stored in approved enterprise platforms with encryption, access logging, backup, and retention controls.

A practical access model separates:

1. Read access: View data and outputs.
2. Input access: Enter or update designated data fields.
3. Calculation access: Modify formulas or model logic.
4. Approval access: Authorize publication or operational use.
5. Administration access: Change permissions, storage, or system settings.

Input cells should be visually and technically distinguishable from formula cells. Protection should prevent accidental overwriting while allowing authorized maintenance through a controlled process. Macros, external links, and data connections deserve particular scrutiny because they can execute code, import untrusted content, or silently change results.

4. Audit Trails, Documentation, and Evidence

An audit trail is a reliable record of what changed, when it changed, who changed it, why it changed, and what approval was obtained. It supports accountability, troubleshooting, regulatory review, and organizational learning.

A suitable audit trail may include:

• workbook identifier and owner;
• version number and effective date;
• change description and business reason;
• affected sheets, formulas, data sources, or assumptions;
• requester, developer, reviewer, and approver;
• test evidence and unresolved limitations;
• release decision and rollback version.

File names such as final_v2_revised_new.xlsx are not adequate version control. A better naming convention includes a stable identifier, process, date, and version, while the authoritative copy is maintained in a controlled repository. Version history should be supplemented by a change log because technical history alone may not explain business rationale.

Documentation should allow a competent successor to answer five questions:

1. What decision or process does the spreadsheet support?
2. Which data are inputs, and where do they originate?
3. How are calculations performed?
4. What assumptions, thresholds, and exceptions apply?
5. What controls and limitations affect interpretation?

A data dictionary should define field names, meanings, units, permitted values, time zones, granularity, and responsible owners. For example, “inventory” must specify whether it means physical stock, available-to-promise stock, or unrestricted book inventory.

5. Change Management and Spreadsheet Lifecycle

A spreadsheet should be governed across a lifecycle rather than only at creation. A typical lifecycle is:

Initiate → Classify → Design → Build → Validate → Approve → Deploy → Monitor → Review → Retire

During initiation, the business purpose and decision impact are recorded. Classification determines the level of review. Design establishes data sources, assumptions, controls, and output requirements. Build should follow standards for naming, formulas, layout, error handling, and documentation.

Validation must occur before deployment and after material changes. A change is material when it could alter decisions, financial results, access rights, regulatory reporting, or risk exposure. Examples include changing a forecasting method, adding a supplier, altering a threshold, replacing a data source, or modifying a macro.

A controlled change process normally requires:

• a documented request;
• impact assessment;
• development in a nonproduction copy;
• testing against known cases;
• independent review for high-risk models;
• approval before release;
• communication to affected users;
• post-release monitoring;
• a rollback or contingency option.

Emergency changes may follow an abbreviated process, but they should be documented retrospectively and independently reviewed. “Urgent” should not become a permanent exemption from control.

Retirement is also important. Obsolete workbooks should be archived or securely deleted according to retention rules. Keeping many uncontrolled copies increases the chance that users rely on outdated results.

6. Model Validation and Spreadsheet Quality

Validation asks whether a spreadsheet is fit for its intended purpose. It is broader than checking whether formulas contain syntax errors. A workbook can calculate without error and still implement the wrong business logic.

Validation should address at least six dimensions:

1. Conceptual validity: Does the model represent the relevant business process and causal relationships?
2. Data validity: Are sources authoritative, complete, timely, and correctly transformed?
3. Calculation validity: Are formulas, ranges, joins, units, and aggregation rules correct?
4. Implementation validity: Do the spreadsheet functions, macros, and links implement the intended design?
5. Output validity: Are results plausible, reconciled, and suitable for the decision?
6. Use validity: Do users understand assumptions, limitations, and appropriate interpretation?

Testing techniques include formula inspection, independent recalculation, boundary testing, historical back-testing, reconciliation to a trusted source, sensitivity analysis, and scenario testing. Extreme-value tests are valuable: zero demand, negative quantities, missing dates, duplicate suppliers, currency changes, and unusually long lead times can expose hidden errors.

For a forecast model, one possible accuracy measure is mean absolute error:

Here, Aᵢ is actual demand for observation i, Fᵢ is the forecast, and n is the number of observations. MAE has the same units as demand and assumes that observations are comparable and that absolute error is an appropriate penalty. It does not, by itself, prove that a spreadsheet is valid; it evaluates one aspect of predictive performance.

A model risk assessment can be structured conceptually as:

Likelihood and impact should be defined using an organizational scale, such as 1 to 5, rather than treated as objectively precise probabilities. The product is a prioritization aid, not a law of nature. A low-frequency event with catastrophic impact may require stronger controls than the score alone suggests.

Reconciliation and control totals

Control totals compare a spreadsheet result with an independent reference. For example, total inventory by warehouse should reconcile to the enterprise inventory ledger, subject to documented timing and scope differences. A reconciliation difference can be expressed as:

The units must be identical, and the comparison must use the same population, period, currency, and inclusion rules. A zero difference is reassuring but not conclusive: identical errors can cancel each other.

7. Privacy, Cybersecurity, and Regulatory Compliance

Supply chain spreadsheets may contain personal data, commercially confidential information, bank details, employee records, customer addresses, or supplier risk assessments. Privacy governance asks whether collection, use, disclosure, retention, and deletion are justified and controlled.

Key privacy principles commonly include purpose limitation, data minimization, accuracy, storage limitation, security, transparency, and accountability. Applicable legal requirements vary by jurisdiction and sector. Examples of relevant regimes may include comprehensive data-protection laws, sector-specific requirements, records-retention rules, customs regulations, employment law, competition law, and contractual obligations. Legal applicability must be determined by qualified counsel; a general spreadsheet policy cannot replace jurisdiction-specific advice.

A privacy impact assessment is appropriate when a new process involves sensitive information, large-scale monitoring, profiling, cross-border transfer, or significant effects on individuals. Questions include:

• What personal or sensitive fields are collected?
• Is each field necessary for the stated purpose?
• Who can access it and why?
• How long is it retained?
• Can it be aggregated, masked, pseudonymized, or deleted?
• What happens if the file is disclosed or corrupted?

Cybersecurity threats include phishing, malicious macros, ransomware, credential theft, accidental public sharing, data exfiltration, and manipulation of supplier or payment information. Controls should combine user awareness, secure platforms, endpoint protection, backups, incident response, and technical monitoring. Backups must be tested; an untested backup is an assumption rather than a demonstrated recovery capability.

Incident response should define identification, containment, eradication, recovery, notification, evidence preservation, and lessons learned. A suspected alteration to a supplier bank-detail spreadsheet, for example, should be treated as a potential security and fraud incident rather than merely a clerical error.

8. Ethics and Responsible Data Use

Compliance is a minimum standard, not the complete definition of responsible practice. Ethical data use considers power, fairness, human dignity, explainability, and consequences for people who may not be able to challenge a decision.

Important ethical risks include:

• using supplier or worker data for purposes beyond the original expectation;
• ranking suppliers with biased or incomplete indicators;
• penalizing small suppliers because they lack sophisticated reporting systems;
• inferring employee performance from unreliable proxies;
• presenting uncertain outputs as objective facts;
• concealing assumptions or selective exclusions;
• sharing commercially sensitive data without authorization.

Responsible practice requires proportionality and contestability. A supplier should have a meaningful opportunity to question an inaccurate score when that score affects qualification or allocation. Decision makers should distinguish measured facts from estimates, judgments, and model outputs.

Fairness does not always mean treating every supplier identically. A fair process may account for differences in size, geography, regulatory context, or data availability, provided those distinctions are relevant, transparent, and not discriminatory. Ethical review should therefore examine both the data and the consequences of using them.

Artificial intelligence and advanced analytics increase these concerns. If an AI tool generates spreadsheet formulas, classifications, forecasts, or summaries, the organization remains accountable for checking accuracy, confidentiality, intellectual property, explainability, and human impact. Sensitive data should not be entered into unapproved external tools. AI-generated formulas require testing just like human-generated formulas.

9. A Practical Spreadsheet Risk-Control Framework

A mature control framework combines preventive, detective, and corrective controls.

Controls should be assigned to an owner, have a defined frequency, and produce evidence. A control that nobody performs or records is not operationally reliable.

A useful risk register records the asset, process, threat, vulnerability, consequence, likelihood, impact, existing controls, residual risk, action owner, due date, and status. Residual risk is the risk remaining after controls. It should be explicitly accepted by an appropriate manager rather than silently tolerated.

10. Illustrative Case: The Regional Replenishment Workbook

Background

The fictional Northstar Distribution Group operates warehouses in three countries. Each Monday, planners use a workbook to calculate suggested purchase quantities for approximately 4,000 stock-keeping units. The workbook imports sales history, inventory balances, open purchase orders, supplier lead times, and minimum-order quantities.

Problem

A planner discovered that several high-volume items were projected to stock out even though inventory was available. Investigation showed that a new warehouse had been added to the inventory export, but the workbook’s fixed data range excluded the additional rows. At the same time, a planner had overwritten a protected formula in one sheet after copying values from an email. The workbook had several copies stored in personal folders, and no one could identify the authoritative version.

The immediate operational risk was unnecessary emergency purchasing. The broader governance risk included unknown formula integrity, weak access control, absent change evidence, and dependence on one experienced planner.

Analysis

The organization classified the workbook as operationally critical because it directly influenced purchase orders and service levels. A risk workshop identified:

• Data risk: incomplete warehouse population and inconsistent item identifiers;
• Model risk: fixed ranges and undocumented assumptions about lead time;
• Process risk: no independent approval before purchase orders were issued;
• Security risk: uncontrolled email attachments and personal storage;
• Continuity risk: insufficient documentation and no tested fallback process.

Approach and solution

Northstar first froze the workbook and compared the latest approved copy with recent versions. It reconciled inventory and open-order totals to the enterprise system, recalculated purchase recommendations independently for a sample of items, and reviewed all formula changes.

The redesigned process introduced:

1. a named business owner and technical custodian;
2. a controlled cloud repository with role-based access;
3. structured tables rather than fixed ranges;
4. input validation for item, warehouse, date, and quantity fields;
5. a documented data dictionary and assumptions register;
6. protected formula cells and separate input, calculation, and output areas;
7. an independent weekly review of exceptions and control totals;
8. formal change requests for logic or data-source changes;
9. a fallback procedure using the enterprise system and approved safety-stock rules;
10. training and cross-coverage for planners.

Outcome

The organization corrected the immediate recommendations, prevented unnecessary orders, and established evidence that subsequent outputs reconciled to source systems. The most important improvement was not a particular spreadsheet feature but the transition from an individual-owned file to a governed decision process.

Learning points

First, spreadsheet failures usually arise from interacting weaknesses rather than one isolated bad formula. Second, technical protection cannot compensate for unclear ownership. Third, control totals and independent review are valuable even when a workbook appears to work. Finally, governance should preserve useful local analysis while ensuring that critical outputs are reproducible, reviewable, and recoverable.

11. Implementation Roadmap for Supply Chain Organizations

Organizations beginning a governance program can proceed in stages.

Stage 1: Discover. Inventory important spreadsheets, identify owners, map data sources, and locate uncontrolled copies.

Stage 2: Triage. Classify workbooks by impact and prioritize those affecting payments, orders, compliance, safety, customers, or executive decisions.

Stage 3: Standardize. Publish naming, documentation, storage, access, testing, and change standards. Provide templates rather than relying solely on policy statements.

Stage 4: Control. Apply permissions, protection, version history, reconciliation, review, backup, and incident procedures to high-priority workbooks.

Stage 5: Improve architecture. Replace repeatedly critical or highly complex spreadsheets with governed databases, planning applications, or workflow tools when the benefits justify the cost.

Stage 6: Monitor. Review access, exceptions, incidents, control performance, and continued business need. Reclassify workbooks when their use changes.

Migration should be based on risk and value, not on the assumption that every spreadsheet must immediately be replaced. A well-governed spreadsheet may be appropriate for a bounded analytical task, whereas a shared, high-volume, real-time process may require a more controlled system.

Challenges and Limitations

Governance can fail if it becomes excessively bureaucratic. Users may create shadow copies when approved processes are too slow, leading to less visibility rather than greater control. Controls must therefore be usable, proportionate, and supported by training.

Automated spreadsheet scanners can identify suspicious formulas, external links, hidden sheets, or unusual structures, but they cannot fully determine whether a model represents the business correctly. Human review remains necessary.

Formal controls also have costs: time, software, training, review capacity, and possible reduction in local flexibility. Managers should evaluate these costs against expected loss, legal exposure, operational disruption, and decision quality. Governance is an ongoing capability, not a one-time compliance project.

Chapter Summary

Spreadsheet governance is a strategic supply chain capability because spreadsheet outputs can influence purchasing, inventory, suppliers, service levels, finances, and regulatory reporting. Effective governance establishes clear ownership, role-based access, separation of duties, documentation, audit trails, controlled change, independent validation, and lifecycle management.

Security protects confidentiality, integrity, and availability, while privacy governs the legitimate and proportionate use of personal information. Compliance establishes mandatory requirements, but ethical practice goes further by addressing fairness, transparency, contestability, and human consequences. Model validation should examine concepts, data, calculations, implementation, outputs, and use. Reconciliation, boundary testing, version control, backups, and incident response reduce practical risk.

The appropriate response is not to eliminate spreadsheets automatically. It is to classify them, apply proportionate controls, monitor residual risk, and migrate critical processes to stronger platforms when justified. Responsible governance turns spreadsheets from fragile personal artifacts into accountable components of supply chain decision systems.

Key Terms

Audit trail: A record of changes, users, dates, reasons, approvals, and evidence.

Business owner: The person accountable for a spreadsheet’s purpose, use, and accepted risk.

Change management: Controlled evaluation, approval, testing, and release of modifications.

Confidentiality: Protection against unauthorized access or disclosure.

Control total: An independently calculated total used to detect omissions or inconsistencies.

Data dictionary: Documentation defining fields, meanings, formats, units, and ownership.

Data minimization: Collecting and retaining only data necessary for a legitimate purpose.

Defense in depth: Use of multiple complementary security and governance controls.

Independent validation: Review or testing performed by someone not responsible for developing the model.

Integrity: Assurance that data and calculations are accurate, complete, and protected from unauthorized alteration.

Least privilege: Providing only the access required for a person’s role.

Model risk: The possibility that a model is unsuitable, incorrectly implemented, or misused.

Personal data: Information relating to an identified or identifiable individual.

Residual risk: Risk remaining after controls are applied.

RACI: A framework identifying who is Responsible, Accountable, Consulted, and Informed.

Reconciliation: Comparison of results with an independent reference or control total.

Segregation of duties: Separation of incompatible responsibilities to reduce error or fraud.

Spreadsheet governance: Policies, roles, standards, and controls governing spreadsheet use.

Threat: A potential cause of harm, such as unauthorized access or malicious code.

Validation: Evidence that a spreadsheet is fit for its intended purpose.

Review Questions

Short Answer Questions

1. Why can a spreadsheet become an enterprise information system even when it was originally created for personal use?
2. Distinguish the responsibilities of a business owner, model developer, and independent reviewer.
3. What are the three objectives in the confidentiality, integrity, and availability triad?
4. Why is a version history alone insufficient as an audit trail?
5. Explain the difference between privacy compliance and ethical data use.

Long Answer Questions

1. Design a governance framework for a spreadsheet used to determine supplier purchase orders. Include roles, access controls, validation, change management, and contingency arrangements.
2. Explain how spreadsheet lifecycle management reduces operational and model risk from initiation through retirement.
3. Compare preventive, detective, and corrective controls, giving supply chain examples of each.
4. Discuss how privacy, cybersecurity, and regulatory compliance interact in a workbook containing supplier and employee information.
5. Evaluate the argument that all critical spreadsheets should immediately be replaced by enterprise software.

Analytical / Application Questions

1. A demand-planning workbook produces plausible forecasts but excludes a newly opened warehouse from its data range. Identify the control failures, tests, and corrective actions required before the workbook is reused.
2. A supplier scorecard uses late-delivery data but penalizes small suppliers whose reporting is less frequent. Analyze the fairness and data-quality risks and propose a responsible redesign.
3. A planner emails a workbook containing customer addresses to an external logistics partner. Develop an incident-response and prevention plan covering containment, access, privacy assessment, communication, and longer-term governance.

Multiple Choice Questions with Answers

Question 1

Which role is primarily accountable for the business purpose, approved use, and accepted risk of an important spreadsheet?

A. Business owner

B. End user

C. Platform administrator

D. Model developer

Correct Answer: A. Business owner

Question 2

Which control most directly supports the principle of least privilege?

A. Giving all planners edit access

B. Providing users only the permissions required for their roles

C. Saving multiple copies locally

D. Removing formula labels

Correct Answer: B. Providing users only the permissions required for their roles

Question 3

What is the main purpose of an audit trail?

A. To increase workbook size

B. To hide sensitive formulas

C. To reconstruct what changed, when, why, and by whom

D. To eliminate the need for testing

Correct Answer: C. To reconstruct what changed, when, why, and by whom

Question 4

Which activity is an example of independent model validation?

A. The developer checking the workbook once while building it

B. A user changing formulas without documentation

C. An unrelated reviewer recalculating selected outputs against known cases

D. Renaming the workbook after publication

Correct Answer: C. An unrelated reviewer recalculating selected outputs against known cases

Question 5

In the formula MAE = (1/n) ∑ᵢ₌₁ⁿ |Aᵢ − Fᵢ|, what does n represent?

A. The number of observations

B. The forecast value

C. The actual value for observation i

D. The absolute error

Correct Answer: A. The number of observations

Question 6

Which action best demonstrates data minimization?

A. Collecting every available employee field

B. Retaining personal data indefinitely

C. Collecting only fields necessary for the stated legitimate purpose

D. Sharing all fields with every supplier

Correct Answer: C. Collecting only fields necessary for the stated legitimate purpose

Question 7

Why are fixed spreadsheet ranges a risk when new warehouses or products are added?

A. They automatically encrypt the new rows

B. They may exclude new records from calculations

C. They prevent all users from viewing outputs

D. They guarantee independent validation

Correct Answer: B. They may exclude new records from calculations

Question 8

Which sequence best represents a controlled material change?

A. Edit, publish, then ask whether testing is needed

B. Request, assess, develop, test, review, approve, and release

C. Copy, rename, email, and delete the original

D. Change formulas directly in the production copy

Correct Answer: B. Request, assess, develop, test, review, approve, and release

Question 9

A zero reconciliation difference proves that a spreadsheet is completely correct. Is this statement valid?

A. Yes, because equal totals prove every record is correct

B. Yes, provided the file has a password

C. No, because identical or offsetting errors may still exist

D. No, because reconciliation is never useful

Correct Answer: C. No, because identical or offsetting errors may still exist

Question 10

What is the most appropriate response when an AI tool generates formulas for a sensitive supply chain workbook?

A. Use them without review because AI is automated

B. Test the formulas, protect confidential data, and retain human accountability

C. Publish them immediately if they look plausible

D. Disable all access controls

Correct Answer: B. Test the formulas, protect confidential data, and retain human accountability