Changing User Attitudes to Reduce Spreadsheet Risk

A business case study on how three simple guidelines: 1. Make it easy to check (and maintain) 2. Make it safe to use 3. Keep business logic out of code changed user attitudes and improved spreadsheet quality in a financial services organisation.

💡 Research Summary

This paper presents a business case study conducted within a large financial services organization, focusing on reducing spreadsheet error risk by fundamentally shifting user attitudes rather than solely relying on enhanced training. The study was initiated due to concerns over poor skill levels and faulty spreadsheets impacting business operations.

The research phase involved a multi-faceted investigation spanning several months. It drew upon existing spreadsheet error research from sources like EuSpRIG and Ray Panko, principles from software engineering and testing disciplines, and error prevention strategies from high-reliability industries such as aviation and nuclear power. Key learnings confirmed that errors are universal and inevitable, even among experts, and that while checking is essential, it is difficult to perform effectively and cannot eliminate all mistakes. An internal assessment revealed a lack of formal oversight, with IT focused on infrastructure and business managers preoccupied with daily operations, leading to self-taught users and ineffective past attempts at prescriptive “do/don’t” lists.

The core solution proposed was not a complex technical manual but a set of three simple, attitudinal safety guidelines inspired by the pervasive safety culture seen in mining industries: 1) Make it easy to check (and maintain), 2) Make it safe to use, and 3) Keep all business logic out of code. The first guideline shifts the designer’s mindset to build spreadsheets for others (checkers and future maintainers), emphasizing clarity, simplicity, documentation, and the inclusion of self-checks. The second guideline extends beyond calculation accuracy to encompass user safety, advocating for clear input grouping, data validation, cell protection, and unambiguous reporting to prevent misuse. The third guideline addresses maintainability by insisting that volatile business rules (e.g., commission rates) reside in worksheet cells, not within VBA code, keeping code generic and reusable. Strong, visible management support was identified as critical for embedding these principles into the organizational culture.

Implementation results were mixed, heavily dependent on local management buy-in. However, in groups where the guidelines were actively championed, significant quality improvements were observed: cleaner and simpler models, better documentation and testing, and a greater willingness to learn. The guidelines provided a non-confrontational framework for critique, focusing on the user experience rather than the developer’s skill. A surprising outcome was the positive reception from advanced users, who embraced the guidelines as a challenging new constraint that allowed them to showcase their skills through elegant simplification, not just complexity.

In conclusion, the case study demonstrates that user attitudes toward spreadsheet development can be effectively influenced by simple, attitudinal guidelines grounded in error management principles. These guidelines are not a substitute for training but create relevance for safety techniques and make users more receptive to skill development. Success hinges on strong managerial support to foster a cultural shift where safety and clarity become ingrained values in the spreadsheet development process.